Commits on Nov 10, 2020

1. Manager and web: don't pass authenticator to account_finish.php …

   If you attach to a project using the Manager, as a "new user",
   the Manager finishes the process by opening a browser window
   to account_finish.php on that project,
   which asks you for your name, country, and (optionally) postal code.
   It passes the authenticator to this script;
   this could be viewed as a security risk.
   
   I changed things so that:
   - the Manager doesn't pass the authenticator
   - account_finish.php asks you to log in (with email/passwd).
   
   Compatibility issues:
   Old manager, new project: no problem.  User will see login form.
   New manager, old project: user will see confusing "no such user" message

   

   davidpanderson committed Nov 10, 2020
   Configuration menu

   • View commit details
   • Copy full SHA for e46c83e
   • Browse repository at this point

   Copy the full SHA

   e46c83e View commit details

   Browse the repository at this point in the history