{"action":"created","issue":{"url":"https://api.github.com/repos/plataformatec/devise/issues/3556","labels_url":"https://api.github.com/repos/plataformatec/devise/issues/3556/labels{/name}","comments_url":"https://api.github.com/repos/plataformatec/devise/issues/3556/comments","events_url":"https://api.github.com/repos/plataformatec/devise/issues/3556/events","html_url":"https://github.com/plataformatec/devise/issues/3556","id":67105223,"number":3556,"title":"Users can spam one another with :confirmable","user":{"login":"arcwhite","id":159702,"avatar_url":"https://avatars.githubusercontent.com/u/159702?v=3","gravatar_id":"","url":"https://api.github.com/users/arcwhite","html_url":"https://github.com/arcwhite","followers_url":"https://api.github.com/users/arcwhite/followers","following_url":"https://api.github.com/users/arcwhite/following{/other_user}","gists_url":"https://api.github.com/users/arcwhite/gists{/gist_id}","starred_url":"https://api.github.com/users/arcwhite/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/arcwhite/subscriptions","organizations_url":"https://api.github.com/users/arcwhite/orgs","repos_url":"https://api.github.com/users/arcwhite/repos","events_url":"https://api.github.com/users/arcwhite/events{/privacy}","received_events_url":"https://api.github.com/users/arcwhite/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-08T11:08:19Z","updated_at":"2015-04-08T11:33:54Z","closed_at":null,"body":"One of our security researchers at Bugcrowd.com pointed this out in our own app; it's a low-priority issue, and a bit specific, but could be an issue regardless.\r\n\r\nAs a user (user+1@bugcrowd.com)\r\nGiven I try to change my email address to user+2@bugcrowd.com\r\nAnd I don't click the confirmation link\r\nAnd another user creates an account with the email user+2@bugcrowd.com (and confirms it)\r\nAnd I'm still logged in as user+1@bugcrowd.com\r\nWhen I resend confirmation instructions\r\nThen user+2@bugcrowd.com will receive a 'change email confirmation' email\r\nAnd the link inside will be useless\r\nAnd I can keep sending it as many times as I want (spamming user+2@bugcrowd.com and possibly annoying them slightly)\r\n\r\nWhen a new user signs up with a given email address, any pending email changes on any other users that reference that email address should be wiped.\r\n\r\nWe've set up a background task to do this, which is one option. We could update the documentation to encourage developers using devise to do this too - or we could add this behaviour to Devise by default?"},"comment":{"url":"https://api.github.com/repos/plataformatec/devise/issues/comments/90885995","html_url":"https://github.com/plataformatec/devise/issues/3556#issuecomment-90885995","issue_url":"https://api.github.com/repos/plataformatec/devise/issues/3556","id":90885995,"user":{"login":"josevalim","id":9582,"avatar_url":"https://avatars.githubusercontent.com/u/9582?v=3","gravatar_id":"","url":"https://api.github.com/users/josevalim","html_url":"https://github.com/josevalim","followers_url":"https://api.github.com/users/josevalim/followers","following_url":"https://api.github.com/users/josevalim/following{/other_user}","gists_url":"https://api.github.com/users/josevalim/gists{/gist_id}","starred_url":"https://api.github.com/users/josevalim/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/josevalim/subscriptions","organizations_url":"https://api.github.com/users/josevalim/orgs","repos_url":"https://api.github.com/users/josevalim/repos","events_url":"https://api.github.com/users/josevalim/events{/privacy}","received_events_url":"https://api.github.com/users/josevalim/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T11:33:54Z","updated_at":"2015-04-08T11:33:54Z","body":"There is a devise_async project. Maybe that would be a good place to add such recomendation? Maybe even do it by default htere?"}}