Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add confirmationToken to user for email confirmation #8365

Merged
merged 2 commits into from Oct 16, 2020

Conversation

alexandrebodin
Copy link
Member

@alexandrebodin alexandrebodin commented Oct 16, 2020

Signed-off-by: Alexandre Bodin bodin.alex@gmail.com

What does it do?

Adds a confirmationToken to use in the email confirmation instead of a valid jwt token.

We will need to explain how to add this field manually for users that did extend the User model. Will create a specific migration guide

@alexandrebodin alexandrebodin requested a review from a team as a code owner October 16, 2020 14:54
@alexandrebodin alexandrebodin added this to the 3.2.4 milestone Oct 16, 2020
@codecov
Copy link

codecov bot commented Oct 16, 2020

Codecov Report

Merging #8365 into master will decrease coverage by 0.00%.
The diff coverage is 0.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #8365      +/-   ##
==========================================
- Coverage   33.20%   33.19%   -0.01%     
==========================================
  Files        1220     1220              
  Lines       13616    13618       +2     
  Branches     1356     1357       +1     
==========================================
  Hits         4521     4521              
- Misses       8211     8212       +1     
- Partials      884      885       +1     
Flag Coverage Δ
#front 24.72% <ø> (ø)
#unit 54.45% <0.00%> (-0.03%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
packages/strapi-utils/lib/models.js 25.00% <0.00%> (-0.32%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 9b62d98...bf18c2b. Read the comment docs.

@alexandrebodin alexandrebodin force-pushed the fix/email-confirmation-jwt branch 2 times, most recently from c132b90 to ae61688 Compare October 16, 2020 15:16
@alexandrebodin alexandrebodin requested a review from a team as a code owner October 16, 2020 15:16
derrickmehaffy
derrickmehaffy previously approved these changes Oct 16, 2020
Copy link
Member

@derrickmehaffy derrickmehaffy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Migration guide looks good to me.

meganelacheny
meganelacheny previously approved these changes Oct 16, 2020
Signed-off-by: Alexandre Bodin <bodin.alex@gmail.com>
Copy link
Contributor

@petersg83 petersg83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works well on my side. Just a typo and a suggestion.

const decodedToken = await strapi.plugins['users-permissions'].services.jwt.verify(
params.confirmation
);
const { user: userServie, jwt: jwtService } = strapi.plugins['users-permissions'].services;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

userService

}
```

That's it now you can follow the basic [version update guide](../guides/update-version.md).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What about adding a coma : That's it, now you can follow the basic ...?

@petersg83 petersg83 added the source: plugin:users-permissions Source is plugin/users-permissions package label Oct 16, 2020
Signed-off-by: Alexandre Bodin <bodin.alex@gmail.com>
@petersg83 petersg83 added the issue: security Issue reporting a security problem label Oct 16, 2020
Copy link
Contributor

@petersg83 petersg83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM !

@alexandrebodin alexandrebodin merged commit 0494121 into master Oct 16, 2020
@alexandrebodin alexandrebodin deleted the fix/email-confirmation-jwt branch October 16, 2020 16:16
@lauriejim
Copy link
Contributor

This pull request has been mentioned on Strapi Community. There might be relevant details there:

https://forum.strapi.io/t/new-release-strapi-v3-2-4-security-fix/509/1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
issue: security Issue reporting a security problem source: plugin:users-permissions Source is plugin/users-permissions package
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants