Eugen Rochko daf71573d0 Fix password change/reset not immediately invalidating other sessions (#12928) ... While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker.		2020-01-24 00:20:38 +01:00
..
challenges_controller.rb	Add password challenge to 2FA settings, e-mail notifications (#11878)	2019-09-18 16:37:27 +02:00
confirmations_controller.rb	Fix wrong variable regression from #11753 (#11763)	2019-09-05 06:13:50 +02:00
omniauth_callbacks_controller.rb	Change unconfirmed user login behaviour (#11375)	2019-07-22 10:48:50 +02:00
passwords_controller.rb	Fix password change/reset not immediately invalidating other sessions (#12928)	2020-01-24 00:20:38 +01:00
registrations_controller.rb	Fix password change/reset not immediately invalidating other sessions (#12928)	2020-01-24 00:20:38 +01:00
sessions_controller.rb	Fix authentication before 2FA challenge (#11943)	2019-09-24 04:35:36 +02:00
setup_controller.rb	Change unconfirmed user login behaviour (#11375)	2019-07-22 10:48:50 +02:00