user must be email_confirmed to log_in

previously we were not checking if the email_confirmed attribute was true before logging in. A new user did not have to activate email before logging in.
npauzenga · Nov 8, 2015 · e71c1e0 · e71c1e0
1 parent 59897c7
commit e71c1e0
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
@@ -4,7 +4,9 @@ def new
 
   def create
     @user = User.find_by(email: params[:session][:email].downcase)
-    if @user && @user.authenticate(params[:session][:password])
+    if @user &&
+       @user.authenticate(params[:session][:password]) &&
+       @user.email_confirmed
       log_in @user
       redirect_to @user
     else