diff --git a/lib/wsapi/stage_reverify.js b/lib/wsapi/stage_reverify.js index d980391b9d5e33b7b7eb9d6448ea381a53be8514..885fcb57ce7c05081dc3c8c06d70ecb16ce0110a 100644 --- a/lib/wsapi/stage_reverify.js +++ b/lib/wsapi/stage_reverify.js @@ -31,43 +31,38 @@ exports.process = function(req, res) { return httputils.badRequest(res, msg); } - db.lastStaged(req.body.email, function (err, last) { - if (err) return wsapi.databaseDown(res, err); + // Note, we do no throttling of emails in this case. Because this call requires + // authentication, protect a user from themselves could cause more harm than good, + // specifically we would be removing a user available workaround (i.e. a cosmic ray + // hits our email delivery, user doesn't get an email in 30s. User tries again.) - if (last && (new Date() - last) < config.get('min_time_between_emails_ms')) { - logger.warn('throttling request to stage email address ' + req.body.email + ', only ' + - ((new Date() - last) / 1000.0) + "s elapsed"); - return httputils.throttled(res, "Too many emails sent to that address, try again later."); - } + // one may only reverify an email that is owned and unverified + db.userOwnsEmail(req.session.userid, req.body.email, function(err, owned) { + if (err) return res.json({ success: false, reason: err }); + if (!owned) return res.json({ success: false, reason: 'you don\'t control that email address' }); - // one may only reverify an email that is owned and unverified - db.userOwnsEmail(req.session.userid, req.body.email, function(err, owned) { + db.emailIsVerified(req.body.email, function(err, verified) { if (err) return res.json({ success: false, reason: err }); - if (!owned) return res.json({ success: false, reason: 'you don\'t control that email address' }); + if (verified) return res.json({ success: false, reason: 'email is already verified' }); - db.emailIsVerified(req.body.email, function(err, verified) { - if (err) return res.json({ success: false, reason: err }); - if (verified) return res.json({ success: false, reason: 'email is already verified' }); + try { + // on failure stageEmail may throw + db.stageEmail(req.session.userid, req.body.email, undefined, function(err, secret) { + if (err) return wsapi.databaseDown(res, err); - try { - // on failure stageEmail may throw - db.stageEmail(req.session.userid, req.body.email, undefined, function(err, secret) { - if (err) return wsapi.databaseDown(res, err); - - var langContext = wsapi.langContext(req); - - // store the email being reverified - req.session.pendingReverification = secret; - - res.json({ success: true }); - // let's now kick out a verification email! - email.sendConfirmationEmail(req.body.email, req.body.site, secret, langContext); - }); - } catch(e) { - // we should differentiate tween' 400 and 500 here. - httputils.badRequest(res, e.toString()); - } - }); + var langContext = wsapi.langContext(req); + + // store the email being reverified + req.session.pendingReverification = secret; + + res.json({ success: true }); + // let's now kick out a verification email! + email.sendConfirmationEmail(req.body.email, req.body.site, secret, langContext); + }); + } catch(e) { + // we should differentiate tween' 400 and 500 here. + httputils.badRequest(res, e.toString()); + } }); }); };