Strengthen the tokens used in email reply addresses

[rails.git] / app / mailers / user_mailer.rb

diff --git a/app/mailers/user_mailer.rb b/app/mailers/user_mailer.rb
index bb4412e8a1927e4d702f3eeed884e785d51dc8db..89f8dfdbf781e66bb20533f2de5db71112e3ff85 100644 (file)
--- a/app/mailers/user_mailer.rb
+++ b/app/mailers/user_mailer.rb
@@ -12,7 +12,7 @@ class UserMailer < ApplicationMailer
 
   def signup_confirm(user, token)
     with_recipient_locale user do
-      @url = url_for(:controller => "users", :action => "confirm",
+      @url = url_for(:controller => "confirmations", :action => "confirm",
                      :display_name => user.display_name,
                      :confirm_string => token.token)
 
@@ -24,7 +24,7 @@ class UserMailer < ApplicationMailer
   def email_confirm(user, token)
     with_recipient_locale user do
       @address = user.new_email
-      @url = url_for(:controller => "users", :action => "confirm_email",
+      @url = url_for(:controller => "confirmations", :action => "confirm_email",
                      :confirm_string => token.token)
 
       mail :to => user.new_email,
@@ -34,7 +34,7 @@ class UserMailer < ApplicationMailer
 
   def lost_password(user, token)
     with_recipient_locale user do
-      @url = url_for(:controller => "users", :action => "reset_password",
+      @url = url_for(:controller => "passwords", :action => "reset_password",
                      :token => token.token)
 
       mail :to => user.email,
@@ -81,7 +81,7 @@ class UserMailer < ApplicationMailer
 
       attach_user_avatar(message.sender)
 
-      mail :from => from_address(message.sender.display_name, "m", message.id, message.digest),
+      mail :from => from_address(message.sender.display_name, "m", message.id, message.notification_token),
            :to => message.recipient.email,
            :subject => t(".subject", :message_title => message.title)
     end
@@ -102,7 +102,7 @@ class UserMailer < ApplicationMailer
 
       set_references("diary", comment.diary_entry)
 
-      mail :from => from_address(comment.user.display_name, "c", comment.id, comment.digest, recipient.id),
+      mail :from => from_address(comment.user.display_name, "c", comment.id, comment.notification_token(recipient.id), recipient.id),
            :to => recipient.email,
            :subject => t(".subject", :user => comment.user.display_name)
     end
@@ -123,7 +123,7 @@ class UserMailer < ApplicationMailer
 
   def note_comment_notification(comment, recipient)
     with_recipient_locale recipient do
-      @noteurl = browse_note_url(comment.note)
+      @noteurl = note_url(comment.note)
       @place = Nominatim.describe_location(comment.note.lat, comment.note.lon, 14, I18n.locale)
       @comment = comment.body
       @owner = recipient == comment.note.author
@@ -183,24 +183,41 @@ class UserMailer < ApplicationMailer
   end
 
   def attach_project_logo
-    attachments.inline["logo.png"] = File.read(Rails.root.join("app/assets/images/osm_logo_30.png"))
+    attachments.inline["logo.png"] = Rails.root.join("app/assets/images/osm_logo_30.png").read
   end
 
   def attach_user_avatar(user)
-    attachments.inline["avatar.png"] = user_avatar_file(user)
+    @avatar = user_avatar_filename(user)
+    attachments.inline[@avatar] = user_avatar_file(user)
+  end
+
+  def user_avatar_filename(user)
+    avatar = user&.avatar
+    if avatar&.attached?
+      case avatar.content_type
+      when "image/png" then "avatar.png"
+      when "image/jpeg" then "avatar.jpg"
+      when "image/gif" then "avatar.gif"
+      when "image/bmp" then "avatar.bmp"
+      when "image/tiff" then "avatar.tif"
+      when "image/svg+xml" then "avatar.svg"
+      else "avatar"
+      end
+    else
+      "avatar.png"
+    end
   end
 
   def user_avatar_file(user)
     avatar = user&.avatar
     if avatar&.attached?
       if avatar.variable?
-        image = avatar.variant(:resize => "50x50>").processed
-        image.service.download(image.key)
+        avatar.variant(:resize_to_limit => [50, 50]).download
       else
         avatar.blob.download
       end
     else
-      File.read(Rails.root.join("app/assets/images/avatar_small.png"))
+      Rails.root.join("app/assets/images/avatar_small.png").read
     end
   end
 
@@ -208,12 +225,12 @@ class UserMailer < ApplicationMailer
     I18n.with_locale(Locale.available.preferred(recipient.preferred_languages), &block)
   end
 
-  def from_address(name, type, id, digest, user_id = nil)
+  def from_address(name, type, id, token, user_id = nil)
     if Settings.key?(:messages_domain) && domain = Settings.messages_domain
       if user_id
-        "#{name} <#{type}-#{id}-#{user_id}-#{digest[0, 6]}@#{domain}>"
+        "#{name} <#{type}-#{id}-#{user_id}-#{token}@#{domain}>"
       else
-        "#{name} <#{type}-#{id}-#{digest[0, 6]}@#{domain}>"
+        "#{name} <#{type}-#{id}-#{token}@#{domain}>"
       end
     else
       Settings.email_from