"While both Mr. Sclafani and Heroku endeavoured to use test accounts exclusively, a very small number of customer account passwords were reset during the incident"
This is interesting.
This is interesting.
I would have liked to see more details about what was going on to cause that sort of problem. I can't think of any reasonable code that would cause password resets for an empty ID to be assigned to a random account.
#Start a password reset
@user = User.find_by_email
@user.update_attribute :password_reset_nonce, rand(16 ** 16).to_hex
#mail them the password reset email
#Look up a user for a password reset
@user.find_by_password_reset_nonce params[:password_reset_nonce]
#if nil, above line returns random user on some databases. Oops.
session[:user_id] = @user #Logs in user
#We assume if they know the nonce that proves they own email.
redirect_to passwordReset_url
Bugs like this one always make me think "There but for the grace of God go I."
rand(16**16).to_s(16)
rand(16**16).to_s(36)