Add canonical e-mail blocks for suspended accounts (#16049)
Prevent new accounts from being created using the same underlying e-mail as a suspended account using extensions and period permutations. Stores e-mails as a SHA256 hash
This commit is contained in:
parent
170e05db12
commit
b3ceb3dcc4
9 changed files with 172 additions and 21 deletions
|
@ -6,26 +6,25 @@ class BlacklistedEmailValidator < ActiveModel::Validator
|
|||
|
||||
@email = user.email
|
||||
|
||||
user.errors.add(:email, :blocked) if blocked_email?
|
||||
user.errors.add(:email, :blocked) if blocked_email_provider?
|
||||
user.errors.add(:email, :taken) if blocked_canonical_email?
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def blocked_email?
|
||||
on_blacklist? || not_on_whitelist?
|
||||
def blocked_email_provider?
|
||||
disallowed_through_email_domain_block? || disallowed_through_configuration? || not_allowed_through_configuration?
|
||||
end
|
||||
|
||||
def on_blacklist?
|
||||
return true if EmailDomainBlock.block?(@email)
|
||||
return false if Rails.configuration.x.email_domains_blacklist.blank?
|
||||
|
||||
domains = Rails.configuration.x.email_domains_blacklist.gsub('.', '\.')
|
||||
regexp = Regexp.new("@(.+\\.)?(#{domains})", true)
|
||||
|
||||
regexp.match?(@email)
|
||||
def blocked_canonical_email?
|
||||
CanonicalEmailBlock.block?(@email)
|
||||
end
|
||||
|
||||
def not_on_whitelist?
|
||||
def disallowed_through_email_domain_block?
|
||||
EmailDomainBlock.block?(@email)
|
||||
end
|
||||
|
||||
def not_allowed_through_configuration?
|
||||
return false if Rails.configuration.x.email_domains_whitelist.blank?
|
||||
|
||||
domains = Rails.configuration.x.email_domains_whitelist.gsub('.', '\.')
|
||||
|
@ -33,4 +32,13 @@ class BlacklistedEmailValidator < ActiveModel::Validator
|
|||
|
||||
@email !~ regexp
|
||||
end
|
||||
|
||||
def disallowed_through_configuration?
|
||||
return false if Rails.configuration.x.email_domains_blacklist.blank?
|
||||
|
||||
domains = Rails.configuration.x.email_domains_blacklist.gsub('.', '\.')
|
||||
regexp = Regexp.new("@(.+\\.)?(#{domains})", true)
|
||||
|
||||
regexp.match?(@email)
|
||||
end
|
||||
end
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue