Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-04-08 02:52:39 -05:00
Code Issues Activity

Used dedicated email address change endpoint

Browse source 
refs https://github.com/TryGhost/Ghost/security/advisories/GHSA-65p7-pjj8-ggmr

We were originally overloading the signup/signin flow for changing email
addresses, which was a security flaw because this route is
unauthenticated. This functionality has been removed and replaced with a
dedicated flow.
This commit is contained in:
Fabien O'Carroll 2021-09-22 14:24:45 +02:00
parent 7e7cfb5227
commit d82c15619d
2 changed files with 25 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ghost/portal/src/actions.js
View file

@ -262,7 +262,7 @@ async function updateMemberEmail({data, state, api}) {
const originalEmail = getMemberEmail({member: state.member});
if (email !== originalEmail) {
try {
await api.member.sendMagicLink({email, oldEmail: originalEmail, emailType: 'updateEmail'});
await api.member.updateEmailAddress({email});
return {
success: true
};

24
ghost/portal/src/utils/api.js
View file

@ -171,6 +171,30 @@ function setupGhostApi({siteUrl = window.location.origin}) {
});
},
async updateEmailAddress({email}) {
const identity = await api.member.identity();
const url = endpointFor({type: 'members', resource: 'member/email'});
const body = {
email,
identity
};
return makeRequest({
url,
method: 'POST',
headers: {
'Content-Type': 'application/json'
},
body: JSON.stringify(body)
}).then(function (res) {
if (res.ok) {
return 'Success';
} else {
throw new Error('Failed to send email address verification email');
}
});
},
async checkoutPlan({plan, cancelUrl, successUrl, email: customerEmail, name, metadata = {}} = {}) {
const siteUrlObj = new URL(siteUrl);
const identity = await api.member.identity();