You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Eugen Rochko e4aa4a1c28 Fix password change/reset not immediately invalidating other sessions (#12928) ... While making browser requests in the other sessions after a password change or reset does not allow you to be logged in and correctly invalidates the session making the request, sessions have API tokens associated with them, which can still be used until that session is invalidated. This is a security issue for accounts that were already compromised some other way because it makes it harder to throw out the hijacker.		5 years ago
..
challenges_controller.rb	Add password challenge to 2FA settings, e-mail notifications (#11878)	5 years ago
confirmations_controller.rb	Fix wrong variable regression from #11753 (#11763)	5 years ago
omniauth_callbacks_controller.rb	Change unconfirmed user login behaviour (#11375)	5 years ago
passwords_controller.rb	Fix password change/reset not immediately invalidating other sessions (#12928)	5 years ago
registrations_controller.rb	Fix password change/reset not immediately invalidating other sessions (#12928)	5 years ago
sessions_controller.rb	Fix authentication before 2FA challenge (#11943)	5 years ago
setup_controller.rb	Change unconfirmed user login behaviour (#11375)	5 years ago