Merge pull request #3468 from redbar0n/patch-2

Fix potential security leak in email reconfirmation flow
2026-04-28 03:00:29 -04:00 · 2015-02-14 10:58:25 +01:00
parent c19f1f27ce ee8c13435f
commit fbb7a21abc
1 changed files with 1 additions and 1 deletions
--- a/app/views/devise/confirmations/new.html.erb
+++ b/app/views/devise/confirmations/new.html.erb
@@ -5,7 +5,7 @@

  <div class="field">
    <%= f.label :email %><br />
-    <%= f.email_field :email, autofocus: true %>
+    <%= f.email_field :email, required: true, readonly: true, input_html: { value: (resource.pending_reconfirmation? ? resource.unconfirmed_email : resource.email) } %> 
  </div>

  <div class="actions">