don't allow other users or confirmed users to resend confirmation email

1 files changed, 6 insertions, 2 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 0755c03..bd511df 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -139,8 +139,12 @@ class UsersController < ApplicationController
   end
 
   def resend_mail
-    RedstonerMailer.register_mail(@user, false).deliver_now
-    flash[:notice] = "Check your inbox for the confirmation mail."
+    if @user.is?(current_user) && !confirmed?
+      RedstonerMailer.register_mail(@user, false).deliver_now
+      flash[:notice] = "Check your inbox for the confirmation mail."
+    else
+      flash[:alert] = "You're not allowed to resend this user's confirmation email"
+    end
     redirect_to user_path(@user)
   end