jro_apps/redmine Commit - r14766:b5366eb3079c

Send a notification when security settings are changed (#21421)....

Jean-Philippe Lang -

r14766:b5366eb3079c

parent child

Context file:

r14766:b5366eb3079c

Collapse all files

app/views/mailer/settings_updated.html.erb created 644 +14 0

@@ -0,0 +1,14
	1	<p><%= l(:mail_body_settings_updated) %></p>
	2
	3	<ul>
	4	<% @changes.each do \|name\| %>
	5	<li><%= l("setting_#{name}") %></li>
	6	<% end %>
	7	</ul>
	8
	9	<%= link_to @url, @url %>
	10
	11	<p><%= l(:field_user) %>: <strong><%= User.current.login %></strong><br/>
	12	<%= l(:field_remote_ip) %>: <strong><%= User.current.remote_ip %></strong><br/>
	13	<%= l(:label_date) %>: <strong><%= format_time Time.now, true %></strong></p>
	14

app/views/mailer/settings_updated.text.erb created 644 +12 0

@@ -0,0 +1,12
	1	<%= l(:mail_body_settings_updated) %>
	2
	3	<% @changes.each do \|name\| %>
	4	* <%= l("setting_#{name}") %>
	5	<% end %>
	6
	7	<%= @url %>
	8
	9	<%= l(:field_user) %>: <%= User.current.login %>
	10	<%= l(:field_remote_ip) %>: <%= User.current.remote_ip %>
	11	<%= l(:label_date) %>: <%= format_time Time.now, true %>
	12

app/controllers/settings_controller.rb +1 -4

               def edit
                 @notifiables = Redmine::Notifiable.all
                 if request.post? && params[:settings] && params[:settings].is_a?(Hash)
-                  settings = (params[:settings] || {}).dup.symbolize_keys
+                  Setting.set_all_from_params(params[:settings])
-                  settings.each do |name, value|
-                    Setting.set_from_params name, value
-                  end
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to settings_path(:tab => params[:tab])
                 else

app/models/mailer.rb +16 0

@@ -332,6 +332,22 class Mailer < ActionMailer::Base
332	:subject => l(:mail_subject_security_notification)	332	:subject => l(:mail_subject_security_notification)
333	end	333	end
334		334
		335	def settings_updated(recipients, changes)
		336	redmine_headers 'Sender' => User.current.login
		337	@changes = changes
		338	@url = url_for(controller: 'settings', action: 'index')
		339	mail :to => recipients,
		340	:subject => l(:mail_subject_security_notification)
		341	end
		342
		343	# Notifies admins about settings changes
		344	def self.security_settings_updated(changes)
		345	return unless changes.present?
		346
		347	users = User.active.where(admin: true).to_a
		348	Mailer.settings_updated(users, changes).deliver
		349	end
		350
335	def test_email(user)	351	def test_email(user)
336	set_language_if_valid(user.language)	352	set_language_if_valid(user.language)
337	@url = url_for(:controller => 'welcome')	353	@url = url_for(:controller => 'welcome')

app/models/setting.rb +17 0

@@ -118,6 +118,23 class Setting < ActiveRecord::Base
118	setting.value	118	setting.value
119	end	119	end
120		120
		121	# Updates multiple settings from params and sends a security notification if needed
		122	def self.set_all_from_params(settings)
		123	settings = (settings \|\| {}).dup.symbolize_keys
		124	changes = []
		125	settings.each do \|name, value\|
		126	previous_value = Setting[name]
		127	set_from_params name, value
		128	if available_settings[name.to_s]['security_notifications'] && Setting[name] != previous_value
		129	changes << name
		130	end
		131	end
		132	if changes.any?
		133	Mailer.security_settings_updated(changes)
		134	end
		135	true
		136	end
		137
121	# Sets a setting value from params	138	# Sets a setting value from params
122	def self.set_from_params(name, params)	139	def self.set_from_params(name, params)
123	params = params.dup	140	params = params.dup

config/locales/en.yml +1 0

               mail_body_security_notification_remove: "%{field} %{value} was removed."
               mail_body_security_notification_notify_enabled: "Email address %{value} now receives notifications."
               mail_body_security_notification_notify_disabled: "Email address %{value} no longer receives notifications."
+              mail_body_settings_updated: "The following settings were changed:"
               field_name: Name
               field_description: Description

config/locales/fr.yml +1 0

               mail_body_wiki_content_added: "La page wiki '%{id}' a été ajoutée par %{author}."
               mail_subject_wiki_content_updated: "Page wiki '%{id}' mise à jour"
               mail_body_wiki_content_updated: "La page wiki '%{id}' a été mise à jour par %{author}."
+              mail_body_settings_updated: "Les paramètres suivants ont été modifiés :"
               field_name: Nom
               field_description: Description

config/settings.yml +16 0

               default:
             login_required:
               default: 0
+              security_notifications: 1
             self_registration:
               default: '2'
+              security_notifications: 1
             lost_password:
               default: 1
+              security_notifications: 1
             unsubscribe:
               default: 1
             password_min_length:
               format: int
               default: 8
+              security_notifications: 1
             # Maximum password age in days
             password_max_age:
               format: int
               default: 0
+              security_notifications: 1
             # Maximum number of additional email addresses per user
             max_additional_emails:
               format: int
             session_lifetime:
               format: int
               default: 0
+              security_notifications: 1
             # User session timeout in minutes
             session_timeout:
               format: int
               default: 0
+              security_notifications: 1
             attachment_max_size:
               format: int
               default: 5120
               default: localhost:3000
             protocol:
               default: http
+              security_notifications: 1
             feeds_limit:
               format: int
               default: 15
               - Cvs
               - Bazaar
               - Git
+              security_notifications: 1
             autofetch_changesets:
               default: 1
             sys_api_enabled:
               default: 0
+              security_notifications: 1
             sys_api_key:
               default: ''
+              security_notifications: 1
             commit_cross_project_ref:
               default: 0
             commit_ref_keywords:
               default: ''
             mail_handler_api_enabled:
               default: 0
+              security_notifications: 1
             mail_handler_api_key:
               default:
+              security_notifications: 1
             issue_list_default_columns:
               serialized: true
               default:
               default: 0
             openid:
               default: 0
+              security_notifications: 1
             gravatar_default:
               default: ''
             start_of_week:
               default: ''
             rest_api_enabled:
               default: 0
+              security_notifications: 1
             jsonp_enabled:
               default: 0
+              security_notifications: 1
             default_notification_option:
               default: 'only_my_events'
             emails_header:

test/functional/settings_controller_test.rb +38 0

@@ -136,6 +136,44 class SettingsControllerTest < ActionController::TestCase
136	], Setting.commit_update_keywords)	136	], Setting.commit_update_keywords)
137	end	137	end
138		138
		139	def test_post_edit_should_send_security_notification_for_notified_settings
		140	ActionMailer::Base.deliveries.clear
		141	post :edit, :settings => {
		142	:login_required => 1
		143	}
		144
		145	assert_not_nil (mail = ActionMailer::Base.deliveries.last)
		146	assert_mail_body_match '0.0.0.0', mail
		147	assert_mail_body_match I18n.t(:setting_login_required), mail
		148	assert_select_email do
		149	assert_select 'a[href^=?]', 'http://localhost:3000/settings'
		150	end
		151	# All admins should receive this
		152	recipients = [mail.bcc, mail.cc].flatten
		153	User.active.where(admin: true).each do \|admin\|
		154	assert_include admin.mail, recipients
		155	end
		156	end
		157
		158	def test_post_edit_should_not_send_security_notification_for_non_notified_settings
		159	ActionMailer::Base.deliveries.clear
		160	post :edit, :settings => {
		161	:app_title => 'MineRed'
		162	}
		163
		164	assert_nil (mail = ActionMailer::Base.deliveries.last)
		165	end
		166
		167	def test_post_edit_should_not_send_security_notification_for_unchanged_settings
		168	ActionMailer::Base.deliveries.clear
		169	post :edit, :settings => {
		170	:login_required => 0
		171	}
		172
		173	assert_nil (mail = ActionMailer::Base.deliveries.last)
		174	end
		175
		176
139	def test_get_plugin_settings	177	def test_get_plugin_settings
140	ActionController::Base.append_view_path(File.join(Rails.root, "test/fixtures/plugins"))	178	ActionController::Base.append_view_path(File.join(Rails.root, "test/fixtures/plugins"))
141	Redmine::Plugin.register :foo do	179	Redmine::Plugin.register :foo do

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages