Prevent CSRF bypass updating account details

[rails.git] / app / models / user_token.rb

diff --git a/app/models/user_token.rb b/app/models/user_token.rb
index 9a754d3442c5deeec13b6b35be7e6e59013dc772..8c9bf4aeb36de68479d11533e406f9106877da4b 100644 (file)
--- a/app/models/user_token.rb
+++ b/app/models/user_token.rb
@@ -1,14 +1,36 @@
-class UserToken < ActiveRecord::Base
-  belongs_to :user
+# == Schema Information
+#
+# Table name: user_tokens
+#
+#  id      :bigint(8)        not null, primary key
+#  user_id :bigint(8)        not null
+#  token   :string           not null
+#  expiry  :datetime         not null
+#  referer :text
+#
+# Indexes
+#
+#  user_tokens_token_idx    (token) UNIQUE
+#  user_tokens_user_id_idx  (user_id)
+#
+# Foreign Keys
+#
+#  user_tokens_user_id_fkey  (user_id => users.id)
+#
 
-  attr_accessible :referer
+class UserToken < ApplicationRecord
+  belongs_to :user
 
   after_initialize :set_defaults
 
-private
+  def expired?
+    expiry < Time.now
+  end
+
+  private
 
   def set_defaults
-    self.token = OSM::make_token() if self.token.blank?
-    self.expiry = 1.week.from_now if self.expiry.blank?
+    self.token = OSM.make_token if token.blank?
+    self.expiry = 1.week.from_now if expiry.blank?
   end
 end