Check if email token belongs to a user before verifying the email

This commit is contained in:
jvyden 2022-03-02 21:48:14 -05:00
commit 96e739a8fe
No known key found for this signature in database
GPG key ID: 18BCF2BE0262B278

View file

@ -28,6 +28,12 @@ public class CompleteEmailVerificationPage : BaseLayout
return this.Page();
}
if (emailVerifyToken.UserId != user.UserId)
{
this.Error = "This token doesn't belong to you!";
return this.Page();
}
this.Database.EmailVerificationTokens.Remove(emailVerifyToken);
user.EmailAddressVerified = true;