[openstreetmap/openstreetmap-website] Re-arrange login and signup screens as discussed in #4128 (PR #4455)

[Anton Khorev]

@AntonKhorev commented on this pull request.



> @@ -101,14 +107,9 @@ def create
       if current_user.invalid?
         # Something is wrong with a new user, so rerender the form
         render :action => "new"
-      elsif current_user.auth_provider.present?
-        # Verify external authenticator before moving on
-        session[:new_user] = current_user.slice("email", "display_name", "pass_crypt", "pass_crypt_confirmation")

`session[:new_user]` filtered out other parameters such as `auth_provider` which was added later in `auth_success`. A new users was created from `session[:new_user]`.

With `session[:new_user]` gone its possible to create users with fake values for `auth_provider` by opening the signup form like this: `/user/new?auth_provider=test1&auth_uid=test1`

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/4455#pullrequestreview-2013475241
You are receiving this because you are subscribed to this thread.

Message ID: <openstreetmap/openstreetmap-website/pull/4455/review/2013475241 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20240421/0745a63d/attachment.htm>