336 Commits (908958780d3de5ee1bd389ef87298749b12ca082)

Author	SHA1	Message	Date
Michael Frister	f884fbf4c2	Add option to prevent former passwords from being reused ... Squashed from single commits: * Add checks to prevent former passwords from being reused * Make number of banned former passwords configurable Also group settings into fieldsets on the authentication settings page. * Update TestUnit fixtures with UserPasswords * Add migration for creating user passwords * Fix new user password not being immediately used * Add cuke for ban of former passwords * Fix admin info showing whether admin password was changed * Fix password check for user without password and fix tests * Fix password complexity feature after translation changes * Adapt my_controller_spec to UserPasswords * Order UserPasswords by id created_at is not unique within one second, this breaks MySQL tests. id is guaranteed to be unique and monotonically increasing on MySQL and on Postgres(at least as long cache is not set for the sequence). * Rename secure_compare to secure_equals? * Immediately use reduced number of banned former passwords Only check number of former passwords as defined in settings. The number of stored passwords per user is only reduced when a user updates the password. * Add missing copyright notices * Update changelog	12 years ago
Michael Frister	501a2fecbb	Make old migration salting existing user passwords independent of User ... Remove code from user, remove test and adapt migration.	12 years ago
Sebastian Schuster	423152fa06	Fixed the uninitialized constant exception ... caused by the user class being loaded first in a pure core configuration in development	12 years ago
Sebastian Schuster	6d8eb89d53	Removed function to preload circular dependencies ... since it is not always running first to load the dependencies (see Bundler.require in application.rb), therefore explicitely requiring the dependencies in the files loads classes in the correct order no matter which is loaded first	12 years ago
Michael Frister	7ba90102a7	Add option to force a user to change password on next login ... * Add force_password_reset field to user * Add force_password_reset field to user edit form Also, reindent the form HTML. * Rename force_password_reset to force_password_change * Force password change: Show form on login, allow change * Remove unused step definitions for setting RAILS_ENV * Fix forced password change, add cuke * Don't reveal whether user exists when not authenticated * Also add spec for testing reaction when user is not allowed to change the password. * Improve force password change code after review * Fix MyController password test and change to spec * Fix AccountController force password change spec	12 years ago
Michael Frister	089db98541	Improve password complexity requirements ... Add a new Passwords module, which evaluates and generates passwords. Adapt User to use this module. In addition to checking the length, the module verifies that a password contains a certain number of character classes like uppercase/lowercase. These classes can be configured in the authentication settings. Also increase the default minimum password length from 4 to 10.	12 years ago
Jens Ulferts	21459a384f	provide every possible file with a short copyright notice ... This was done using the rake task: rake copyright:update	12 years ago
Christian Ratz	7ee079fa65	added SystemUser ... - sometimes we need an existing user eg. for migrations - it is possible to execute a block in the context of this SystemUser	12 years ago
Christian Ratz	54a78a37f7	changed user#random_password ... - new random password generation - moved random_password test to spec	12 years ago
Christian Ratz	045ae8c9dc	fix user create with empty pwd ... - fixed wrong condition in users pwd validation methode	12 years ago
Philipp Tessenow	15df2ecdcc	be careful with nested namespace'd controllers in our models	12 years ago
Philipp Tessenow	ddc7cf70b4	fix bug: User#allowed_to? couldn't handle Symbols in action[:controller]	12 years ago
Philipp Tessenow	7e5cc3816f	enables menus when beeing inside a namespaced controller	12 years ago
jwollert	487802dee7	migrate longer logins plugin to core	12 years ago
Martin Linkhorst	a188dfd713	Project.all_public can also be written as Project.public.all or just Project.public	12 years ago
Gregor Schmidt	c94c0789bb	Async loading of project list in project jump box ... * Adding special URL endpoint to get all visible projects at once (w/o paging - as in /projects/index.json) * Adding openProject JS object to carry useful information and helper methods for JS land * Adding helper method to User to get the number of visible projects w/o loading all of them * Reducing dependency to DOM structure of select2 - using API access instead * Close menu when select2 list is closed	12 years ago
Gregor Schmidt	ab968a52fc	Micro-optimization - no initialization when admin	12 years ago
Martin Linkhorst	b30fac4a59	refactor the welcome controller	12 years ago
Martin Linkhorst	05efc55174	mark user's login attribute as unsafe (like the test likes it)	12 years ago
Philipp Tessenow	84e2729b98	REVIEW: another batch of the renaming effort from Journals#changes to changed_data	12 years ago
Martin Linkhorst	5a93169800	ActiveSupport::SecureRandom was deprecated in favor of SecureRandom from the standard lib	12 years ago
Martin Linkhorst	6d1354dbd0	ActiveSupport::SecureRandom was deprecated in favor of SecureRandom from the standard lib	12 years ago
Martin Linkhorst	21fa39c25a	fix the user tests by storing user and his preferences in two steps	12 years ago
Martin Linkhorst	e6e421297e	yay, and active record bug, woohoo :) TODO: fix me on rails 3.2	12 years ago
Martin Linkhorst	d616d0574e	DEPRECATION FIX: use errors.add(:base, msg) instead of errors.add_to_base(:msg)	12 years ago
Martin Linkhorst	6c5239c4e2	DEPRECATION FIX: make a badly named GroupUser model to acts as the join model for a has_many :through between groups and users. ... this replaces a has_and_belongs_to_many association, that contained additional parameters like :after_add and :after_destroy. these additional parameters aren't supported for habtm beginning with rails 3.1.0	12 years ago
Martin Linkhorst	71fe49e862	DEPRECATION FIX: use validate :method_name instead of overwriting the validate method	12 years ago
Martin Linkhorst	b5a902c795	re-add the missing return values since they do matter	12 years ago
Martin Linkhorst	d05ec3be8f	DEPRECATION FIX: use validate :on => :create instead of overwriting the validate_on_create method	12 years ago
Martin Linkhorst	fe372af131	DEPRECATION FIX: use before_create :method_name instead of overwriting the before_create method	12 years ago
Martin Linkhorst	2ed585a297	converted account activation requested email	12 years ago
Romano Licker	e316e6df85	separate sequence-information of user formats ... from actual string concatenation in order to use it in an sql query	12 years ago
Martin Linkhorst	f75b531f1f	fix Role can't be blank error message on member_roles	12 years ago
Martin Linkhorst	ea0954bfa6	fixed a user test	12 years ago
Martin Linkhorst	b6aac286d4	take the root Query class rather than active records. also re-allow passing an order to acts_as_nested_set. all to make the tests happy	12 years ago
Jens Ulferts	3e633fc27e	renames all named_scopes to scopes ... * named_scopes are deprecated in rails 3	12 years ago
Martin Czuchra	27fa5c09b3	Externalizes user deletion limit on journals.	13 years ago
Jens Ulferts	7a95576591	dont't laod all journals at once upon user deletion ... * as all journals have to be considered and cleaned of the user_id user deletion might take a while * new journals could be added at that time which might be missed if all journals are loaded at once	13 years ago
Jens Ulferts	e65401764e	refactoring user #destroy ... * associations on the user/principal model that already define a dependent strategy are excluded from the method -> adding watcher association to do so * moving public query destroy behaviour into own method * renaming	13 years ago
Jens Ulferts	a05734c7d8	moving user destroy towards generic form	13 years ago
Jens Ulferts	2d7313abde	adding assigned_issues association to user so that assigned_issues are nullified on destroy	13 years ago
Jens Ulferts	325714de87	have assigned issues assigned to nobody instead of assigning it to the deleted user	13 years ago
Jens Ulferts	06898d0e74	having a builtin status which replaces the anonymous status ... * used by deleted user * should change db restrictions to not require status for builtin	13 years ago
Jens Ulferts	a02c3e5f32	i18n for deleted user	13 years ago
Jens Ulferts	5d6c5da9e7	removing User status ANONYMOUS ... * not used anywhere	13 years ago
Jens Ulferts	fa8261f2ba	added DeletedUser, models associated to a user get assigned to DeletedUser instance upon deletion ... * Only one DeletedUser allowed	13 years ago
Jens Ulferts	db32a45d54	Adding before destroy filter to user model that assigns associated objects to the anonymous user or deletes them ... * inspired by JPL's implementation for redmine #7296	13 years ago
Martin Linkhorst	34dbfb2c83	don't use mass assignment for login field, somebody added it to attr_protected	13 years ago
Martin Linkhorst	235fe06944	use safe attributes rather than mass assignment directly	13 years ago
jwollert	e0a2b9e768	fixes creation of anonymous user. shouldn't mass assign protected attributes (i.e. login)	13 years ago