mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-28 00:16:48 +09:00
Jeremy Daer
44a92ff6c6
Changing the password now ends every other session, so whoever holds one could shut the owner out of their own account with a new password. The profile asks for the current password whenever the password changes; without it, or with a wrong one, nothing is saved and the page says why. Other profile edits don't need it, and the admin reset-password script still works without it. Attempts are rate limited like signing in, 10 in 3 minutes per address, so the current password can't be guessed here instead.
22 lines
626 B
Ruby
22 lines
626 B
Ruby
require "test_helper"
|
|
|
|
class ResetPasswordScriptTest < ActiveSupport::TestCase
|
|
test "resets a password without the current one and signs out every session" do
|
|
assert_output "Password has been reset\n" do
|
|
run_script "david@37signals.com", "a new secret123456"
|
|
end
|
|
|
|
assert users(:david).reload.authenticate("a new secret123456")
|
|
assert_empty users(:david).sessions
|
|
end
|
|
|
|
private
|
|
def run_script(*arguments)
|
|
original_arguments = ARGV.dup
|
|
ARGV.replace(arguments)
|
|
load Rails.root.join("script/admin/reset-password").to_s
|
|
ensure
|
|
ARGV.replace(original_arguments)
|
|
end
|
|
end
|