From 4fd6253a003895e0da6d866b05749ba80e7d6159 Mon Sep 17 00:00:00 2001
From: Iraline <iraline@hotmail.com>
Date: Thu, 5 May 2022 16:54:56 -0300
Subject: [PATCH] Permit use confirmation token only when user create a new
 account or change the email

---
 app/controllers/users/confirmations_controller.rb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/app/controllers/users/confirmations_controller.rb b/app/controllers/users/confirmations_controller.rb
index d7e3f7593..667f96ee8 100644
--- a/app/controllers/users/confirmations_controller.rb
+++ b/app/controllers/users/confirmations_controller.rb
@@ -49,11 +49,11 @@ class Users::ConfirmationsController < Devise::ConfirmationsController
     elsif resource.errors.empty?
       set_official_position if resource.has_official_email?
 
-      if resource.confirmed_at
-        message = :already_confirmed
-      else
+      if !resource.confirmed_at || resource.unconfirmed_email
         resource.confirm # Last change: confirm happens here for people with passwords instead of af the top of the show action
         message = :confirmed
+      else
+        message = :already_confirmed
       end
 
       set_flash_message(:notice, message) if is_flashing_format?