app/controllers/users_controller.rb
# GET and POST for :collection route /users/recover_account
GET and POST for :collection route /users/recover_account
GET and POST for : collection route / users / recover_account
def recover_account
    if request.post? && params[:user]
      if params[:commit_choose_account]
        user = User.find(params[:user][:id]) rescue nil
        if user.nil?
          @users = User.find_all_by_email(params[:user][:email].strip)
          flash.now[:error] = I18n.t('users.recover_account_choose_account.errors.user_not_found_choose_again')
          render action: 'recover_account_choose_account' and return
        end
      else
        @users = User.find_all_by_email(params[:user][:email].strip)
        if @users.blank?
          flash.now[:error] = I18n.t('users.recover_account.errors.user_not_found_by_email_address')
          return
        elsif @users.size > 1
          render action: 'recover_account_choose_account' and return
        end
        user = @users.first
      end
      if user.hidden?
        raise EOL::Exceptions::SecurityViolation.new(
          "Hidden User with ID=#{user.id} attempted to recover their account and was disallowed.",
          :hidden_user_recover_account)
      end
      user.update_column(:recover_account_token, User.generate_key)
      user.update_column(:recover_account_token_expires_at, 24.hours.from_now)
      user.expire_primary_index
      user.reload 
      if user.recover_account_token =~ /^[a-f0-9]{40}$/ && !user.recover_account_token_expired?
        Notifier.user_recover_account(user, temporary_login_user_url(user, user.recover_account_token)).deliver
        flash[:notice] = I18n.t('users.recover_account.notices.recovery_email_sent', from_address: $NO_REPLY_EMAIL_ADDRESS)
        redirect_to login_path and return
      else
        flash.now[:error] = I18n.t('users.recover_account.errors.unable_to_update_token')
      end
    end
  end
def recover_account if request . post? && params [ :user ] if params [ :commit_choose_account ] user = User . find ( params [ :user ] [ :id ] ) rescue nil if user . nil? @users = User . find_all_by_email ( params [ :user ] [ :email ] . strip ) flash . now [ :error ] = I18n . t ( 'users.recover_account_choose_account.errors.user_not_found_choose_again' ) render action : 'recover_account_choose_account' and return end else @users = User . find_all_by_email ( params [ :user ] [ :email ] . strip ) if @users . blank? flash . now [ :error ] = I18n . t ( 'users.recover_account.errors.user_not_found_by_email_address' ) return elsif @users . size > 1 render action : 'recover_account_choose_account' and return end user = @users . first end if user . hidden? raise EOL :: Exceptions :: SecurityViolation . new ( "Hidden User with ID=#{user.id} attempted to recover their account and was disallowed." , :hidden_user_recover_account ) end user . update_column ( :recover_account_token , User . generate_key ) user . update_column ( :recover_account_token_expires_at , 24 . hours . from_now ) user . expire_primary_index user . reload if user . recover_account_token =~ / ^[a-f0-9]{40}$ / && ! user . recover_account_token_expired? Notifier . user_recover_account ( user , temporary_login_user_url ( user , user . recover_account_token ) ) . deliver flash [ :notice ] = I18n . t ( 'users.recover_account.notices.recovery_email_sent' , from_address : $NO_REPLY_EMAIL_ADDRESS ) redirect_to login_path and return else flash . now [ :error ] = I18n . t ( 'users.recover_account.errors.unable_to_update_token' ) end end end
GET and POST for :collection route /users/recover_account
GET and POST for : collection route / users / recover_account
# Bypass validation errors on user model # Just to ensure everything is dandy in the database (TODO: will slave cause problems?)