mirrors/element-web
1
0
Fork 0
mirror of https://github.com/element-hq/element-web synced 2024-10-24 19:55:54 +03:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #514 from matrix-org/dbkr/prevent_email_spam

Browse source 
Prevent spamming emails by reusing client secret
This commit is contained in:
Richard van der Hoff 2016-10-12 14:40:39 +01:00 committed by GitHub
commit 999a9e34b9
2 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
src/Signup.js
View file

@ -130,6 +130,18 @@ class Register extends Signup {
this.password = password; this.password = password;
const client = this._createTemporaryClient(); const client = this._createTemporaryClient();
this.activeStage = null; this.activeStage = null;
// If there hasn't been a client secret set by this point,
// generate one for this session. It will only be used if
// we do email verification, but far simpler to just make
// sure we have one.
// We re-use this same secret over multiple calls to register
// so that the identity server can honour the sendAttempt
// parameter and not re-send email unless we actually want
// another mail to be sent.
if (!this.params.clientSecret) {
this.params.clientSecret = client.generateClientSecret();
}
return this._tryRegister(client); return this._tryRegister(client);
} }

6
src/SignupStages.js
View file

@ -116,7 +116,11 @@ class EmailIdentityStage extends Stage {
return this._completeVerify(); return this._completeVerify();
} }
this.clientSecret = this.client.generateClientSecret(); this.clientSecret = this.signupInstance.params.clientSecret;
if (!this.clientSecret) {
return q.reject(new Error("No client secret specified by Signup class!"));
}
var nextLink = this.signupInstance.params.registrationUrl + var nextLink = this.signupInstance.params.registrationUrl +
'?client_secret=' + '?client_secret=' +
encodeURIComponent(this.clientSecret) + encodeURIComponent(this.clientSecret) +