asxpi/asxpio
asxpi/asxpio
1
0
Fork 0
Code Issues Pull requests Packages 1 Activity Actions

admin: invite links without a username
All checks were successful
Build and Deploy to Production / test (push) Successful in 25s
Details
Build and Deploy to Production / build (push) Successful in 1m2s
Details
Build and Deploy to Production / deploy (push) Successful in 38s
Details

Browse source 
Leaving the username empty when creating a user makes the account
invite-<hex>; the invitee picks the real username on the invite page
(taken names and the invite- prefix are refused). Without an email this
gives a plain invite link to share.

Assisted-by: Claude:opus-5
This commit is contained in:
Sergei Poljanski 2026-10-10 09:12:21 +04:00
commit 78ea9926e7
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
6 changed files with 57 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
views/admin/set_password.erb
View file

@ -1,13 +1,17 @@
<div class="header">
<h1><%= @purpose == 'invite' ? 'Welcome' : 'Reset password' %></h1>
<p class="tagline">Set a password for <b><%= @token.user.username %></b></p>
<p class="tagline"><% if @token.user.choose_username %>Choose a username and password<% else %>Set a password for <b><%= @token.user.username %></b><% end %></p>
</div>
<section class="section">
<% if @error %><div class="form-error-base"><div><%= @error %></div></div><% end %>
<form class="invoice-form auth-form" method="post" action="/admin/<%= @purpose %>/<%= params[:token] %>">
<input type="hidden" name="authenticity_token" value="<%= csrf_token %>" />
<input type="text" name="username" value="<%= @token.user.username %>" autocomplete="username" hidden />
<% if @token.user.choose_username %>
<div class="field"><label for="username">Username <span class="optional">(lowercase letters, digits, . _ @ -)</span></label><input type="text" id="username" name="username" value="<%= params[:username] %>" autocomplete="username" autocapitalize="none" pattern="[a-z0-9][a-z0-9_.@-]{1,63}" required autofocus /></div>
<% else %>
<input type="text" name="username" value="<%= @token.user.username %>" autocomplete="username" hidden />
<% end %>
<div class="field"><label for="password">Password <span class="optional">(at least <%= User::MIN_PASS %> characters)</span></label><input type="password" id="password" name="password" autocomplete="new-password" minlength="<%= User::MIN_PASS %>" required autofocus /></div>
<div class="field"><label for="confirm">Repeat password</label><input type="password" id="confirm" name="confirm" autocomplete="new-password" required /></div>
<button type="submit" class="download-button">Set password and log in</button>