jro_apps/redmine Commit - r3631:908d44519c41

Allow AuthSources to control if they allow password changes....

Eric Davis -

r3631:908d44519c41

parent child

Context file:

r3631:908d44519c41

Collapse all files

app/controllers/my_controller.rb +1 -1

               # Manage user's password
               def password
                 @user = User.current
-                if @user.auth_source_id
+                unless @user.change_password_allowed?
                   flash[:error] = l(:notice_can_t_change_password)
                   redirect_to :action => 'account'
                   return

app/models/auth_source.rb +9 0

@@ -32,6 +32,15 class AuthSource < ActiveRecord::Base
32	"Abstract"	32	"Abstract"
33	end	33	end
34		34
		35	def allow_password_changes?
		36	self.class.allow_password_changes?
		37	end
		38
		39	# Does this auth source backend allow password changes?
		40	def self.allow_password_changes?
		41	false
		42	end
		43
35	# Try to authenticate a user not yet registered against available sources	44	# Try to authenticate a user not yet registered against available sources
36	def self.authenticate(login, password)	45	def self.authenticate(login, password)
37	AuthSource.find(:all, :conditions => ["onthefly_register=?", true]).each do \|source\|	46	AuthSource.find(:all, :conditions => ["onthefly_register=?", true]).each do \|source\|

app/models/user.rb +13 -3

               def before_save
                 # update hashed_password if password was set
-                self.hashed_password = User.hash_password(self.password) if self.password
+                self.hashed_password = User.hash_password(self.password) if self.password && self.auth_source_id.blank?
               end
               def reload(*args)
                     user.language = Setting.default_language
                     if user.save
                       user.reload
-                      logger.info("User '#{user.login}' created from external auth source: #{user.auth_source.type} - #{user.auth_source.name}") if logger
+                      logger.info("User '#{user.login}' created from external auth source: #{user.auth_source.type} - #{user.auth_source.name}") if logger && user.auth_source
                     end
                   end
                 end
               end
               def check_password?(clear_password)
-                User.hash_password(clear_password) == self.hashed_password
+                if auth_source_id.present?
+                  auth_source.authenticate(self.login, clear_password)
+                else
+                  User.hash_password(clear_password) == self.hashed_password
+                end
+              end
+              # Does the backend storage allow this user to change their password?
+              def change_password_allowed?
+                return true if auth_source_id.blank?
+                return auth_source.allow_password_changes?
               end
               # Generate and set a random password.  Useful for automated user creation

app/views/my/account.rhtml +1 -1

             <div class="contextual">
-            <%= link_to(l(:button_change_password), :action => 'password') unless @user.auth_source_id %>
+            <%= link_to(l(:button_change_password), :action => 'password') if @user.change_password_allowed? %>
             <%= call_hook(:view_my_account_contextual, :user => @user)%>
             </div>
             <h2><%=l(:label_my_account)%></h2>

test/unit/user_test.rb +26 0

@@ -273,6 +273,32 class UserTest < ActiveSupport::TestCase
273	assert !u.password.blank?	273	assert !u.password.blank?
274	assert !u.password_confirmation.blank?	274	assert !u.password_confirmation.blank?
275	end	275	end
		276
		277	context "#change_password_allowed?" do
		278	should "be allowed if no auth source is set" do
		279	user = User.generate_with_protected!
		280	assert user.change_password_allowed?
		281	end
		282
		283	should "delegate to the auth source" do
		284	user = User.generate_with_protected!
		285
		286	allowed_auth_source = AuthSource.generate!
		287	def allowed_auth_source.allow_password_changes?; true; end
		288
		289	denied_auth_source = AuthSource.generate!
		290	def denied_auth_source.allow_password_changes?; false; end
		291
		292	assert user.change_password_allowed?
		293
		294	user.auth_source = allowed_auth_source
		295	assert user.change_password_allowed?, "User not allowed to change password, though auth source does"
		296
		297	user.auth_source = denied_auth_source
		298	assert !user.change_password_allowed?, "User allowed to change password, though auth source does not"
		299	end
		300
		301	end
276		302
277	if Object.const_defined?(:OpenID)	303	if Object.const_defined?(:OpenID)
278		304

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages