TheDude
/
openproject
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Rewrite broken password_complexity cuke

Browse Source
pull/5884/head
Oliver Günther 7 years ago
parent 28ff6e0fc9
commit 6702853a28
No known key found for this signature in database
GPG Key ID: 88872239EB414F99
4 changed files with 188 additions and 97 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 4
      app/views/repositories/_revisions.html.erb
  2. 51
      features/users/password_complexity_checks.feature
  3. 180
      spec/features/users/password_change_spec.rb
  4. 50
      spec/support/pages/my/password_page.rb

4
app/views/repositories/_revisions.html.erb
Unescape View File

@ -119,7 +119,7 @@ See docs/COPYRIGHT.rdoc for more details.
<%= radio_button_tag 'rev',
changeset.identifier,
(line_num==1),
id: "cb-#{line_num}") %>
id: "cb-#{line_num}" %>
<% csp_onclick("jQuery('#cbto-#{line_num+1}').attr('checked', true);",
"cb-#{line_num}") %>
<% end %>
@ -130,7 +130,7 @@ See docs/COPYRIGHT.rdoc for more details.
<%= radio_button_tag 'rev_to',
changeset.identifier,
(line_num==2),
id: "cbto-#{line_num}") %>
id: "cbto-#{line_num}" %>
<% csp_onclick("if (jQuery('#cb-#{line_num}').attr('checked')) {jQuery('#cb-#{line_num-1}').attr('checked', true)}",
"cbto-#{line_num}") %>
<% end %>

51
features/users/password_complexity_checks.feature
Unescape View File

@ -1,51 +0,0 @@
#-- copyright
# OpenProject is a project management system.
# Copyright (C) 2012-2018 the OpenProject Foundation (OPF)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License version 3.
#
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
# Copyright (C) 2006-2017 Jean-Philippe Lang
# Copyright (C) 2010-2013 the ChiliProject Team
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#
# See docs/COPYRIGHT.rdoc for more details.
#++
Feature: Password Complexity Checks
Scenario: A user changing the password including attempts to set not complex enough passwords
Given passwords must contain 2 of lowercase, uppercase, and numeric characters
And passwords have a minimum length of 4 characters
And I am logged in
And I try to set my new password to "password"
Then there should be an error message
When I try to set my new password to "Password"
Then the password change should succeed
And I should be able to login using the new password
Scenario: An admin can change the password complexity requirements and they are effective
Given I am already admin
When I go to the authentication tab of the settings page
And I activate the lowercase, uppercase, and special password rules
And I fill in "Minimum number of required classes" with "3"
And I save the settings
And I try to set my new password to "adminADMIN"
Then there should be an error message
And I try to set my new password to "adminADMIN123"
Then there should be an error message
And I try to set my new password to "adminADMIN!"
Then the password change should succeed

180
spec/features/users/password_change_spec.rb
Unescape View File

@ -36,65 +36,157 @@ describe 'random password generation', type: :feature, js: true do
let(:user) { FactoryGirl.create :user, password: old_password, password_confirmation: old_password }
let(:user_page) { ::Pages::Admin::User.new(user.id) }
before do
login_with admin.login, 'adminADMIN!'
end
describe 'as admin user' do
before do
login_with admin.login, 'adminADMIN!'
end
it 'can log in with a random generated password' do
user_page.visit!
expect(page).to have_selector('#user_password')
expect(page).to have_selector('#user_password_confirmation')
check 'user_assign_random_password'
expect(page).to have_selector('#user_password[disabled]')
expect(page).to have_selector('#user_password_confirmation[disabled]')
it 'can log in with a random generated password' do
user_page.visit!
# Remember password for login
password = nil
expect(OpenProject::Passwords::Generator)
.to receive(:random_password)
.and_wrap_original { |m, *args| password = m.call(*args) }
expect(page).to have_selector('#user_password')
expect(page).to have_selector('#user_password_confirmation')
click_on 'Save'
check 'user_assign_random_password'
expect(page).to have_selector('.flash', text: I18n.t(:notice_successful_update))
expect(password).to be_present
expect(page).to have_selector('#user_password[disabled]')
expect(page).to have_selector('#user_password_confirmation[disabled]')
# Logout
visit signout_path
login_with user.login, password
# Remember password for login
password = nil
expect(OpenProject::Passwords::Generator)
.to receive(:random_password)
.and_wrap_original { |m, *args| password = m.call(*args) }
# Expect password change
expect(page).to have_selector('#new_password')
click_on 'Save'
# Give wrong password
fill_in 'password', with: old_password
fill_in 'new_password', with: new_password
fill_in 'new_password_confirmation', with: new_password
click_on 'Save'
expect(page).to have_selector('.flash', text: I18n.t(:notice_successful_update))
expect(password).to be_present
expect(page).to have_content 'Invalid user or password'
# Logout
visit signout_path
login_with user.login, password
# Give correct password
fill_in 'password', with: password
fill_in 'new_password', with: new_password
fill_in 'new_password_confirmation', with: new_password
click_on 'Save'
# Expect password change
expect(page).to have_selector('#new_password')
expect(page).to have_selector('.flash.notice', text: I18n.t(:notice_account_password_updated))
# Give wrong password
fill_in 'password', with: old_password
fill_in 'new_password', with: new_password
fill_in 'new_password_confirmation', with: new_password
click_on 'Save'
# Logout and sign in with outdated password
visit signout_path
login_with user.login, password
expect(page).to have_content 'Invalid user or password'
# Logout and sign in with new_passworwd
visit signout_path
login_with user.login, new_password
visit my_account_path
expect(page).to have_selector('.account-menu-item.selected')
end
end
##
# Converted from cuke password_complexity_checks.feature
context 'as an admin' do
before do
login_with admin.login, 'adminADMIN!'
end
it 'can configure and enforce password rules' do
visit '/settings'
expect_angular_frontend_initialized
# Go to authentication
find('#tab-authentication').click
# Enforce rules
# 3 of 'lowercase, uppercase, special'
find('.form--check-box[value=uppercase]').set true
find('.form--check-box[value=lowercase]').set true
find('.form--check-box[value=numeric]').set false
find('.form--check-box[value=special]').set true
# Set min length to 4
find('#settings_password_min_length').set 4
# Set min classes to 3
find('#settings_password_min_adhered_rules').set 3
scroll_to_and_click(find('.button', text: 'Save'))
expect(page).to have_selector('.flash.notice', text: I18n.t(:notice_successful_update))
Setting.clear_cache
expect(Setting.password_min_length).to eq(4)
expect(Setting.password_min_adhered_rules).to eq(3)
expect(Setting.password_active_rules).to eq(%w(uppercase lowercase special))
# Go to user page
user_page.visit!
expect(page).to have_selector('#user_password')
expect(page).to have_selector('#user_password_confirmation')
# And I try to set my new password to "adminADMIN"
fill_in 'user_password', with: 'adminADMIN'
fill_in 'user_password_confirmation', with: 'adminADMIN'
scroll_to_and_click(find('.button', text: 'Save'))
expect(page).to have_selector('#errorExplanation', text: "Password Must contain characters of the following classes")
# 2 of 3 classes
fill_in 'user_password', with: 'adminADMIN123'
fill_in 'user_password_confirmation', with: 'adminADMIN123'
scroll_to_and_click(find('.button', text: 'Save'))
expect(page).to have_selector('#errorExplanation', text: "Password Must contain characters of the following classes")
# All classes
fill_in 'user_password', with: 'adminADMIN!'
fill_in 'user_password_confirmation', with: 'adminADMIN!'
scroll_to_and_click(find('.button', text: 'Save'))
expect(page).to have_selector('.flash.notice', text: I18n.t(:notice_successful_update))
end
end
expect(page).to have_content 'Invalid user or password'
context 'as a user on his my page' do
let(:user_page) { ::Pages::My::PasswordPage.new }
# Give correct password
fill_in 'password', with: password
fill_in 'new_password', with: new_password
fill_in 'new_password_confirmation', with: new_password
click_on 'Save'
before do
login_with user.login, old_password
visit '/my/password'
end
expect(page).to have_selector('.flash.notice', text: I18n.t(:notice_account_password_updated))
context 'with 2 of lowercase, uppercase, and numeric characters',
with_settings: {
password_active_rules: %w(lowercase uppercase numeric),
password_min_adhered_rules: 2,
password_min_length: 4
} do
# Logout and sign in with outdated password
visit signout_path
login_with user.login, password
expect(page).to have_content 'Invalid user or password'
it 'enforces those rules' do
# Change to valid password according to spec
user_page.change_password(old_password, 'password')
# Logout and sign in with new_passworwd
visit signout_path
login_with user.login, new_password
expect(page).to have_selector('#errorExplanation', text: "Password Must contain characters of the following classes (at least 2 of 3): lowercase (e.g. 'a'), uppercase (e.g. 'A'), numeric (e.g. '1').")
visit my_account_path
expect(page).to have_selector('.account-menu-item.selected')
# Change to valid password according to spec
user_page.change_password(old_password, 'Password')
expect(page).to have_selector('.flash.notice', text: I18n.t(:notice_account_password_updated))
end
end
end
end

50
spec/support/pages/my/password_page.rb
Unescape View File

@ -0,0 +1,50 @@
#-- copyright
# OpenProject is a project management system.
# Copyright (C) 2012-2018 the OpenProject Foundation (OPF)
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License version 3.
#
# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
# Copyright (C) 2006-2017 Jean-Philippe Lang
# Copyright (C) 2010-2013 the ChiliProject Team
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
#
# See docs/COPYRIGHT.rdoc for more details.
#++
require 'support/pages/page'
module Pages
module My
class PasswordPage < ::Pages::Page
def path
'/my/password'
end
def change_password(old_password, new_password, confirmation = new_password)
# use find and set with id to prevent ambiguous match I get with fill_in
page.find('#password').set(old_password)
page.fill_in('new_password', with: new_password)
page.fill_in('new_password_confirmation', with: confirmation)
page.click_link_or_button 'Save'
end
end
end
end
Write Preview
Loading…
Cancel
Save