Skip to content

Unused Devise routes are still active #9498

@microstudi

Description

@microstudi

Describe the bug
Years ago, the "account" page was introduced in Decidim in order to edit personal details (emails, passwords or destroy the account).

However, it is still possible to access the old route (which appears unstyled) from which you can still change your details. What's more important is that there's a link to destroy your account without any warning of what that means.

We should probably delete the file https://github.com/decidim/decidim/blob/develop/decidim-core/app/views/decidim/devise/registrations/edit.html.erb and place some restriction in the devise route or controller in order to prevent access actions different than create or new

To Reproduce
Steps to reproduce the behavior:

  1. Log into any Decidim instance
  2. Write in the url, after the domain: /users/edit
  3. See the form, destroy your account if you want (don't blame me)

Expected behavior
As devise is not used to edit the account, this route should not exist.

Screenshots

image

Stacktrace
If applicable, add the error stacktrace to help explain your problem.

Extra data (please complete the following information):

  • Device: [e.g. iPhone6, Desktop]
  • Device OS: [e.g. iOS8.1, Windows 10]
  • Browser: [e.g. Chrome, Firefox, Safari]
  • Decidim Version: [e.g. 0.10]
  • Decidim installation: [e.g. MetaDecidim]

NOT RELEVANT

Additional context
Add any other context about the problem here. For instance, add Metadecidim link.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions