CVE-2019-11514

@@ -53,7 +53,8 @@ public function handle(ConfirmEmail $command)
         $user->save();
         $this->dispatchEventsFor($user);
 
-        $token->delete();
+        // Delete *all* tokens for the user, in case other ones were sent first
+        $user->emailTokens()->delete();
 
         return $user;
     }

@@ -614,6 +614,16 @@ public function notifications()
         return $this->hasMany('Flarum\Notification\Notification');
     }
 
+    /**
+     * Define the relationship with the user's email tokens.
+     *
+     * @return \Illuminate\Database\Eloquent\Relations\HasMany
+     */
+    public function emailTokens()
+    {
+        return $this->hasMany(EmailToken::class);
+    }
+
     /**
      * Define the relationship with the permissions of all of the groups that
      * the user is in.