forked from OpenNeo/impress
Emi Matchu
58d86cf3ac
Oh right, if you can remove your email, there's a way to fully lock out your account: 1. Create account via NeoPass, so no password is set. 2. Ensure you have an email saved, then disconnect NeoPass. 3. Remove the email. 4. Now you have no NeoPass, no email, and no password! In this change, we add a validation that requires an account to always have at least one login method. This works well for the case described above, and also helps offer server-side validation to the "can't disconnect NeoPass until you have an email and password" stuff that previously was only enforced by disabling the button. That is, the following procedure could also lock you out before, whereas now it raises the "Whoops, there was an error disconnecting your NeoPass from your account, sorry." message: 1. Create account via NeoPass, so no password is set. 2. Ensure you have an email saved, so "Disconnect" button is enabled. 3. Open a new browser tab, and remove the email. 4. In the original browser tab, click "Disconnect". |
||
|---|---|---|
| .. | ||
| assets | ||
| controllers | ||
| helpers | ||
| javascript | ||
| mailers/fundraising | ||
| models | ||
| services | ||
| views | ||