2014-03-18 11:25:49 +00:00
|
|
|
class PasswordsController < Devise::PasswordsController
|
2017-12-31 05:08:15 +00:00
|
|
|
skip_before_action :require_no_authentication, only: [:edit, :update]
|
|
|
|
|
2015-10-02 01:47:27 +00:00
|
|
|
before_action :resource_from_email, only: [:create]
|
2017-11-23 13:16:14 +00:00
|
|
|
before_action :check_password_authentication_available, only: [:create]
|
2015-10-02 01:47:27 +00:00
|
|
|
before_action :throttle_reset, only: [:create]
|
2015-05-11 18:31:31 +00:00
|
|
|
|
2015-05-14 02:29:15 +00:00
|
|
|
def edit
|
|
|
|
super
|
|
|
|
reset_password_token = Devise.token_generator.digest(
|
|
|
|
User,
|
|
|
|
:reset_password_token,
|
|
|
|
resource.reset_password_token
|
|
|
|
)
|
|
|
|
|
|
|
|
unless reset_password_token.nil?
|
|
|
|
user = User.where(
|
|
|
|
reset_password_token: reset_password_token
|
|
|
|
).first_or_initialize
|
|
|
|
|
|
|
|
unless user.reset_password_period_valid?
|
|
|
|
flash[:alert] = 'Your password reset token has expired.'
|
2015-05-14 03:57:16 +00:00
|
|
|
redirect_to(new_user_password_url(user_email: user['email']))
|
2015-05-14 02:29:15 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2015-09-30 19:38:21 +00:00
|
|
|
|
2016-03-02 22:48:49 +00:00
|
|
|
def update
|
|
|
|
super do |resource|
|
2017-11-23 13:16:14 +00:00
|
|
|
if resource.valid? && resource.password_automatically_set?
|
2016-03-02 22:48:49 +00:00
|
|
|
resource.update_attribute(:password_automatically_set, false)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-10-02 01:47:27 +00:00
|
|
|
protected
|
|
|
|
|
|
|
|
def resource_from_email
|
|
|
|
email = resource_params[:email]
|
|
|
|
self.resource = resource_class.find_by_email(email)
|
|
|
|
end
|
|
|
|
|
2017-11-23 13:16:14 +00:00
|
|
|
def check_password_authentication_available
|
|
|
|
if resource
|
|
|
|
return if resource.allow_password_authentication?
|
|
|
|
else
|
2018-02-02 18:39:55 +00:00
|
|
|
return if Gitlab::CurrentSettings.password_authentication_enabled?
|
2017-11-23 13:16:14 +00:00
|
|
|
end
|
2015-10-02 01:47:27 +00:00
|
|
|
|
|
|
|
redirect_to after_sending_reset_password_instructions_path_for(resource_name),
|
2017-11-23 13:16:14 +00:00
|
|
|
alert: "Password authentication is unavailable."
|
2015-10-02 01:47:27 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_reset
|
|
|
|
return unless resource && resource.recently_sent_password_reset?
|
2015-09-30 19:38:21 +00:00
|
|
|
|
2015-12-09 17:45:26 +00:00
|
|
|
# Throttle reset attempts, but return a normal message to
|
|
|
|
# avoid user enumeration attack.
|
|
|
|
redirect_to new_user_session_path,
|
|
|
|
notice: I18n.t('devise.passwords.send_paranoid_instructions')
|
2015-09-30 19:38:21 +00:00
|
|
|
end
|
2014-03-18 11:25:49 +00:00
|
|
|
end
|