OpenCloud
/
riot-web
mirror of https://github.com/vector-im/riot-web
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge pull request #514 from matrix-org/dbkr/prevent_email_spam 

Prevent spamming emails by reusing client secret
pull/21833/head
Richard van der Hoff 2016-10-12 14:40:39 +01:00 committed by GitHub
parent 213e3dab35 c45b076df9
commit 999a9e34b9
2 changed files with 17 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/Signup.js
View File

@ -130,6 +130,18 @@ class Register extends Signup {
this.password = password;
const client = this._createTemporaryClient();
this.activeStage = null;
// If there hasn't been a client secret set by this point,
// generate one for this session. It will only be used if
// we do email verification, but far simpler to just make
// sure we have one.
// We re-use this same secret over multiple calls to register
// so that the identity server can honour the sendAttempt
// parameter and not re-send email unless we actually want
// another mail to be sent.
if (!this.params.clientSecret) {
this.params.clientSecret = client.generateClientSecret();
}
return this._tryRegister(client);
}

6
src/SignupStages.js
View File

@ -116,7 +116,11 @@ class EmailIdentityStage extends Stage {
return this._completeVerify();
}
this.clientSecret = this.client.generateClientSecret();
this.clientSecret = this.signupInstance.params.clientSecret;
if (!this.clientSecret) {
return q.reject(new Error("No client secret specified by Signup class!"));
}
var nextLink = this.signupInstance.params.registrationUrl +
'?client_secret=' +
encodeURIComponent(this.clientSecret) +