jro_apps/redmine Commit - r13033:2eb95f41b41d

Invalidate security tokens on password or email changes (#17717)....

Jean-Baptiste Barth -

r13033:2eb95f41b41d

parent child

Context file:

r13033:2eb95f41b41d

app/models/user.rb +13 -1

               before_create :set_mail_notification
               before_save   :generate_password_if_needed, :update_hashed_password
               before_destroy :remove_references_before_destroy
-              after_save :update_notified_project_ids
+              after_save :update_notified_project_ids, :destroy_tokens
               scope :in_group, lambda {|group|
                 group_id = group.is_a?(Group) ? group.id : group.to_i
                 end
               end
+              # Delete all outstanding password reset tokens on password or email change.
+              # Delete the autologin tokens on password change to prohibit session leakage.
+              # This helps to keep the account secure in case the associated email account
+              # was compromised.
+              def destroy_tokens
+                tokens  = []
+                tokens |= ['recovery', 'autologin'] if changes.has_key?('hashed_password')
+                tokens |= ['recovery'] if changes.has_key?('mail')
+                Token.delete_all(['user_id = ? AND action IN (?)', self.id, tokens]) if tokens.any?
+              end
               # Removes references that are not handled by associations
               # Things that are not deleted are reassociated with the anonymous user
               def remove_references_before_destroy

test/unit/user_test.rb +36 0

@@ -403,6 +403,42 class UserTest < ActiveSupport::TestCase
403	end	403	end
404	end	404	end
405		405
		406	def test_password_change_should_destroy_tokens
		407	recovery_token = Token.create!(:user_id => 2, :action => 'recovery')
		408	autologin_token = Token.create!(:user_id => 2, :action => 'autologin')
		409
		410	user = User.find(2)
		411	user.password, user.password_confirmation = "a new password", "a new password"
		412	assert user.save
		413
		414	assert_nil Token.find_by_id(recovery_token.id)
		415	assert_nil Token.find_by_id(autologin_token.id)
		416	end
		417
		418	def test_mail_change_should_destroy_tokens
		419	recovery_token = Token.create!(:user_id => 2, :action => 'recovery')
		420	autologin_token = Token.create!(:user_id => 2, :action => 'autologin')
		421
		422	user = User.find(2)
		423	user.mail = "user@somwehere.com"
		424	assert user.save
		425
		426	assert_nil Token.find_by_id(recovery_token.id)
		427	assert_equal autologin_token, Token.find_by_id(autologin_token.id)
		428	end
		429
		430	def test_change_on_other_fields_should_not_destroy_tokens
		431	recovery_token = Token.create!(:user_id => 2, :action => 'recovery')
		432	autologin_token = Token.create!(:user_id => 2, :action => 'autologin')
		433
		434	user = User.find(2)
		435	user.firstname = "Bobby"
		436	assert user.save
		437
		438	assert_equal recovery_token, Token.find_by_id(recovery_token.id)
		439	assert_equal autologin_token, Token.find_by_id(autologin_token.id)
		440	end
		441
406	def test_validate_login_presence	442	def test_validate_login_presence
407	@admin.login = ""	443	@admin.login = ""
408	assert !@admin.save	444	assert !@admin.save

General Comments 0

You need to be logged in to leave comments. Login now

No TODOs yet

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages