diff options
| author | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:27:12 +0000 |
|---|---|---|
| committer | Steve Azzopardi <sazzopardi@gitlab.com> | 2018-11-26 08:27:12 +0000 |
| commit | 778d14b1f06d457221c887d1e22ff71080a8d169 (patch) | |
| tree | 1d8384f25120294882dec325532d1b90bd11a781 | |
| parent | 9ec0a08afee8eebbfb19ba39761a3cea16089feb (diff) | |
| parent | 91116ef63aff5d950406c1c247bc4cf00ef109d2 (diff) | |
| download | gitlab-ce-778d14b1f06d457221c887d1e22ff71080a8d169.tar.gz | |
Merge branch 'security-email-change-notification-11-3' into 'security-11-3'
[11.3] Resolve: "Provide email notification when a user changes their email address"
See merge request gitlab/gitlabhq!2604
| -rw-r--r-- | app/views/devise/mailer/email_changed.html.haml | 12 | ||||
| -rw-r--r-- | app/views/devise/mailer/email_changed.text.erb | 10 | ||||
| -rw-r--r-- | changelogs/unreleased/security-email-change-notification.yml | 5 | ||||
| -rw-r--r-- | config/initializers/devise.rb | 3 | ||||
| -rw-r--r-- | doc/workflow/notifications.md | 2 |
5 files changed, 32 insertions, 0 deletions
diff --git a/app/views/devise/mailer/email_changed.html.haml b/app/views/devise/mailer/email_changed.html.haml new file mode 100644 index 00000000000..5398430fdfd --- /dev/null +++ b/app/views/devise/mailer/email_changed.html.haml @@ -0,0 +1,12 @@ += email_default_heading("Hello, #{@resource.name}!") + +- if @resource.try(:unconfirmed_email?) + %p + We're contacting you to notify you that your email is being changed to #{@resource.reload.unconfirmed_email}. +- else + %p + We're contacting you to notify you that your email has been changed to #{@resource.email}. + +%p + If you did not initiate this change, please contact your administrator + immediately. diff --git a/app/views/devise/mailer/email_changed.text.erb b/app/views/devise/mailer/email_changed.text.erb new file mode 100644 index 00000000000..18137389e7b --- /dev/null +++ b/app/views/devise/mailer/email_changed.text.erb @@ -0,0 +1,10 @@ +Hello, <%= @resource.name %>! + +<% if @resource.try(:unconfirmed_email?) %> +We're contacting you to notify you that your email is being changed to <%= @resource.reload.unconfirmed_email %>. +<% else %> +We're contacting you to notify you that your email has been changed to <%= @resource.email %>. +<% end %> + +If you did not initiate this change, please contact your administrator +immediately. diff --git a/changelogs/unreleased/security-email-change-notification.yml b/changelogs/unreleased/security-email-change-notification.yml new file mode 100644 index 00000000000..45075ff20bb --- /dev/null +++ b/changelogs/unreleased/security-email-change-notification.yml @@ -0,0 +1,5 @@ +--- +title: Provide email notification when a user changes their email address +merge_request: +author: +type: security diff --git a/config/initializers/devise.rb b/config/initializers/devise.rb index c41b2db722c..d2fea1c4aef 100644 --- a/config/initializers/devise.rb +++ b/config/initializers/devise.rb @@ -103,6 +103,9 @@ Devise.setup do |config| # Send a notification email when the user's password is changed config.send_password_change_notification = true + # Send a notification email when the user's email is changed + config.send_email_changed_notification = true + # ==> Configuration for :validatable # Range for password length. Default is 6..128. config.password_length = 8..128 diff --git a/doc/workflow/notifications.md b/doc/workflow/notifications.md index 731c9209224..0cd831b111a 100644 --- a/doc/workflow/notifications.md +++ b/doc/workflow/notifications.md @@ -63,6 +63,8 @@ Below is the table of events users can be notified of: |------------------------------|-------------------------------------------------------------------|------------------------------| | New SSH key added | User | Security email, always sent. | | New email added | User | Security email, always sent. | +| Email changed | User | Security email, always sent. | +| Password changed | User | Security email, always sent. | | New user created | User | Sent on user creation, except for omniauth (LDAP)| | User added to project | User | Sent when user is added to project | | Project access level changed | User | Sent when user project access level is changed | |