Do not autologin if more that one token is found (#3351).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2742 e93f8b46-1217-0410-a6f0-8f06a7374b81

Do not autologin if more that one token is found (#3351).
git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2742 e93f8b46-1217-0410-a6f0-8f06a7374b81
b87753c9 · Jean-Philippe Lang · f5eb1be2 · b87753c9
Commit b87753c9 authored May 13, 2009 by Jean-Philippe Lang
Hide whitespace changes
Inline Side-by-side

Showing with 8 additions and 4 deletions

user.rb app/models/user.rb +8 -4

No files found.
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -128,10 +128,14 @@ class User < ActiveRecord::Base
  
  # Returns the user who matches the given autologin +key+ or nil
  def self.try_to_autologin(key)
-    token = Token.find_by_action_and_value('autologin', key)
-    if token && (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?
-      token.user.update_attribute(:last_login_on, Time.now)
-      token.user
+    tokens = Token.find_all_by_action_and_value('autologin', key)
+    # Make sure there's only 1 token that matches the key
+    if tokens.size == 1
+      token = tokens.first
+      if (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?
+        token.user.update_attribute(:last_login_on, Time.now)
+        token.user
+      end
    end
  end