debian-mirror-gitlab/app/controllers/passwords_controller.rb

73 lines
2 KiB
Ruby
Raw Normal View History

2018-12-05 23:21:45 +05:30
# frozen_string_literal: true
2014-09-02 18:07:02 +05:30
class PasswordsController < Devise::PasswordsController
2018-03-17 18:26:18 +05:30
skip_before_action :require_no_authentication, only: [:edit, :update]
2015-10-24 18:46:33 +05:30
before_action :resource_from_email, only: [:create]
2018-03-17 18:26:18 +05:30
before_action :check_password_authentication_available, only: [:create]
2019-03-02 22:35:43 +05:30
before_action :throttle_reset, only: [:create]
2015-09-11 14:41:01 +05:30
2021-01-03 14:25:43 +05:30
feature_category :authentication_and_authorization
2018-12-05 23:21:45 +05:30
# rubocop: disable CodeReuse/ActiveRecord
2015-09-11 14:41:01 +05:30
def edit
super
reset_password_token = Devise.token_generator.digest(
User,
:reset_password_token,
resource.reset_password_token
)
unless reset_password_token.nil?
user = User.where(
reset_password_token: reset_password_token
).first_or_initialize
unless user.reset_password_period_valid?
2019-07-31 22:56:46 +05:30
flash[:alert] = _('Your password reset token has expired.')
2015-09-11 14:41:01 +05:30
redirect_to(new_user_password_url(user_email: user['email']))
end
end
end
2018-12-05 23:21:45 +05:30
# rubocop: enable CodeReuse/ActiveRecord
2015-10-24 18:46:33 +05:30
2016-06-02 11:05:42 +05:30
def update
super do |resource|
2020-11-24 15:15:51 +05:30
if resource.valid?
resource.password_automatically_set = false
resource.password_expires_at = nil
resource.save(validate: false) if resource.changed?
2016-06-02 11:05:42 +05:30
end
end
end
2015-10-24 18:46:33 +05:30
protected
def resource_from_email
email = resource_params[:email]
self.resource = resource_class.find_by_email(email)
end
2018-03-17 18:26:18 +05:30
def check_password_authentication_available
if resource
return if resource.allow_password_authentication?
else
return if Gitlab::CurrentSettings.password_authentication_enabled?
end
2015-10-24 18:46:33 +05:30
redirect_to after_sending_reset_password_instructions_path_for(resource_name),
2019-07-31 22:56:46 +05:30
alert: _("Password authentication is unavailable.")
2015-10-24 18:46:33 +05:30
end
def throttle_reset
return unless resource && resource.recently_sent_password_reset?
2015-12-23 02:04:40 +05:30
# Throttle reset attempts, but return a normal message to
# avoid user enumeration attack.
redirect_to new_user_session_path,
notice: I18n.t('devise.passwords.send_paranoid_instructions')
2015-10-24 18:46:33 +05:30
end
2014-09-02 18:07:02 +05:30
end
2019-12-04 20:38:33 +05:30
2021-06-08 01:23:25 +05:30
PasswordsController.prepend_mod_with('PasswordsController')