70df29790a
In the current setup users could be tricked into deleting their data by providing a malicious link like `[click me](/me/delete)`. This commit prevents such an easy attack and need the user's deleteToken to get his data deleted. In case someone requests his deletion by email you can also ask him for this token. We can add a GUI that shows it later on. Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
13 lines
333 B
JavaScript
13 lines
333 B
JavaScript
'use strict'
|
|
module.exports = {
|
|
up: function (queryInterface, Sequelize) {
|
|
return queryInterface.addColumn('Users', 'deleteToken', {
|
|
type: Sequelize.UUID,
|
|
defaultValue: Sequelize.UUIDV4
|
|
})
|
|
},
|
|
|
|
down: function (queryInterface, Sequelize) {
|
|
return queryInterface.removeColumn('Users', 'deleteToken')
|
|
}
|
|
}
|