meineerde/redmine
1
0
Fork 0
mirror of https://github.com/meineerde/redmine.git synced 2025-12-19 15:01:14 +00:00
Code Issues Releases Wiki Activity

Fix redirect loop when both enabling two-factor authentication and changing password are required (#1237, #34618).

Browse Source 
Patch by Go MAEDA.


git-svn-id: http://svn.redmine.org/redmine/trunk@20734 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Go MAEDA 2021-02-02 07:15:08 +00:00
parent 097e75987b
commit 75b6cacb5d
2 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/my_controller.rb
View File

@ -21,7 +21,7 @@ class MyController < ApplicationController
self.main_menu = false
before_action :require_login
# let user change user's password when user has to
skip_before_action :check_password_change, :only => :password
skip_before_action :check_password_change, :check_twofa_activation, :only => :password
accept_api_auth :account

13
test/integration/twofa_test.rb
View File

@ -30,6 +30,19 @@ class TwofaTest < Redmine::IntegrationTest
end
end
test 'should require to change password first when must_change_passwd is true' do
User.find_by(login: 'jsmith').update_attribute(:must_change_passwd, true)
with_settings twofa: '2' do
log_user('jsmith', 'jsmith')
follow_redirect!
assert_redirected_to '/my/password'
follow_redirect!
# Skip the before action check_twofa_activation for '/my/password'
# to avoid redirect loop
assert_response :success
end
end
test "should generate and accept backup codes" do
log_user('jsmith', 'jsmith')
get "/my/account"