Changeset 451

Timestamp:

08/25/06 03:07:49 (2 years ago)

Author:

snowblink

Message:

Ticket #213: Passwords cannot match the last n passwords

Files:

• login_engine/trunk/README (modified) (1 diff)
• login_engine/trunk/lib/login_engine.rb (modified) (1 diff)
• login_engine/trunk/lib/login_engine/authenticated_user.rb (modified) (2 diffs)
• login_engine/trunk/test/functional/user_controller_test.rb (modified) (1 diff)
• login_engine/trunk/test/unit/user_test.rb (modified) (1 diff)

login_engine/trunk/README

@@ -240 +240 @@
-+password_minimum+:: Set your minimum password length.
-                     Defaults to 5.
++password_expiry+:: Number of days until passwords expire.
+                    0 means never expire.
+                    Defaults to 0
++password_recyclable_after+:: Cannot reuse the last n passwords.
+                              Defaults to 0
-
-== Overriding controllers and views

login_engine/trunk/lib/login_engine.rb

@@ -61 +61 @@
-  # 0 means it will not expire
-  config :password_expiry, 0
+
+  # password cannot be one of the last n passwords
+  # specify here n
+  # 0 means there is no limit
+  config :password_recyclable_after, 0
-  
-  # controls whether or not email is used

login_engine/trunk/lib/login_engine/authenticated_user.rb

@@ -27 +27 @@
-        validates_length_of :password, { :maximum => 40, :if => :validate_password? }
-  
+        validates_each :password, {:if => :validate_password? } do |record, attr, value|
+          if LoginEngine.config(:password_recyclable_after) > 0 && record.passwords[0, LoginEngine.config(:password_recyclable_after)].any?{|p| p.salted_password == AuthenticatedUser.salted_password(p.salt, AuthenticatedUser.hashed(value)) }
+            record.errors.add attr, "You cannot reuse any of the last #{LoginEngine.config(:password_recyclable_after)} passwords"
+          end
+        end
+      
-        protected 
-      
@@ -56 +62 @@
-        u
-      end
-
+
-    end
-  

login_engine/trunk/test/functional/user_controller_test.rb

@@ -435 +435 @@
-  def test_forgot_password
-    LoginEngine::CONFIG[:use_email_notification] = true
+    LoginEngine::CONFIG[:password_recyclable_after] = 0
-
-    do_forgot_password(false, false, false)

login_engine/trunk/test/unit/user_test.rb

@@ -148 +148 @@
-    u.passwords.first.save
-    assert u.password_expired?, "Password should have expired"
-    
-    
-  end
+
+  def test_should_not_be_able_to_change_password_to_any_of_the_last_n_passwords
+    require 'pp'
+    LoginEngine::CONFIG[:password_recyclable_after] = 4
+
+    u = User.new
+    u.login = 'bob_changer'
+    u.email = 'bob_changer@email.com'
+    u.change_password('password')
+    assert u.save
+    u.reload
+
+    u.change_password('password')
+    assert !u.save, "Password saved even though it was not recyclable yet"
+
+    1.upto(10) do |i|
+      if i < LoginEngine::config(:password_recyclable_after)
+        u.change_password('password')
+        assert !u.save, "Password saved #{i} even though it was not recyclable yet"
+        assert_match /cannot reuse/, u.errors[:password]
+      else
+        u.change_password("password#{i}")
+        assert u.save, "Password not saved"
+      end
+    end
+
+
+
+  end
+
-end