From f2dcbcd7102047597f860a995e06e5d41b5bebfc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?= Date: Thu, 8 Feb 2018 10:23:47 -0500 Subject: [PATCH] closes #6318 --- src/user/email.js | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/src/user/email.js b/src/user/email.js index 9c61211d9a..598536ad29 100644 --- a/src/user/email.js +++ b/src/user/email.js @@ -126,14 +126,24 @@ UserEmail.sendValidationEmail = function (uid, options, callback) { }; UserEmail.confirm = function (code, callback) { + var confirmObj; async.waterfall([ function (next) { db.getObject('confirm:' + code, next); }, - function (confirmObj, next) { + function (_confirmObj, next) { + confirmObj = _confirmObj; if (!confirmObj || !confirmObj.uid || !confirmObj.email) { return next(new Error('[[error:invalid-data]]')); } + + user.getUserField(confirmObj.uid, 'email', next); + }, + function (currentEmail, next) { + if (!currentEmail || currentEmail.toLowerCase() !== confirmObj.email) { + return next(new Error('[[error:invalid-email]]')); + } + async.series([ async.apply(user.setUserField, confirmObj.uid, 'email:confirmed', 1), async.apply(db.delete, 'confirm:' + code),