From daf71573d0e5f1376264c7d32cf55fae284ba9e5 Mon Sep 17 00:00:00 2001 From: Eugen Rochko Date: Fri, 24 Jan 2020 00:20:38 +0100 Subject: Fix password change/reset not immediately invalidating other sessions (#12928) While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker. --- app/models/user.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'app/models') diff --git a/app/models/user.rb b/app/models/user.rb index a43e63b2e..058a8d5f8 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -247,7 +247,7 @@ class User < ApplicationRecord ip: request.remote_ip).session_id end - def exclusive_session(id) + def clear_other_sessions(id) session_activations.exclusive(id) end -- cgit