jro_apps/redmine Commit - r4816:ce84bb1a0194

Adds random salt to user passwords (#7410)....

Jean-Philippe Lang -

r4816:ce84bb1a0194

parent child

Context file:

r4816:ce84bb1a0194

Collapse all files

db/migrate/20110223180944_add_users_salt.rb created 644 +9 0

			@@ -0,0 +1,9
		1	class AddUsersSalt < ActiveRecord::Migration
		2	def self.up
		3	add_column :users, :salt, :string, :limit => 64
		4	end
		5
		6	def self.down
		7	remove_column :users, :salt
		8	end
		9	end

db/migrate/20110223180953_salt_user_passwords.rb created 644 +13 0

			@@ -0,0 +1,13
		1	class SaltUserPasswords < ActiveRecord::Migration
		2
		3	def self.up
		4	say_with_time "Salting user passwords, this may take some time..." do
		5	User.salt_unsalted_passwords!
		6	end
		7	end
		8
		9	def self.down
		10	# Unsalted passwords can not be restored
		11	raise ActiveRecord::IrreversibleMigration, "Can't decypher salted passwords. This migration can not be rollback'ed."
		12	end
		13	end

app/models/user.rb +33 -3

              # Redmine - project management software
              # Copyright (C) 2006-2009  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require "digest/sha1"
              class User < Principal
                include Redmine::SafeAttributes
                # Account statuses
                STATUS_ANONYMOUS  = 0
                STATUS_ACTIVE     = 1
                STATUS_REGISTERED = 2
                STATUS_LOCKED     = 3
                USER_FORMATS = {
                  :firstname_lastname => '#{firstname} #{lastname}',
                  :firstname => '#{firstname}',
                  :lastname_firstname => '#{lastname} #{firstname}',
                  :lastname_coma_firstname => '#{lastname}, #{firstname}',
                  :username => '#{login}'
                }
                MAIL_NOTIFICATION_OPTIONS = [
                  ['all', :label_user_mail_option_all],
                  ['selected', :label_user_mail_option_selected],
                  ['only_my_events', :label_user_mail_option_only_my_events],
                  ['only_assigned', :label_user_mail_option_only_assigned],
                  ['only_owner', :label_user_mail_option_only_owner],
                  ['none', :label_user_mail_option_none]
                ]
                has_and_belongs_to_many :groups, :after_add => Proc.new {|user, group| group.user_added(user)},
                                                 :after_remove => Proc.new {|user, group| group.user_removed(user)}
                has_many :issue_categories, :foreign_key => 'assigned_to_id', :dependent => :nullify
                has_many :changesets, :dependent => :nullify
                has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'
                has_one :rss_token, :class_name => 'Token', :conditions => "action='feeds'"
                has_one :api_token, :class_name => 'Token', :conditions => "action='api'"
                belongs_to :auth_source
                # Active non-anonymous users scope
                named_scope :active, :conditions => "#{User.table_name}.status = #{STATUS_ACTIVE}"
                acts_as_customizable
                attr_accessor :password, :password_confirmation
                attr_accessor :last_before_login_on
                # Prevents unauthorized assignments
                attr_protected :login, :admin, :password, :password_confirmation, :hashed_password
                validates_presence_of :login, :firstname, :lastname, :mail, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }
                validates_uniqueness_of :login, :if => Proc.new { |user| !user.login.blank? }, :case_sensitive => false
                validates_uniqueness_of :mail, :if => Proc.new { |user| !user.mail.blank? }, :case_sensitive => false
                # Login must contain lettres, numbers, underscores only
                validates_format_of :login, :with => /^[a-z0-9_\-@\.]*$/i
                validates_length_of :login, :maximum => 30
                validates_length_of :firstname, :lastname, :maximum => 30
                validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :allow_nil => true
                validates_length_of :mail, :maximum => 60, :allow_nil => true
                validates_confirmation_of :password, :allow_nil => true
                validates_inclusion_of :mail_notification, :in => MAIL_NOTIFICATION_OPTIONS.collect(&:first), :allow_blank => true
                before_destroy :remove_references_before_destroy
                def before_create
                  self.mail_notification = Setting.default_notification_option if self.mail_notification.blank?
                  true
                end
                def before_save
                  # update hashed_password if password was set
-                 self.hashed_password = User.hash_password(self.password) if self.password && self.auth_source_id.blank?
+                 if self.password && self.auth_source_id.blank?
+                   salt_password(password)
+                 end
                end
                def reload(*args)
                  @name = nil
                  super
                end
                def mail=(arg)
                  write_attribute(:mail, arg.to_s.strip)
                end
                def identity_url=(url)
                  if url.blank?
                    write_attribute(:identity_url, '')
                  else
                    begin
                      write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))
                    rescue OpenIdAuthentication::InvalidOpenId
                      # Invlaid url, don't save
                    end
                  end
                  self.read_attribute(:identity_url)
                end
                # Returns the user that matches provided login and password, or nil
                def self.try_to_login(login, password)
                  # Make sure no one can sign in with an empty password
                  return nil if password.to_s.empty?
                  user = find_by_login(login)
                  if user
                    # user is already in local database
                    return nil if !user.active?
                    if user.auth_source
                      # user has an external authentication method
                      return nil unless user.auth_source.authenticate(login, password)
                    else
                      # authentication with local password
-                     return nil unless User.hash_password(password) == user.hashed_password
+                     return nil unless user.check_password?(password)
                    end
                  else
                    # user is not yet registered, try to authenticate with available sources
                    attrs = AuthSource.authenticate(login, password)
                    if attrs
                      user = new(attrs)
                      user.login = login
                      user.language = Setting.default_language
                      if user.save
                        user.reload
                        logger.info("User '#{user.login}' created from external auth source: #{user.auth_source.type} - #{user.auth_source.name}") if logger && user.auth_source
                      end
                    end
                  end
                  user.update_attribute(:last_login_on, Time.now) if user && !user.new_record?
                  user
                rescue => text
                  raise text
                end
                # Returns the user who matches the given autologin +key+ or nil
                def self.try_to_autologin(key)
                  tokens = Token.find_all_by_action_and_value('autologin', key)
                  # Make sure there's only 1 token that matches the key
                  if tokens.size == 1
                    token = tokens.first
                    if (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?
                      token.user.update_attribute(:last_login_on, Time.now)
                      token.user
                    end
                  end
                end
                # Return user's full name for display
                def name(formatter = nil)
                  if formatter
                    eval('"' + (USER_FORMATS[formatter] || USER_FORMATS[:firstname_lastname]) + '"')
                  else
                    @name ||= eval('"' + (USER_FORMATS[Setting.user_format] || USER_FORMATS[:firstname_lastname]) + '"')
                  end
                end
                def active?
                  self.status == STATUS_ACTIVE
                end
                def registered?
                  self.status == STATUS_REGISTERED
                end
                def locked?
                  self.status == STATUS_LOCKED
                end
                def activate
                  self.status = STATUS_ACTIVE
                end
                def register
                  self.status = STATUS_REGISTERED
                end
                def lock
                  self.status = STATUS_LOCKED
                end
                def activate!
                  update_attribute(:status, STATUS_ACTIVE)
                end
                def register!
                  update_attribute(:status, STATUS_REGISTERED)
                end
                def lock!
                  update_attribute(:status, STATUS_LOCKED)
                end
+               # Returns true if +clear_password+ is the correct user's password, otherwise false
                def check_password?(clear_password)
                  if auth_source_id.present?
                    auth_source.authenticate(self.login, clear_password)
                  else
-                   User.hash_password(clear_password) == self.hashed_password
+                   User.hash_password("#{salt}#{User.hash_password clear_password}") == hashed_password
                  end
                end
+               # Generates a random salt and computes hashed_password for +clear_password+
+               # The hashed password is stored in the following form: SHA1(salt + SHA1(password))
+               def salt_password(clear_password)
+                 self.salt = User.generate_salt
+                 self.hashed_password = User.hash_password("#{salt}#{User.hash_password clear_password}")
+               end
                # Does the backend storage allow this user to change their password?
                def change_password_allowed?
                  return true if auth_source_id.blank?
                  return auth_source.allow_password_changes?
                end
                # Generate and set a random password.  Useful for automated user creation
                # Based on Token#generate_token_value
                #
                def random_password
                  chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
                  password = ''
 .times { |i| password << chars[rand(chars.size-1)] }
                  self.password = password
                  self.password_confirmation = password
                  self
                end
                def pref
                  self.preference ||= UserPreference.new(:user => self)
                end
                def time_zone
                  @time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])
                end
                def wants_comments_in_reverse_order?
                  self.pref[:comments_sorting] == 'desc'
                end
                # Return user's RSS key (a 40 chars long string), used to access feeds
                def rss_key
                  token = self.rss_token || Token.create(:user => self, :action => 'feeds')
                  token.value
                end
                # Return user's API key (a 40 chars long string), used to access the API
                def api_key
                  token = self.api_token || self.create_api_token(:action => 'api')
                  token.value
                end
                # Return an array of project ids for which the user has explicitly turned mail notifications on
                def notified_projects_ids
                  @notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)
                end
                def notified_project_ids=(ids)
                  Member.update_all("mail_notification = #{connection.quoted_false}", ['user_id = ?', id])
                  Member.update_all("mail_notification = #{connection.quoted_true}", ['user_id = ? AND project_id IN (?)', id, ids]) if ids && !ids.empty?
                  @notified_projects_ids = nil
                  notified_projects_ids
                end
                def valid_notification_options
                  self.class.valid_notification_options(self)
                end
                # Only users that belong to more than 1 project can select projects for which they are notified
                def self.valid_notification_options(user=nil)
                  # Note that @user.membership.size would fail since AR ignores
                  # :include association option when doing a count
                  if user.nil? || user.memberships.length < 1
                    MAIL_NOTIFICATION_OPTIONS.reject {|option| option.first == 'selected'}
                  else
                    MAIL_NOTIFICATION_OPTIONS
                  end
                end
                # Find a user account by matching the exact login and then a case-insensitive
                # version.  Exact matches will be given priority.
                def self.find_by_login(login)
                  # force string comparison to be case sensitive on MySQL
                  type_cast = (ActiveRecord::Base.connection.adapter_name == 'MySQL') ? 'BINARY' : ''
                  # First look for an exact match
                  user = first(:conditions => ["#{type_cast} login = ?", login])
                  # Fail over to case-insensitive if none was found
                  user ||= first(:conditions => ["#{type_cast} LOWER(login) = ?", login.to_s.downcase])
                end
                def self.find_by_rss_key(key)
                  token = Token.find_by_value(key)
                  token && token.user.active? ? token.user : nil
                end
                def self.find_by_api_key(key)
                  token = Token.find_by_action_and_value('api', key)
                  token && token.user.active? ? token.user : nil
                end
                # Makes find_by_mail case-insensitive
                def self.find_by_mail(mail)
                  find(:first, :conditions => ["LOWER(mail) = ?", mail.to_s.downcase])
                end
                def to_s
                  name
                end
                # Returns the current day according to user's time zone
                def today
                  if time_zone.nil?
                    Date.today
                  else
                    Time.now.in_time_zone(time_zone).to_date
                  end
                end
                def logged?
                  true
                end
                def anonymous?
                  !logged?
                end
                # Return user's roles for project
                def roles_for_project(project)
                  roles = []
                  # No role on archived projects
                  return roles unless project && project.active?
                  if logged?
                    # Find project membership
                    membership = memberships.detect {|m| m.project_id == project.id}
                    if membership
                      roles = membership.roles
                    else
                      @role_non_member ||= Role.non_member
                      roles << @role_non_member
                    end
                  else
                    @role_anonymous ||= Role.anonymous
                    roles << @role_anonymous
                  end
                  roles
                end
                # Return true if the user is a member of project
                def member_of?(project)
                  !roles_for_project(project).detect {|role| role.member?}.nil?
                end
                # Return true if the user is allowed to do the specified action on a specific context
                # Action can be:
                # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
                # * a permission Symbol (eg. :edit_project)
                # Context can be:
                # * a project : returns true if user is allowed to do the specified action on this project
                # * a group of projects : returns true if user is allowed on every project
                # * nil with options[:global] set : check if user has at least one role allowed for this action,
                #   or falls back to Non Member / Anonymous permissions depending if the user is logged
                def allowed_to?(action, context, options={})
                  if context && context.is_a?(Project)
                    # No action allowed on archived projects
                    return false unless context.active?
                    # No action allowed on disabled modules
                    return false unless context.allows_to?(action)
                    # Admin users are authorized for anything else
                    return true if admin?
                    roles = roles_for_project(context)
                    return false unless roles
                    roles.detect {|role| (context.is_public? || role.member?) && role.allowed_to?(action)}
                  elsif context && context.is_a?(Array)
                    # Authorize if user is authorized on every element of the array
                    context.map do |project|
                      allowed_to?(action,project,options)
                    end.inject do |memo,allowed|
                      memo && allowed
                    end
                  elsif options[:global]
                    # Admin users are always authorized
                    return true if admin?
                    # authorize if user has at least one role that has this permission
                    roles = memberships.collect {|m| m.roles}.flatten.uniq
                    roles.detect {|r| r.allowed_to?(action)} || (self.logged? ? Role.non_member.allowed_to?(action) : Role.anonymous.allowed_to?(action))
                  else
                    false
                  end
                end
                # Is the user allowed to do the specified action on any project?
                # See allowed_to? for the actions and valid options.
                def allowed_to_globally?(action, options)
                  allowed_to?(action, nil, options.reverse_merge(:global => true))
                end
                safe_attributes 'login',
                  'firstname',
                  'lastname',
                  'mail',
                  'mail_notification',
                  'language',
                  'custom_field_values',
                  'custom_fields',
                  'identity_url'
                safe_attributes 'status',
                  'auth_source_id',
                  :if => lambda {|user, current_user| current_user.admin?}
                safe_attributes 'group_ids',
                  :if => lambda {|user, current_user| current_user.admin? && !user.new_record?}
                # Utility method to help check if a user should be notified about an
                # event.
                #
                # TODO: only supports Issue events currently
                def notify_about?(object)
                  case mail_notification
                  when 'all'
                    true
                  when 'selected'
                    # user receives notifications for created/assigned issues on unselected projects
                    if object.is_a?(Issue) && (object.author == self || object.assigned_to == self)
                      true
                    else
                      false
                    end
                  when 'none'
                    false
                  when 'only_my_events'
                    if object.is_a?(Issue) && (object.author == self || object.assigned_to == self)
                      true
                    else
                      false
                    end
                  when 'only_assigned'
                    if object.is_a?(Issue) && object.assigned_to == self
                      true
                    else
                      false
                    end
                  when 'only_owner'
                    if object.is_a?(Issue) && object.author == self
                      true
                    else
                      false
                    end
                  else
                    false
                  end
                end
                def self.current=(user)
                  @current_user = user
                end
                def self.current
                  @current_user ||= User.anonymous
                end
                # Returns the anonymous user.  If the anonymous user does not exist, it is created.  There can be only
                # one anonymous user per database.
                def self.anonymous
                  anonymous_user = AnonymousUser.find(:first)
                  if anonymous_user.nil?
                    anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :mail => '', :login => '', :status => 0)
                    raise 'Unable to create the anonymous user.' if anonymous_user.new_record?
                  end
                  anonymous_user
                end
+               # Salts all existing unsalted passwords
+               # It changes password storage scheme from SHA1(password) to SHA1(salt + SHA1(password))
+               # This method is used in the SaltPasswords migration and is to be kept as is
+               def self.salt_unsalted_passwords!
+                 transaction do
+                   User.find_each(:conditions => "salt IS NULL OR salt = ''") do |user|
+                     next if user.hashed_password.blank?
+                     salt = User.generate_salt
+                     hashed_password = User.hash_password("#{salt}#{user.hashed_password}")
+                     User.update_all("salt = '#{salt}', hashed_password = '#{hashed_password}'", ["id = ?", user.id] )
+                   end
+                 end
+               end
                protected
                def validate
                  # Password length validation based on setting
                  if !password.nil? && password.size < Setting.password_min_length.to_i
                    errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)
                  end
                end
                private
                # Removes references that are not handled by associations
                # Things that are not deleted are reassociated with the anonymous user
                def remove_references_before_destroy
                  return if self.id.nil?
                  substitute = User.anonymous
                  Attachment.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  Comment.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  Issue.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  Issue.update_all 'assigned_to_id = NULL', ['assigned_to_id = ?', id]
                  Journal.update_all ['user_id = ?', substitute.id], ['user_id = ?', id]
                  JournalDetail.update_all ['old_value = ?', substitute.id.to_s], ["property = 'attr' AND prop_key = 'assigned_to_id' AND old_value = ?", id.to_s]
                  JournalDetail.update_all ['value = ?', substitute.id.to_s], ["property = 'attr' AND prop_key = 'assigned_to_id' AND value = ?", id.to_s]
                  Message.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  News.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  # Remove private queries and keep public ones
                  Query.delete_all ['user_id = ? AND is_public = ?', id, false]
                  Query.update_all ['user_id = ?', substitute.id], ['user_id = ?', id]
                  TimeEntry.update_all ['user_id = ?', substitute.id], ['user_id = ?', id]
                  Token.delete_all ['user_id = ?', id]
                  Watcher.delete_all ['user_id = ?', id]
                  WikiContent.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                  WikiContent::Version.update_all ['author_id = ?', substitute.id], ['author_id = ?', id]
                end
                # Return password digest
                def self.hash_password(clear_password)
                  Digest::SHA1.hexdigest(clear_password || "")
                end
+               # Returns a 128bits random salt as a hex string (32 chars long)
+               def self.generate_salt
+                 ActiveSupport::SecureRandom.hex(16)
+               end
              end
              class AnonymousUser < User
                def validate_on_create
                  # There should be only one AnonymousUser in the database
                  errors.add_to_base 'An anonymous user already exists.' if AnonymousUser.find(:first)
                end
                def available_custom_fields
                  []
                end
                # Overrides a few properties
                def logged?; false end
                def admin; false end
                def name(*args); I18n.t(:label_user_anonymous) end
                def mail; nil end
                def time_zone; nil end
                def rss_key; nil end
                # Anonymous user can not be destroyed
                def destroy
                  false
                end
              end

extra/svn/Redmine.pm +5 -4

              package Apache::Authn::Redmine;
              =head1 Apache::Authn::Redmine
              Redmine - a mod_perl module to authenticate webdav subversion users
              against redmine database
              =head1 SYNOPSIS
              This module allow anonymous users to browse public project and
              registred users to browse and commit their project. Authentication is
              done against the redmine database or the LDAP configured in redmine.
              This method is far simpler than the one with pam_* and works with all
              database without an hassle but you need to have apache/mod_perl on the
              svn server.
              =head1 INSTALLATION
              For this to automagically work, you need to have a recent reposman.rb
              (after r860) and if you already use reposman, read the last section to
              migrate.
              Sorry ruby users but you need some perl modules, at least mod_perl2,
              DBI and DBD::mysql (or the DBD driver for you database as it should
              work on allmost all databases).
              On debian/ubuntu you must do :
                aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
              If your Redmine users use LDAP authentication, you will also need
              Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
                aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
              =head1 CONFIGURATION
                 ## This module has to be in your perl path
                 ## eg:  /usr/lib/perl5/Apache/Authn/Redmine.pm
                 PerlLoadModule Apache::Authn::Redmine
                 <Location /svn>
                   DAV svn
                   SVNParentPath "/var/svn"
                   AuthType Basic
                   AuthName redmine
                   Require valid-user
                   PerlAccessHandler Apache::Authn::Redmine::access_handler
                   PerlAuthenHandler Apache::Authn::Redmine::authen_handler
                   ## for mysql
                   RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
                   ## for postgres
                   # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
                   RedmineDbUser "redmine"
                   RedmineDbPass "password"
                   ## Optional where clause (fulltext search would be slow and
                   ## database dependant).
                   # RedmineDbWhereClause "and members.role_id IN (1,2)"
                   ## Optional credentials cache size
                   # RedmineCacheCredsMax 50
                </Location>
              To be able to browse repository inside redmine, you must add something
              like that :
                 <Location /svn-private>
                   DAV svn
                   SVNParentPath "/var/svn"
                   Order deny,allow
                   Deny from all
                   # only allow reading orders
                   <Limit GET PROPFIND OPTIONS REPORT>
                     Allow from redmine.server.ip
                   </Limit>
                 </Location>
              and you will have to use this reposman.rb command line to create repository :
                reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
              =head1 MIGRATION FROM OLDER RELEASES
              If you use an older reposman.rb (r860 or before), you need to change
              rights on repositories to allow the apache user to read and write
              S<them :>
                sudo chown -R www-data /var/svn/*
                sudo chmod -R u+w /var/svn/*
              And you need to upgrade at least reposman.rb (after r860).
              =cut
              use strict;
              use warnings FATAL => 'all', NONFATAL => 'redefine';
              use DBI;
              use Digest::SHA1;
              # optional module for LDAP authentication
              my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
              use Apache2::Module;
              use Apache2::Access;
              use Apache2::ServerRec qw();
              use Apache2::RequestRec qw();
              use Apache2::RequestUtil qw();
              use Apache2::Const qw(:common :override :cmd_how);
              use APR::Pool ();
              use APR::Table ();
              # use Apache2::Directive qw();
              my @directives = (
                {
                  name => 'RedmineDSN',
                  req_override => OR_AUTHCFG,
                  args_how => TAKE1,
                  errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
                },
                {
                  name => 'RedmineDbUser',
                  req_override => OR_AUTHCFG,
                  args_how => TAKE1,
                },
                {
                  name => 'RedmineDbPass',
                  req_override => OR_AUTHCFG,
                  args_how => TAKE1,
                },
                {
                  name => 'RedmineDbWhereClause',
                  req_override => OR_AUTHCFG,
                  args_how => TAKE1,
                },
                {
                  name => 'RedmineCacheCredsMax',
                  req_override => OR_AUTHCFG,
                  args_how => TAKE1,
                  errmsg => 'RedmineCacheCredsMax must be decimal number',
                },
              );
              sub RedmineDSN {
                my ($self, $parms, $arg) = @_;
                $self->{RedmineDSN} = $arg;
                my $query = "SELECT
-                              hashed_password, auth_source_id, permissions
+                              hashed_password, salt, auth_source_id, permissions
                            FROM members, projects, users, roles, member_roles
                            WHERE
                              projects.id=members.project_id
                              AND member_roles.member_id=members.id
                              AND users.id=members.user_id
                              AND roles.id=member_roles.role_id
                              AND users.status=1
                              AND login=?
                              AND identifier=? ";
                $self->{RedmineQuery} = trim($query);
              }
              sub RedmineDbUser { set_val('RedmineDbUser', @_); }
              sub RedmineDbPass { set_val('RedmineDbPass', @_); }
              sub RedmineDbWhereClause {
                my ($self, $parms, $arg) = @_;
                $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
              }
              sub RedmineCacheCredsMax {
                my ($self, $parms, $arg) = @_;
                if ($arg) {
                  $self->{RedmineCachePool} = APR::Pool->new;
                  $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
                  $self->{RedmineCacheCredsCount} = 0;
                  $self->{RedmineCacheCredsMax} = $arg;
                }
              }
              sub trim {
                my $string = shift;
                $string =~ s/\s{2,}/ /g;
                return $string;
              }
              sub set_val {
                my ($key, $self, $parms, $arg) = @_;
                $self->{$key} = $arg;
              }
              Apache2::Module::add(__PACKAGE__, \@directives);
              my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
              sub access_handler {
                my $r = shift;
                unless ($r->some_auth_required) {
                    $r->log_reason("No authentication has been configured");
                    return FORBIDDEN;
                }
                my $method = $r->method;
                return OK unless defined $read_only_methods{$method};
                my $project_id = get_project_identifier($r);
                $r->set_handlers(PerlAuthenHandler => [\&OK])
                    if is_public_project($project_id, $r);
                return OK
              }
              sub authen_handler {
                my $r = shift;
                my ($res, $redmine_pass) =  $r->get_basic_auth_pw();
                return $res unless $res == OK;
                if (is_member($r->user, $redmine_pass, $r)) {
                    return OK;
                } else {
                    $r->note_auth_failure();
                    return AUTH_REQUIRED;
                }
              }
              # check if authentication is forced
              sub is_authentication_forced {
                my $r = shift;
                my $dbh = connect_database($r);
                my $sth = $dbh->prepare(
                  "SELECT value FROM settings where settings.name = 'login_required';"
                );
                $sth->execute();
                my $ret = 0;
                if (my @row = $sth->fetchrow_array) {
                  if ($row[0] eq "1" || $row[0] eq "t") {
                    $ret = 1;
                  }
                }
                $sth->finish();
                undef $sth;
                $dbh->disconnect();
                undef $dbh;
                $ret;
              }
              sub is_public_project {
                  my $project_id = shift;
                  my $r = shift;
                  if (is_authentication_forced($r)) {
                    return 0;
                  }
                  my $dbh = connect_database($r);
                  my $sth = $dbh->prepare(
                      "SELECT is_public FROM projects WHERE projects.identifier = ?;"
                  );
                  $sth->execute($project_id);
                  my $ret = 0;
                  if (my @row = $sth->fetchrow_array) {
                  	if ($row[0] eq "1" || $row[0] eq "t") {
                  		$ret = 1;
                  	}
                  }
                  $sth->finish();
                  undef $sth;
                  $dbh->disconnect();
                  undef $dbh;
                  $ret;
              }
              # perhaps we should use repository right (other read right) to check public access.
              # it could be faster BUT it doesn't work for the moment.
              # sub is_public_project_by_file {
              #     my $project_id = shift;
              #     my $r = shift;
              #     my $tree = Apache2::Directive::conftree();
              #     my $node = $tree->lookup('Location', $r->location);
              #     my $hash = $node->as_hash;
              #     my $svnparentpath = $hash->{SVNParentPath};
              #     my $repos_path = $svnparentpath . "/" . $project_id;
              #     return 1 if (stat($repos_path))[2] & 00007;
              # }
              sub is_member {
                my $redmine_user = shift;
                my $redmine_pass = shift;
                my $r = shift;
                my $dbh         = connect_database($r);
                my $project_id  = get_project_identifier($r);
                my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
                my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
                my $usrprojpass;
                if ($cfg->{RedmineCacheCredsMax}) {
                  $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
                  return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
                }
                my $query = $cfg->{RedmineQuery};
                my $sth = $dbh->prepare($query);
                $sth->execute($redmine_user, $project_id);
                my $ret;
-               while (my ($hashed_password, $auth_source_id, $permissions) = $sth->fetchrow_array) {
+               while (my ($hashed_password, $salt, $auth_source_id, $permissions) = $sth->fetchrow_array) {
                    unless ($auth_source_id) {
-             	  my $method = $r->method;
-                       if ($hashed_password eq $pass_digest && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
+             	  			my $method = $r->method;
+                       my $salted_password = Digest::SHA1::sha1_hex($salt.$pass_digest);
+             					if ($hashed_password eq $salted_password && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
                            $ret = 1;
                            last;
                        }
                    } elsif ($CanUseLDAPAuth) {
                        my $sthldap = $dbh->prepare(
                            "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
                        );
                        $sthldap->execute($auth_source_id);
                        while (my @rowldap = $sthldap->fetchrow_array) {
                          my $ldap = Authen::Simple::LDAP->new(
                              host    =>      ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]:$rowldap[1]" : $rowldap[0],
                              port    =>      $rowldap[1],
                              basedn  =>      $rowldap[5],
                              binddn  =>      $rowldap[3] ? $rowldap[3] : "",
                              bindpw  =>      $rowldap[4] ? $rowldap[4] : "",
                              filter  =>      "(".$rowldap[6]."=%s)"
                          );
                          my $method = $r->method;
                          $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass) && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/));
                        }
                        $sthldap->finish();
                        undef $sthldap;
                    }
                }
                $sth->finish();
                undef $sth;
                $dbh->disconnect();
                undef $dbh;
                if ($cfg->{RedmineCacheCredsMax} and $ret) {
                  if (defined $usrprojpass) {
                    $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                  } else {
                    if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
                      $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                      $cfg->{RedmineCacheCredsCount}++;
                    } else {
                      $cfg->{RedmineCacheCreds}->clear();
                      $cfg->{RedmineCacheCredsCount} = 0;
                    }
                  }
                }
                $ret;
              }
              sub get_project_identifier {
                  my $r = shift;
                  my $location = $r->location;
                  my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
                  $identifier;
              }
              sub connect_database {
                  my $r = shift;
                  my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
                  return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
              }
 ;

test/fixtures/users.yml +13 -5

              ---
              users_004:
                created_on: 2006-07-19 19:34:07 +02:00
                status: 1
                last_login_on:
                language: en
-               hashed_password: 4e4aeb7baaf0706bd670263fef42dad15763b608
+               # password = foo
+               salt: 3126f764c3c5ac61cbfc103f25f934cf
+               hashed_password: 9e4dd7eeb172c12a0691a6d9d3a269f7e9fe671b
                updated_on: 2006-07-19 19:34:07 +02:00
                admin: false
                mail: rhill@somenet.foo
                lastname: Hill
                firstname: Robert
                id: 4
                auth_source_id:
                mail_notification: all
                login: rhill
                type: User
              users_001:
                created_on: 2006-07-19 19:12:21 +02:00
                status: 1
                last_login_on: 2006-07-19 22:57:52 +02:00
                language: en
-               hashed_password: d033e22ae348aeb5660fc2140aec35850c4da997
+               # password = admin
+               salt: 82090c953c4a0000a7db253b0691a6b4
+               hashed_password: b5b6ff9543bf1387374cdfa27a54c96d236a7150
                updated_on: 2006-07-19 22:57:52 +02:00
                admin: true
                mail: admin@somenet.foo
                lastname: Admin
                firstname: redMine
                id: 1
                auth_source_id:
                mail_notification: all
                login: admin
                type: User
              users_002:
                created_on: 2006-07-19 19:32:09 +02:00
                status: 1
                last_login_on: 2006-07-19 22:42:15 +02:00
                language: en
-               hashed_password: a9a653d4151fa2c081ba1ffc2c2726f3b80b7d7d
+               # password = jsmith
+               salt: 67eb4732624d5a7753dcea7ce0bb7d7d
+               hashed_password: bfbe06043353a677d0215b26a5800d128d5413bc
                updated_on: 2006-07-19 22:42:15 +02:00
                admin: false
                mail: jsmith@somenet.foo
                lastname: Smith
                firstname: John
                id: 2
                auth_source_id:
                mail_notification: all
                login: jsmith
                type: User
              users_003:
                created_on: 2006-07-19 19:33:19 +02:00
                status: 1
                last_login_on:
                language: en
-               hashed_password: 7feb7657aa7a7bf5aef3414a5084875f27192415
+               # password = foo
+               salt: 7599f9963ec07b5a3b55b354407120c0
+               hashed_password: 8f659c8d7c072f189374edacfa90d6abbc26d8ed
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: dlopper@somenet.foo
                lastname: Lopper
                firstname: Dave
                id: 3
                auth_source_id:
                mail_notification: all
                login: dlopper
                type: User
              users_005:
                id: 5
                created_on: 2006-07-19 19:33:19 +02:00
                # Locked
                status: 3
                last_login_on:
                language: en
-               hashed_password: 7feb7657aa7a7bf5aef3414a5084875f27192415
+               hashed_password: 1
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: dlopper2@somenet.foo
                lastname: Lopper2
                firstname: Dave2
                auth_source_id:
                mail_notification: all
                login: dlopper2
                type: User
              users_006:
                id: 6
                created_on: 2006-07-19 19:33:19 +02:00
                status: 0
                last_login_on:
                language: ''
                hashed_password: 1
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: ''
                lastname: Anonymous
                firstname: ''
                auth_source_id:
                mail_notification: only_my_events
                login: ''
                type: AnonymousUser
              users_007:
                id: 7
                created_on: 2006-07-19 19:33:19 +02:00
                status: 1
                last_login_on:
                language: ''
                hashed_password: 1
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: someone@foo.bar
                lastname: One
                firstname: Some
                auth_source_id:
                mail_notification: only_my_events
                login: someone
                type: User
              users_008:
                id: 8
                created_on: 2006-07-19 19:33:19 +02:00
                status: 1
                last_login_on:
                language: 'it'
                hashed_password: 1
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: miscuser8@foo.bar
                lastname: Misc
                firstname: User
                auth_source_id:
                mail_notification: only_my_events
                login: miscuser8
                type: User
              users_009:
                id: 9
                created_on: 2006-07-19 19:33:19 +02:00
                status: 1
                last_login_on:
                language: 'it'
                hashed_password: 1
                updated_on: 2006-07-19 19:33:19 +02:00
                admin: false
                mail: miscuser9@foo.bar
                lastname: Misc
                firstname: User
                auth_source_id:
                mail_notification: only_my_events
                login: miscuser9
                type: User
              groups_010:
                id: 10
                lastname: A Team
                type: Group
              groups_011:
                id: 11
                lastname: B Team
                type: Group

test/unit/user_test.rb +33 -1

              # Redmine - project management software
              # Copyright (C) 2006-2011  Jean-Philippe Lang
              #
              # This program is free software; you can redistribute it and/or
              # modify it under the terms of the GNU General Public License
              # as published by the Free Software Foundation; either version 2
              # of the License, or (at your option) any later version.
              #
              # This program is distributed in the hope that it will be useful,
              # but WITHOUT ANY WARRANTY; without even the implied warranty of
              # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
              # GNU General Public License for more details.
              #
              # You should have received a copy of the GNU General Public License
              # along with this program; if not, write to the Free Software
              # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
              require File.expand_path('../../test_helper', __FILE__)
              class UserTest < ActiveSupport::TestCase
                fixtures :users, :members, :projects, :roles, :member_roles, :auth_sources
                def setup
                  @admin = User.find(1)
                  @jsmith = User.find(2)
                  @dlopper = User.find(3)
                end
                test 'object_daddy creation' do
                  User.generate_with_protected!(:firstname => 'Testing connection')
                  User.generate_with_protected!(:firstname => 'Testing connection')
                  assert_equal 2, User.count(:all, :conditions => {:firstname => 'Testing connection'})
                end
                def test_truth
                  assert_kind_of User, @jsmith
                end
                def test_mail_should_be_stripped
                  u = User.new
                  u.mail = " foo@bar.com  "
                  assert_equal "foo@bar.com", u.mail
                end
                def test_create
                  user = User.new(:firstname => "new", :lastname => "user", :mail => "newuser@somenet.foo")
                  user.login = "jsmith"
                  user.password, user.password_confirmation = "password", "password"
                  # login uniqueness
                  assert !user.save
                  assert_equal 1, user.errors.count
                  user.login = "newuser"
                  user.password, user.password_confirmation = "passwd", "password"
                  # password confirmation
                  assert !user.save
                  assert_equal 1, user.errors.count
                  user.password, user.password_confirmation = "password", "password"
                  assert user.save
                end
                context "User#before_create" do
                  should "set the mail_notification to the default Setting" do
                    @user1 = User.generate_with_protected!
                    assert_equal 'only_my_events', @user1.mail_notification
                    with_settings :default_notification_option => 'all' do
                      @user2 = User.generate_with_protected!
                      assert_equal 'all', @user2.mail_notification
                    end
                  end
                end
                context "User.login" do
                  should "be case-insensitive." do
                    u = User.new(:firstname => "new", :lastname => "user", :mail => "newuser@somenet.foo")
                    u.login = 'newuser'
                    u.password, u.password_confirmation = "password", "password"
                    assert u.save
                    u = User.new(:firstname => "Similar", :lastname => "User", :mail => "similaruser@somenet.foo")
                    u.login = 'NewUser'
                    u.password, u.password_confirmation = "password", "password"
                    assert !u.save
                    assert_equal I18n.translate('activerecord.errors.messages.taken'), u.errors.on(:login)
                  end
                end
                def test_mail_uniqueness_should_not_be_case_sensitive
                  u = User.new(:firstname => "new", :lastname => "user", :mail => "newuser@somenet.foo")
                  u.login = 'newuser1'
                  u.password, u.password_confirmation = "password", "password"
                  assert u.save
                  u = User.new(:firstname => "new", :lastname => "user", :mail => "newUser@Somenet.foo")
                  u.login = 'newuser2'
                  u.password, u.password_confirmation = "password", "password"
                  assert !u.save
                  assert_equal I18n.translate('activerecord.errors.messages.taken'), u.errors.on(:mail)
                end
                def test_update
                  assert_equal "admin", @admin.login
                  @admin.login = "john"
                  assert @admin.save, @admin.errors.full_messages.join("; ")
                  @admin.reload
                  assert_equal "john", @admin.login
                end
                def test_destroy_should_delete_members_and_roles
                  members = Member.find_all_by_user_id(2)
                  ms = members.size
                  rs = members.collect(&:roles).flatten.size
                  assert_difference 'Member.count', - ms do
                    assert_difference 'MemberRole.count', - rs do
                      User.find(2).destroy
                    end
                  end
                  assert_nil User.find_by_id(2)
                  assert Member.find_all_by_user_id(2).empty?
                end
                def test_destroy_should_update_attachments
                  attachment = Attachment.create!(:container => Project.find(1),
                    :file => uploaded_test_file("testfile.txt", "text/plain"),
                    :author_id => 2)
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, attachment.reload.author
                end
                def test_destroy_should_update_comments
                  comment = Comment.create!(
                    :commented => News.create!(:project_id => 1, :author_id => 1, :title => 'foo', :description => 'foo'),
                    :author => User.find(2),
                    :comments => 'foo'
                  )
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, comment.reload.author
                end
                def test_destroy_should_update_issues
                  issue = Issue.create!(:project_id => 1, :author_id => 2, :tracker_id => 1, :subject => 'foo')
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, issue.reload.author
                end
                def test_destroy_should_unassign_issues
                  issue = Issue.create!(:project_id => 1, :author_id => 1, :tracker_id => 1, :subject => 'foo', :assigned_to_id => 2)
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil issue.reload.assigned_to
                end
                def test_destroy_should_update_journals
                  issue = Issue.create!(:project_id => 1, :author_id => 2, :tracker_id => 1, :subject => 'foo')
                  issue.init_journal(User.find(2), "update")
                  issue.save!
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, issue.journals.first.reload.user
                end
                def test_destroy_should_update_journal_details_old_value
                  issue = Issue.create!(:project_id => 1, :author_id => 1, :tracker_id => 1, :subject => 'foo', :assigned_to_id => 2)
                  issue.init_journal(User.find(1), "update")
                  issue.assigned_to_id = nil
                  assert_difference 'JournalDetail.count' do
                    issue.save!
                  end
                  journal_detail = JournalDetail.first(:order => 'id DESC')
                  assert_equal '2', journal_detail.old_value
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous.id.to_s, journal_detail.reload.old_value
                end
                def test_destroy_should_update_journal_details_value
                  issue = Issue.create!(:project_id => 1, :author_id => 1, :tracker_id => 1, :subject => 'foo')
                  issue.init_journal(User.find(1), "update")
                  issue.assigned_to_id = 2
                  assert_difference 'JournalDetail.count' do
                    issue.save!
                  end
                  journal_detail = JournalDetail.first(:order => 'id DESC')
                  assert_equal '2', journal_detail.value
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous.id.to_s, journal_detail.reload.value
                end
                def test_destroy_should_update_messages
                  board = Board.create!(:project_id => 1, :name => 'Board', :description => 'Board')
                  message = Message.create!(:board_id => board.id, :author_id => 2, :subject => 'foo', :content => 'foo')
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, message.reload.author
                end
                def test_destroy_should_update_news
                  news = News.create!(:project_id => 1, :author_id => 2, :title => 'foo', :description => 'foo')
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, news.reload.author
                end
                def test_destroy_should_delete_private_queries
                  query = Query.new(:name => 'foo', :is_public => false)
                  query.project_id = 1
                  query.user_id = 2
                  query.save!
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil Query.find_by_id(query.id)
                end
                def test_destroy_should_update_public_queries
                  query = Query.new(:name => 'foo', :is_public => true)
                  query.project_id = 1
                  query.user_id = 2
                  query.save!
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, query.reload.user
                end
                def test_destroy_should_update_time_entries
                  entry = TimeEntry.new(:hours => '2', :spent_on => Date.today, :activity => TimeEntryActivity.create!(:name => 'foo'))
                  entry.project_id = 1
                  entry.user_id = 2
                  entry.save!
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, entry.reload.user
                end
                def test_destroy_should_delete_tokens
                  token = Token.create!(:user_id => 2, :value => 'foo')
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil Token.find_by_id(token.id)
                end
                def test_destroy_should_delete_watchers
                  issue = Issue.create!(:project_id => 1, :author_id => 1, :tracker_id => 1, :subject => 'foo')
                  watcher = Watcher.create!(:user_id => 2, :watchable => issue)
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil Watcher.find_by_id(watcher.id)
                end
                def test_destroy_should_update_wiki_contents
                  wiki_content = WikiContent.create!(
                    :text => 'foo',
                    :author_id => 2,
                    :page => WikiPage.create!(:title => 'Foo', :wiki => Wiki.create!(:project_id => 1, :start_page => 'Start'))
                  )
                  wiki_content.text = 'bar'
                  assert_difference 'WikiContent::Version.count' do
                    wiki_content.save!
                  end
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_equal User.anonymous, wiki_content.reload.author
                  wiki_content.versions.each do |version|
                    assert_equal User.anonymous, version.reload.author
                  end
                end
                def test_destroy_should_nullify_issue_categories
                  category = IssueCategory.create!(:project_id => 1, :assigned_to_id => 2, :name => 'foo')
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil category.reload.assigned_to_id
                end
                def test_destroy_should_nullify_changesets
                  changeset = Changeset.create!(
                    :repository => Repository::Subversion.create!(
                      :project_id => 1,
                      :url => 'file:///var/svn'
                    ),
                    :revision => '12',
                    :committed_on => Time.now,
                    :committer => 'jsmith'
                    )
                  assert_equal 2, changeset.user_id
                  User.find(2).destroy
                  assert_nil User.find_by_id(2)
                  assert_nil changeset.reload.user_id
                end
                def test_anonymous_user_should_not_be_destroyable
                  assert_no_difference 'User.count' do
                    assert_equal false, User.anonymous.destroy
                  end
                end
                def test_validate_login_presence
                  @admin.login = ""
                  assert !@admin.save
                  assert_equal 1, @admin.errors.count
                end
                def test_validate_mail_notification_inclusion
                  u = User.new
                  u.mail_notification = 'foo'
                  u.save
                  assert_not_nil u.errors.on(:mail_notification)
                end
                context "User#try_to_login" do
                  should "fall-back to case-insensitive if user login is not found as-typed." do
                    user = User.try_to_login("AdMin", "admin")
                    assert_kind_of User, user
                    assert_equal "admin", user.login
                  end
                  should "select the exact matching user first" do
                    case_sensitive_user = User.generate_with_protected!(:login => 'changed', :password => 'admin', :password_confirmation => 'admin')
                    # bypass validations to make it appear like existing data
                    case_sensitive_user.update_attribute(:login, 'ADMIN')
                    user = User.try_to_login("ADMIN", "admin")
                    assert_kind_of User, user
                    assert_equal "ADMIN", user.login
                  end
                end
                def test_password
                  user = User.try_to_login("admin", "admin")
                  assert_kind_of User, user
                  assert_equal "admin", user.login
                  user.password = "hello"
                  assert user.save
                  user = User.try_to_login("admin", "hello")
                  assert_kind_of User, user
                  assert_equal "admin", user.login
-                 assert_equal User.hash_password("hello"), user.hashed_password
                end
                def test_name_format
                  assert_equal 'Smith, John', @jsmith.name(:lastname_coma_firstname)
                  Setting.user_format = :firstname_lastname
                  assert_equal 'John Smith', @jsmith.reload.name
                  Setting.user_format = :username
                  assert_equal 'jsmith', @jsmith.reload.name
                end
                def test_lock
                  user = User.try_to_login("jsmith", "jsmith")
                  assert_equal @jsmith, user
                  @jsmith.status = User::STATUS_LOCKED
                  assert @jsmith.save
                  user = User.try_to_login("jsmith", "jsmith")
                  assert_equal nil, user
                end
+               context ".try_to_login" do
+                 context "with good credentials" do
+                   should "return the user" do
+                     user = User.try_to_login("admin", "admin")
+                     assert_kind_of User, user
+                     assert_equal "admin", user.login
+                   end
+                 end
+                 context "with wrong credentials" do
+                   should "return nil" do
+                     assert_nil User.try_to_login("admin", "foo")
+                   end
+                 end
+               end
                if ldap_configured?
                  context "#try_to_login using LDAP" do
                    context "with failed connection to the LDAP server" do
                      should "return nil" do
                        @auth_source = AuthSourceLdap.find(1)
                        AuthSource.any_instance.stubs(:initialize_ldap_con).raises(Net::LDAP::LdapError, 'Cannot connect')
                        assert_equal nil, User.try_to_login('edavis', 'wrong')
                      end
                    end
                    context "with an unsuccessful authentication" do
                      should "return nil" do
                        assert_equal nil, User.try_to_login('edavis', 'wrong')
                      end
                    end
                    context "on the fly registration" do
                      setup do
                        @auth_source = AuthSourceLdap.find(1)
                      end
                      context "with a successful authentication" do
                        should "create a new user account if it doesn't exist" do
                          assert_difference('User.count') do
                            user = User.try_to_login('edavis', '123456')
                            assert !user.admin?
                          end
                        end
                        should "retrieve existing user" do
                          user = User.try_to_login('edavis', '123456')
                          user.admin = true
                          user.save!
                          assert_no_difference('User.count') do
                            user = User.try_to_login('edavis', '123456')
                            assert user.admin?
                          end
                        end
                      end
                    end
                  end
                else
                  puts "Skipping LDAP tests."
                end
                def test_create_anonymous
                  AnonymousUser.delete_all
                  anon = User.anonymous
                  assert !anon.new_record?
                  assert_kind_of AnonymousUser, anon
                end
                should_have_one :rss_token
                def test_rss_key
                  assert_nil @jsmith.rss_token
                  key = @jsmith.rss_key
                  assert_equal 40, key.length
                  @jsmith.reload
                  assert_equal key, @jsmith.rss_key
                end
                should_have_one :api_token
                context "User#api_key" do
                  should "generate a new one if the user doesn't have one" do
                    user = User.generate_with_protected!(:api_token => nil)
                    assert_nil user.api_token
                    key = user.api_key
                    assert_equal 40, key.length
                    user.reload
                    assert_equal key, user.api_key
                  end
                  should "return the existing api token value" do
                    user = User.generate_with_protected!
                    token = Token.generate!(:action => 'api')
                    user.api_token = token
                    assert user.save
                    assert_equal token.value, user.api_key
                  end
                end
                context "User#find_by_api_key" do
                  should "return nil if no matching key is found" do
                    assert_nil User.find_by_api_key('zzzzzzzzz')
                  end
                  should "return nil if the key is found for an inactive user" do
                    user = User.generate_with_protected!(:status => User::STATUS_LOCKED)
                    token = Token.generate!(:action => 'api')
                    user.api_token = token
                    user.save
                    assert_nil User.find_by_api_key(token.value)
                  end
                  should "return the user if the key is found for an active user" do
                    user = User.generate_with_protected!(:status => User::STATUS_ACTIVE)
                    token = Token.generate!(:action => 'api')
                    user.api_token = token
                    user.save
                    assert_equal user, User.find_by_api_key(token.value)
                  end
                end
                def test_roles_for_project
                  # user with a role
                  roles = @jsmith.roles_for_project(Project.find(1))
                  assert_kind_of Role, roles.first
                  assert_equal "Manager", roles.first.name
                  # user with no role
                  assert_nil @dlopper.roles_for_project(Project.find(2)).detect {|role| role.member?}
                end
                def test_valid_notification_options
                  # without memberships
                  assert_equal 5, User.find(7).valid_notification_options.size
                  # with memberships
                  assert_equal 6, User.find(2).valid_notification_options.size
                end
                def test_valid_notification_options_class_method
                  assert_equal 5, User.valid_notification_options.size
                  assert_equal 5, User.valid_notification_options(User.find(7)).size
                  assert_equal 6, User.valid_notification_options(User.find(2)).size
                end
                def test_mail_notification_all
                  @jsmith.mail_notification = 'all'
                  @jsmith.notified_project_ids = []
                  @jsmith.save
                  @jsmith.reload
                  assert @jsmith.projects.first.recipients.include?(@jsmith.mail)
                end
                def test_mail_notification_selected
                  @jsmith.mail_notification = 'selected'
                  @jsmith.notified_project_ids = [1]
                  @jsmith.save
                  @jsmith.reload
                  assert Project.find(1).recipients.include?(@jsmith.mail)
                end
                def test_mail_notification_only_my_events
                  @jsmith.mail_notification = 'only_my_events'
                  @jsmith.notified_project_ids = []
                  @jsmith.save
                  @jsmith.reload
                  assert !@jsmith.projects.first.recipients.include?(@jsmith.mail)
                end
                def test_comments_sorting_preference
                  assert !@jsmith.wants_comments_in_reverse_order?
                  @jsmith.pref.comments_sorting = 'asc'
                  assert !@jsmith.wants_comments_in_reverse_order?
                  @jsmith.pref.comments_sorting = 'desc'
                  assert @jsmith.wants_comments_in_reverse_order?
                end
                def test_find_by_mail_should_be_case_insensitive
                  u = User.find_by_mail('JSmith@somenet.foo')
                  assert_not_nil u
                  assert_equal 'jsmith@somenet.foo', u.mail
                end
                def test_random_password
                  u = User.new
                  u.random_password
                  assert !u.password.blank?
                  assert !u.password_confirmation.blank?
                end
                context "#change_password_allowed?" do
                  should "be allowed if no auth source is set" do
                    user = User.generate_with_protected!
                    assert user.change_password_allowed?
                  end
                  should "delegate to the auth source" do
                    user = User.generate_with_protected!
                    allowed_auth_source = AuthSource.generate!
                    def allowed_auth_source.allow_password_changes?; true; end
                    denied_auth_source = AuthSource.generate!
                    def denied_auth_source.allow_password_changes?; false; end
                    assert user.change_password_allowed?
                    user.auth_source = allowed_auth_source
                    assert user.change_password_allowed?, "User not allowed to change password, though auth source does"
                    user.auth_source = denied_auth_source
                    assert !user.change_password_allowed?, "User allowed to change password, though auth source does not"
                  end
                end
                context "#allowed_to?" do
                  context "with a unique project" do
                    should "return false if project is archived" do
                      project = Project.find(1)
                      Project.any_instance.stubs(:status).returns(Project::STATUS_ARCHIVED)
                      assert ! @admin.allowed_to?(:view_issues, Project.find(1))
                    end
                    should "return false if related module is disabled" do
                      project = Project.find(1)
                      project.enabled_module_names = ["issue_tracking"]
                      assert @admin.allowed_to?(:add_issues, project)
                      assert ! @admin.allowed_to?(:view_wiki_pages, project)
                    end
                    should "authorize nearly everything for admin users" do
                      project = Project.find(1)
                      assert ! @admin.member_of?(project)
                      %w(edit_issues delete_issues manage_news manage_documents manage_wiki).each do |p|
                        assert @admin.allowed_to?(p.to_sym, project)
                      end
                    end
                    should "authorize normal users depending on their roles" do
                      project = Project.find(1)
                      assert @jsmith.allowed_to?(:delete_messages, project)    #Manager
                      assert ! @dlopper.allowed_to?(:delete_messages, project) #Developper
                    end
                  end
                  context "with multiple projects" do
                    should "return false if array is empty" do
                      assert ! @admin.allowed_to?(:view_project, [])
                    end
                    should "return true only if user has permission on all these projects" do
                      assert @admin.allowed_to?(:view_project, Project.all)
                      assert ! @dlopper.allowed_to?(:view_project, Project.all) #cannot see Project(2)
                      assert @jsmith.allowed_to?(:edit_issues, @jsmith.projects) #Manager or Developer everywhere
                      assert ! @jsmith.allowed_to?(:delete_issue_watchers, @jsmith.projects) #Dev cannot delete_issue_watchers
                    end
                    should "behave correctly with arrays of 1 project" do
                      assert ! User.anonymous.allowed_to?(:delete_issues, [Project.first])
                    end
                  end
                  context "with options[:global]" do
                    should "authorize if user has at least one role that has this permission" do
                      @dlopper2 = User.find(5) #only Developper on a project, not Manager anywhere
                      @anonymous = User.find(6)
                      assert @jsmith.allowed_to?(:delete_issue_watchers, nil, :global => true)
                      assert ! @dlopper2.allowed_to?(:delete_issue_watchers, nil, :global => true)
                      assert @dlopper2.allowed_to?(:add_issues, nil, :global => true)
                      assert ! @anonymous.allowed_to?(:add_issues, nil, :global => true)
                      assert @anonymous.allowed_to?(:view_issues, nil, :global => true)
                    end
                  end
                end
                context "User#notify_about?" do
                  context "Issues" do
                    setup do
                      @project = Project.find(1)
                      @author = User.generate_with_protected!
                      @assignee = User.generate_with_protected!
                      @issue = Issue.generate_for_project!(@project, :assigned_to => @assignee, :author => @author)
                    end
                    should "be true for a user with :all" do
                      @author.update_attribute(:mail_notification, 'all')
                      assert @author.notify_about?(@issue)
                    end
                    should "be false for a user with :none" do
                      @author.update_attribute(:mail_notification, 'none')
                      assert ! @author.notify_about?(@issue)
                    end
                    should "be false for a user with :only_my_events and isn't an author, creator, or assignee" do
                      @user = User.generate_with_protected!(:mail_notification => 'only_my_events')
                      Member.create!(:user => @user, :project => @project, :role_ids => [1])
                      assert ! @user.notify_about?(@issue)
                    end
                    should "be true for a user with :only_my_events and is the author" do
                      @author.update_attribute(:mail_notification, 'only_my_events')
                      assert @author.notify_about?(@issue)
                    end
                    should "be true for a user with :only_my_events and is the assignee" do
                      @assignee.update_attribute(:mail_notification, 'only_my_events')
                      assert @assignee.notify_about?(@issue)
                    end
                    should "be true for a user with :only_assigned and is the assignee" do
                      @assignee.update_attribute(:mail_notification, 'only_assigned')
                      assert @assignee.notify_about?(@issue)
                    end
                    should "be false for a user with :only_assigned and is not the assignee" do
                      @author.update_attribute(:mail_notification, 'only_assigned')
                      assert ! @author.notify_about?(@issue)
                    end
                    should "be true for a user with :only_owner and is the author" do
                      @author.update_attribute(:mail_notification, 'only_owner')
                      assert @author.notify_about?(@issue)
                    end
                    should "be false for a user with :only_owner and is not the author" do
                      @assignee.update_attribute(:mail_notification, 'only_owner')
                      assert ! @assignee.notify_about?(@issue)
                    end
                    should "be true for a user with :selected and is the author" do
                      @author.update_attribute(:mail_notification, 'selected')
                      assert @author.notify_about?(@issue)
                    end
                    should "be true for a user with :selected and is the assignee" do
                      @assignee.update_attribute(:mail_notification, 'selected')
                      assert @assignee.notify_about?(@issue)
                    end
                    should "be false for a user with :selected and is not the author or assignee" do
                      @user = User.generate_with_protected!(:mail_notification => 'selected')
                      Member.create!(:user => @user, :project => @project, :role_ids => [1])
                      assert ! @user.notify_about?(@issue)
                    end
                  end
                  context "other events" do
                    should 'be added and tested'
                  end
                end
+               def test_salt_unsalted_passwords
+                 # Restore a user with an unsalted password
+                 user = User.find(1)
+                 user.salt = nil
+                 user.hashed_password = User.hash_password("unsalted")
+                 user.save!
+                 User.salt_unsalted_passwords!
+                 user.reload
+                 # Salt added
+                 assert !user.salt.blank?
+                 # Password still valid
+                 assert user.check_password?("unsalted")
+                 assert_equal user, User.try_to_login(user.login, "unsalted")
+               end
                if Object.const_defined?(:OpenID)
                def test_setting_identity_url
                  normalized_open_id_url = 'http://example.com/'
                  u = User.new( :identity_url => 'http://example.com/' )
                  assert_equal normalized_open_id_url, u.identity_url
                end
                def test_setting_identity_url_without_trailing_slash
                  normalized_open_id_url = 'http://example.com/'
                  u = User.new( :identity_url => 'http://example.com' )
                  assert_equal normalized_open_id_url, u.identity_url
                end
                def test_setting_identity_url_without_protocol
                  normalized_open_id_url = 'http://example.com/'
                  u = User.new( :identity_url => 'example.com' )
                  assert_equal normalized_open_id_url, u.identity_url
                end
                def test_setting_blank_identity_url
                  u = User.new( :identity_url => 'example.com' )
                  u.identity_url = ''
                  assert u.identity_url.blank?
                end
                def test_setting_invalid_identity_url
                  u = User.new( :identity_url => 'this is not an openid url' )
                  assert u.identity_url.blank?
                end
                else
                  puts "Skipping openid tests."
                end
              end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages