plataformatec/devise — Issue #1530: reconfirmable: Token doesn't change when changing email address multiple times.
Author: lmanners
Created: 2011-12-29 08:16:24+00:00
State: open

When you change an email address multiple times, the token doesn't change.

This is a bit of a security problem in the case where a user mistypes an email address, then fixes it. As the recipient of the first email can still activate the account.

NOTE:
I was able to work around this issue by setting confrimation_token = nil myself whenever a user changes the email.