96 Commits (09cbe712b2d7b7307b2016c5335ebf9a9e2421d8)

Author	SHA1	Message	Date
Michael Frister	09cbe712b2	Login: Fix log warning being shown on not allowed password change	11 years ago
Michael Frister	0978e24dc0	AccountController#register: Refactor omniauth part into own method	11 years ago
kgalli	9e4f84844b	Removal of trailing white spaces	11 years ago
kgalli	a4b155eef2	Removal of unnecessary auth_hash method	11 years ago
kgalli	8f0c7cbfcd	bugfix for register method and refactoring of specs ... Bugfix register method was missing user.save for exteranl authentication other than omniauth. Refactoring of omniauth specs to use let method to set omniauth hash.	11 years ago
kgalli	5cb176124a	add omniauth failure callback and specs for omniauth login/registration	11 years ago
Michael Frister	068c04b1d1	AccountController: Rename method	11 years ago
kgalli	decc834ea6	Replace of flash notice for registration scenarios with automatic login	11 years ago
kgalli	35c334c6c5	redirect to first_login page for all new users to set accessibility mode	11 years ago
Michael Frister	d16e062b41	Omniauth: Fix lost_password deciding whether to allow reset	11 years ago
Michael Frister	475d0b33c5	Omniauth: Allow correcting validation errors via registration form ... This also sets User#password_change_allowed? to false for users authenticated via Omniauth and thus hides login and passwords fields from the register form when using Omniauth.	11 years ago
Michael Frister	673c620306	Begin to replace OpenID with omniauth ... Only UI yet is a link on the dedicated login page, a lot of OpenID remains are still in there and things are absolutely not secure or nice.	11 years ago
Michael Frister	3c324bdc42	Use strong_parameters for User, remove safe_attribtues	11 years ago
Johannes Wollert	8b096975fe	updates copyright headers ... updates more copyright more copyright headers	11 years ago
Michael Frister	626848551b	Rename Redmine::Configuration to OpenProject::Configuration ... This removes the configuration test, the test will later be updated and re-added as a spec.	11 years ago
Philipp Tessenow	a1e67dd460	new copyright header #1903	11 years ago
Michael Frister	1a848ee2f5	Add password expiry check ... Conflicts: doc/CHANGELOG.md	11 years ago
Philipp Tessenow	7aeb2fc979	fix #1405: fake invalid credentials when a blocked user tries to login	11 years ago
Michael Frister	4e439e2551	Don't show notice about brute force prevention when it's disabled	11 years ago
Michael Frister	d01ec32b3d	Block user on too many failed logins within specific period	11 years ago
Michael Frister	c75820a3e1	Don't force password change after using lost password ... Fixes: * don't redirect after login * show login name on my/password page	12 years ago
Michael Frister	7ba90102a7	Add option to force a user to change password on next login ... * Add force_password_reset field to user * Add force_password_reset field to user edit form Also, reindent the form HTML. * Rename force_password_reset to force_password_change * Force password change: Show form on login, allow change * Remove unused step definitions for setting RAILS_ENV * Fix forced password change, add cuke * Don't reveal whether user exists when not authenticated * Also add spec for testing reaction when user is not allowed to change the password. * Improve force password change code after review * Fix MyController password test and change to spec * Fix AccountController force password change spec	12 years ago
Michael Frister	089db98541	Improve password complexity requirements ... Add a new Passwords module, which evaluates and generates passwords. Adapt User to use this module. In addition to checking the length, the module verifies that a password contains a certain number of character classes like uppercase/lowercase. These classes can be configured in the authentication settings. Also increase the default minimum password length from 4 to 10.	12 years ago
Jens Ulferts	21459a384f	provide every possible file with a short copyright notice ... This was done using the rake task: rake copyright:update	12 years ago
Philipp Tessenow	ec3829e11b	be careful with nested namespace'd controllers in our controllers	12 years ago
Jens Ulferts	d5daa90937	prevents exploiting implicit mysql typecasting ... This should prevent an attacker from issuing a request where he sends a token param casted to integer. MySql would cast the value attribute of Token to integer which is either the integer at the beginning of the value or, in absence of such, 0.	12 years ago
Martin Linkhorst	6eafde439d	force attributes to be set where needed	12 years ago
Martin Linkhorst	2ed585a297	converted account activation requested email	12 years ago
Martin Linkhorst	a585c1b437	renamed lost_password to password_lost	12 years ago
Martin Linkhorst	727a232d3d	use the new mailer!	12 years ago
Tom Rochette	eed627011c	Login should redirect to welcome/home page if already logged in.	13 years ago
Stephan Eckardt	28d7bb1198	Show a notification about account activation on failed login due to inactive account	13 years ago
Gregor Schmidt	bc1aa80f02	Adding welcome page and asking for impaired settings	13 years ago
Holger Just	91070236db	Set source encoding to UTF-8	13 years ago
Romano Licker	0048ee49ac	[#671] include password in user form ... necessary to associate the error message with the password field	13 years ago
Holger Just	07185fb169	[#436] Remove trailing whitespace	14 years ago
Eric Davis	99507a0391	[#197] Upgrade the copyright in the code files	14 years ago
Eric Davis	e131c3b531	[#197] Remove old copyrights	14 years ago
Eric Davis	ed252f7246	[#309] Set the back_url after sending a lost password so HTTP_REFERER isn't used ... Contributed by Robert Chady	14 years ago
Eric Davis	1eee7312f6	[#289] Remove single helpers in favor of :all in ApplicationController	14 years ago
Felix Schäfer	10dffcf3b9	Get the autologin cookie name from the config #273	14 years ago
Jean-Philippe Lang	ef32606c43	Set the httponly flag on the autologin cookie. ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4757 e93f8b46-1217-0410-a6f0-8f06a7374b81	14 years ago
Jean-Philippe Lang	4adf3abf83	Makes the autologin cookie configurable (#1763). ... The cookie attributes (name, path, secure) can now be set in config/configuration.yml. git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@4756 e93f8b46-1217-0410-a6f0-8f06a7374b81	14 years ago
Eric Davis	8dde6e019d	Merged r3906 from trunk. ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.0-stable@3956 e93f8b46-1217-0410-a6f0-8f06a7374b81	14 years ago
Eric Davis	13234f8552	Refactor: Add methods to User to edit the encapsulate the status field. ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3906 e93f8b46-1217-0410-a6f0-8f06a7374b81	14 years ago
Jean-Philippe Lang	e109c9b6b6	Do not reset session when a non logged in user request the login form (#4958). ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3572 e93f8b46-1217-0410-a6f0-8f06a7374b81	15 years ago
Eric Davis	afdcd770dc	Refactor: Extract method ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3538 e93f8b46-1217-0410-a6f0-8f06a7374b81	15 years ago
Eric Davis	bc79caaf69	Refactor: Extract method ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3537 e93f8b46-1217-0410-a6f0-8f06a7374b81	15 years ago
Eric Davis	d2baf5f2a7	Log failed user logins to the Rails logger ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3411 e93f8b46-1217-0410-a6f0-8f06a7374b81	15 years ago
Eric Davis	c478fa7f90	Extract method ... git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3209 e93f8b46-1217-0410-a6f0-8f06a7374b81	15 years ago