diff options
| author | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:26:35 +0000 |
|---|---|---|
| committer | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:26:35 +0000 |
| commit | 2f668e408d804d56275f2c85f447b539b3f844a4 (patch) | |
| tree | 91989f4c60668392aebd3b561a93c33b280c3fba | |
| parent | 1bb764aaa279f1badde793cd241d347a24fdb172 (diff) | |
| parent | 11f06eea6df058ac342811138597081eafb1de65 (diff) | |
| download | gitlab-ce-2f668e408d804d56275f2c85f447b539b3f844a4.tar.gz | |
Merge branch 'security-email-change-notification-11-5' into 'security-11-5'
[11.5] Resolve: "Provide email notification when a user changes their email address"
See merge request gitlab/gitlabhq!2602
| -rw-r--r-- | app/views/devise/mailer/email_changed.html.haml | 12 | ||||
| -rw-r--r-- | app/views/devise/mailer/email_changed.text.erb | 10 | ||||
| -rw-r--r-- | changelogs/unreleased/security-email-change-notification.yml | 5 | ||||
| -rw-r--r-- | config/initializers/devise.rb | 3 | ||||
| -rw-r--r-- | doc/workflow/notifications.md | 2 |
5 files changed, 32 insertions, 0 deletions
diff --git a/app/views/devise/mailer/email_changed.html.haml b/app/views/devise/mailer/email_changed.html.haml new file mode 100644 index 00000000000..5398430fdfd --- /dev/null +++ b/app/views/devise/mailer/email_changed.html.haml @@ -0,0 +1,12 @@ += email_default_heading("Hello, #{@resource.name}!") + +- if @resource.try(:unconfirmed_email?) + %p + We're contacting you to notify you that your email is being changed to #{@resource.reload.unconfirmed_email}. +- else + %p + We're contacting you to notify you that your email has been changed to #{@resource.email}. + +%p + If you did not initiate this change, please contact your administrator + immediately. diff --git a/app/views/devise/mailer/email_changed.text.erb b/app/views/devise/mailer/email_changed.text.erb new file mode 100644 index 00000000000..18137389e7b --- /dev/null +++ b/app/views/devise/mailer/email_changed.text.erb @@ -0,0 +1,10 @@ +Hello, <%= @resource.name %>! + +<% if @resource.try(:unconfirmed_email?) %> +We're contacting you to notify you that your email is being changed to <%= @resource.reload.unconfirmed_email %>. +<% else %> +We're contacting you to notify you that your email has been changed to <%= @resource.email %>. +<% end %> + +If you did not initiate this change, please contact your administrator +immediately. diff --git a/changelogs/unreleased/security-email-change-notification.yml b/changelogs/unreleased/security-email-change-notification.yml new file mode 100644 index 00000000000..45075ff20bb --- /dev/null +++ b/changelogs/unreleased/security-email-change-notification.yml @@ -0,0 +1,5 @@ +--- +title: Provide email notification when a user changes their email address +merge_request: +author: +type: security diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index 179e00cdbd0..67eabb0b4fc 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -103,6 +103,9 @@ Devise.setup do |config| # Send a notification email when the user's password is changed config.send_password_change_notification = true + # Send a notification email when the user's email is changed + config.send_email_changed_notification = true + # ==> Configuration for :validatable # Range for password length. Default is 6..128. config.password_length = 8..128 diff --git a/doc/workflow/notifications.md b/doc/workflow/notifications.md index c590ac4b0ba..020aa73f809 100644 --- a/doc/workflow/notifications.md +++ b/doc/workflow/notifications.md @@ -64,6 +64,8 @@ Below is the table of events users can be notified of: |------------------------------|-------------------------------------------------------------------|------------------------------| | New SSH key added | User | Security email, always sent. | | New email added | User | Security email, always sent. | +| Email changed | User | Security email, always sent. | +| Password changed | User | Security email, always sent. | | New user created | User | Sent on user creation, except for omniauth (LDAP)| | User added to project | User | Sent when user is added to project | | Project access level changed | User | Sent when user project access level is changed | |