Commit c175c30d authored by Stan Hu's avatar Stan Hu

Fix sub-second timing comparison error for Devise confirmation period

On databases such as MySQL, it's possible to get into a timing comparison
error if the value of `Confirmable#confirmation_sent_at` is within a second
of `0.days.ago`. This is possible mostly in specs that test this behavior
and most likely not happening in practice. The result of this error causes
a user to be deemed active when it should be inactive. To prevent this
error, we explicitly check the configuration setting to be `0.days.ago`.

Closes gitlab-org/gitlab-ee#2362
parent 8b9cd3c0
......@@ -1000,6 +1000,15 @@ class User < ActiveRecord::Base
devise_mailer.send(notification, self, *args).deliver_later
# This works around a bug in Devise 4.2.0 that erroneously causes a user to
# be considered active in MySQL specs due to a sub-second comparison
# issue. For more details, see:
def confirmation_period_valid?
return false if self.class.allow_unconfirmed_access_for == 0.days
def ensure_external_user_rights
return unless external?
Markdown is supported
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment