From 85770b44b81d55f2d113f6b0fbb42c915242ecd4 Mon Sep 17 00:00:00 2001 From: Shivam Mishra Date: Tue, 8 Apr 2025 12:31:52 +0530 Subject: [PATCH] refactor: use bcrypt hash --- .../devise_overrides/omniauth_callbacks_controller.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb index 45fb2b425..a357ea03b 100644 --- a/app/controllers/devise_overrides/omniauth_callbacks_controller.rb +++ b/app/controllers/devise_overrides/omniauth_callbacks_controller.rb @@ -17,7 +17,11 @@ class DeviseOverrides::OmniauthCallbacksController < DeviseTokenAuth::OmniauthCa # Set random password if user was not previously confirmed # This is to prevent an malicious user from acting in # case they created an account with this email before - @resource.update_column(:encrypted_password, SecureRandom.hex(12)) if confirmable_enabled? && !was_confirmed + if confirmable_enabled? && !was_confirmed + # Generate proper bcrypt hash for the password instead of storing raw password + encrypted_password = BCrypt::Password.create(SecureRandom.hex(32)) + @resource.update_column(:encrypted_password, encrypted_password) + end # rubocop:enable Rails/SkipsModelValidations # once the resource is found and verified