Add cuke for brute force prevention; also add timecop

Gemfile

@@ -77,6 +77,7 @@ group :test do
   gem 'capybara'
   gem 'capybara-screenshot'
   gem 'selenium-webdriver'
+  gem 'timecop', "~> 0.6.1"
 
   gem 'rb-readline' # ruby on CI needs this
   # why in Gemfile? see: https://github.com/guard/guard-test

Gemfile.lock

@@ -342,6 +342,7 @@ GEM
       rack (>= 1.0.0)
     thor (0.18.1)
     tilt (1.4.1)
+    timecop (0.6.1)
     tinymce-rails (3.5.8.2)
       railties (>= 3.1.1)
     tinymce-rails-langs (0.1)
@@ -434,6 +435,7 @@ DEPENDENCIES
   strong_parameters
   therubyracer
   thin
+  timecop (~> 0.6.1)
   tinymce-rails
   tinymce-rails-langs
   uglifier (>= 1.0.3)

features/step_definitions/password_steps.rb

@@ -76,12 +76,12 @@ end
 
 Given /^I try to log in with user "([^"]*)"$/ do |login|
   step 'I go to the logout page'
-  step 'I go to the login page'
+  login(login, @password || 'adminADMIN!')
-  with_scope('#main') do
+end
-    fill_in('Login', :with => login)
+
-    fill_in('Password', :with => (@new_password || 'adminADMIN!'))
+Given /^I try to log in with user "([^"]*)" and a wrong password$/ do |login|
-    click_link_or_button('Login')
+  step 'I go to the logout page'
-  end
+  login(login, 'Wrong password')
 end
 
 When /^I activate the ([a-z, ]+) password rules$/ do |rules|

features/step_definitions/settings_steps.rb

@@ -43,3 +43,8 @@ end
 Given /^I save the settings$/ do
   click_button('Save', :visible => true)
 end
+
+Given /^users are blocked for ([0-9]+) minutes after ([0-9]+) failed login attempts$/ do |duration, attempts|
+  Setting.brute_force_block_minutes = duration
+  Setting.brute_force_block_after_failed_logins = attempts
+end

features/step_definitions/timecop_steps.rb

@@ -0,0 +1,20 @@
+#encoding: utf-8
+
+#-- copyright
+# OpenProject is a project management system.
+#
+# Copyright (C) 2012-2013 the OpenProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+Given /^the time is ([0-9]+) minutes later$/ do |duration|
+  Timecop.travel(Time.now + duration.to_i.minutes)
+end
+
+After do
+  Timecop.return
+end

features/users/brute_force_prevention.feature

@@ -0,0 +1,35 @@
+#encoding: utf-8
+
+#-- copyright
+# OpenProject is a project management system.
+#
+# Copyright (C) 2012-2013 the OpenProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# See doc/COPYRIGHT.rdoc for more details.
+#++
+
+Feature: Prevent brute force attacks
+  Background:
+    Given users are blocked for 5 minutes after 2 failed login attempts
+    And there is a user named "bob"
+
+  Scenario: A user failing to login on the first time can login on second attempt
+    When I try to log in with user "bob" and a wrong password
+    Then I should not see "Bob Bobbit"
+    When I try to log in with user "bob"
+    Then I should see "Bob Bobbit"
+
+  Scenario: A user can't login after two failed attempts, but can after waiting 5 minutes
+    When I try to log in with user "bob" and a wrong password
+    Then I should not see "Bob Bobbit"
+    When I try to log in with user "bob" and a wrong password
+    Then I should not see "Bob Bobbit"
+    When I try to log in with user "bob"
+    Then I should not see "Bob Bobbit"
+    When the time is 6 minutes later
+    And I try to log in with user "bob"
+    Then I should see "Bob Bobbit"
+