Defect #44673 » 0001-Reject-the-current-password-on-lost-password-reset-w.patch
| app/controllers/account_controller.rb | ||
|---|---|---|
| 82 | 82 |
return |
| 83 | 83 |
end |
| 84 | 84 |
if request.post? |
| 85 |
if @user.must_change_passwd? && @user.check_password?(params[:new_password]) |
|
| 85 |
if @user.must_change_password? && @user.check_password?(params[:new_password])
|
|
| 86 | 86 |
flash.now[:error] = l(:notice_new_password_must_be_different) |
| 87 | 87 |
else |
| 88 | 88 |
@user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation] |
| test/functional/account_controller_test.rb | ||
|---|---|---|
| 640 | 640 |
assert_select 'input[type=hidden][name=token][value=?]', token.value |
| 641 | 641 |
end |
| 642 | 642 | |
| 643 |
def test_post_lost_password_with_token_should_not_accept_same_password_if_password_expired |
|
| 644 |
user = User.find(2) |
|
| 645 |
user.password = "originalpassword" |
|
| 646 |
user.save! |
|
| 647 |
user.update_column(:passwd_changed_on, 14.days.ago) |
|
| 648 |
token = Token.create!(:action => 'recovery', :user => user) |
|
| 649 |
with_settings :password_max_age => 7 do |
|
| 650 |
post( |
|
| 651 |
:lost_password, |
|
| 652 |
:params => {
|
|
| 653 |
:token => token.value, |
|
| 654 |
:new_password => 'originalpassword', |
|
| 655 |
:new_password_confirmation => 'originalpassword' |
|
| 656 |
} |
|
| 657 |
) |
|
| 658 |
assert user.reload.must_change_password?, "Password expiry was reset" |
|
| 659 |
end |
|
| 660 |
assert_response :success |
|
| 661 |
assert_not_nil Token.find_by_id(token.id), "Token was deleted" |
|
| 662 | ||
| 663 |
assert_select '.flash', :text => /The new password must be different/ |
|
| 664 |
assert_select 'input[type=hidden][name=token][value=?]', token.value |
|
| 665 |
end |
|
| 666 | ||
| 643 | 667 |
def test_post_lost_password_with_token_should_reset_must_change_password |
| 644 | 668 |
user = User.find(2) |
| 645 | 669 |
user.password = "originalpassword" |