openproject

Commit Graph

Author	SHA1	Message	Date
Jens Ulferts	f3eb87c3e4	replace deprecated stub! with stub	11 years ago
Michael Frister	f884fbf4c2	Add option to prevent former passwords from being reused Squashed from single commits: * Add checks to prevent former passwords from being reused * Make number of banned former passwords configurable Also group settings into fieldsets on the authentication settings page. * Update TestUnit fixtures with UserPasswords * Add migration for creating user passwords * Fix new user password not being immediately used * Add cuke for ban of former passwords * Fix admin info showing whether admin password was changed * Fix password check for user without password and fix tests * Fix password complexity feature after translation changes * Adapt my_controller_spec to UserPasswords * Order UserPasswords by id created_at is not unique within one second, this breaks MySQL tests. id is guaranteed to be unique and monotonically increasing on MySQL and on Postgres(at least as long cache is not set for the sequence). * Rename secure_compare to secure_equals? * Immediately use reduced number of banned former passwords Only check number of former passwords as defined in settings. The number of stored passwords per user is only reduced when a user updates the password. * Add missing copyright notices * Update changelog	11 years ago
Michael Frister	7ba90102a7	Add option to force a user to change password on next login * Add force_password_reset field to user * Add force_password_reset field to user edit form Also, reindent the form HTML. * Rename force_password_reset to force_password_change * Force password change: Show form on login, allow change * Remove unused step definitions for setting RAILS_ENV * Fix forced password change, add cuke * Don't reveal whether user exists when not authenticated * Also add spec for testing reaction when user is not allowed to change the password. * Improve force password change code after review * Fix MyController password test and change to spec * Fix AccountController force password change spec	12 years ago

Author

SHA1

Message

Date

Jens Ulferts

f3eb87c3e4

replace deprecated stub! with stub

11 years ago

Michael Frister

f884fbf4c2

Add option to prevent former passwords from being reused

Squashed from single commits:
* Add checks to prevent former passwords from being reused
* Make number of banned former passwords configurable

  Also group settings into fieldsets on the authentication settings
  page.
* Update TestUnit fixtures with UserPasswords
* Add migration for creating user passwords
* Fix new user password not being immediately used
* Add cuke for ban of former passwords
* Fix admin info showing whether admin password was changed
* Fix password check for user without password and fix tests
* Fix password complexity feature after translation changes
* Adapt my_controller_spec to UserPasswords
* Order UserPasswords by id

  created_at is not unique within one second, this breaks MySQL tests.

  id is guaranteed to be unique and monotonically increasing on MySQL
  and on Postgres(at least as long cache is not set for the sequence).
* Rename secure_compare to secure_equals?
* Immediately use reduced number of banned former passwords

  Only check number of former passwords as defined in settings. The
  number of stored passwords per user is only reduced when a user
  updates the password.
* Add missing copyright notices
* Update changelog

11 years ago

Michael Frister

7ba90102a7

Add option to force a user to change password on next login

* Add force_password_reset field to user

* Add force_password_reset field to user edit form
  Also, reindent the form HTML.

* Rename force_password_reset to force_password_change

* Force password change: Show form on login, allow change

* Remove unused step definitions for setting RAILS_ENV

* Fix forced password change, add cuke

* Don't reveal whether user exists when not authenticated

* Also add spec for testing reaction when user is not allowed to change the password.

* Improve force password change code after review

* Fix MyController password test and change to spec

* Fix AccountController force password change spec

12 years ago

3 Commits (12af1745306662cd673abf5baf0afcbadaf7a9f2)