Merge branch 'feature/password_expire' of /home/git/repositories/gitlab/gitlabhq

Dmitriy Zaporozhets
2 parents cfd15eb4 6838304a
Showing 15 changed files with 199 additions and 79 deletions Show diff stats
app/controllers/admin/users_controller.rb
app/controllers/application_controller.rb
app/controllers/passwords_controller.rb
app/models/user.rb
app/views/admin/users/_form.html.haml
app/views/admin/users/show.html.haml
app/views/notify/new_user_email.html.haml
app/views/notify/new_user_email.text.erb
app/views/passwords/new.html.haml
config/routes.rb
db/fixtures/production/001_admin.rb
db/migrate/20130613165816_add_password_expires_at_to_users.rb
db/migrate/20130613173246_add_created_by_id_to_user.rb
db/schema.rb
spec/features/admin/admin_users_spec.rb
@@ -55,8 +55,14 @@ class Admin::UsersController &lt; Admin::ApplicationController
   def create
     admin = params[:user].delete("admin")
-    @admin_user = User.new(params[:user], as: :admin)
+    opts = {
+      force_random_password: true,
+      password_expires_at: Time.now
+    }
+
+    @admin_user = User.new(params[:user].merge(opts), as: :admin)
     @admin_user.admin = (admin && admin.to_i > 0)
+    @admin_user.created_by_id = current_user.id
     respond_to do |format|
       if @admin_user.save
 class ApplicationController < ActionController::Base
   before_filter :authenticate_user!
   before_filter :reject_blocked!
+  before_filter :check_password_expiration
   before_filter :set_current_user_for_thread
   before_filter :add_abilities
   before_filter :dev_tools if Rails.env == 'development'
@@ -156,4 +157,10 @@ class ApplicationController &lt; ActionController::Base
     gon.gravatar_url = request.ssl? || Gitlab.config.gitlab.https ? Gitlab.config.gravatar.ssl_url : Gitlab.config.gravatar.plain_url
     gon.relative_url_root = Gitlab.config.gitlab.relative_url_root
   end
+
+  def check_password_expiration
+    if current_user && current_user.password_expires_at && current_user.password_expires_at < Time.now
+      redirect_to new_profile_password_path and return
+    end
+  end
 end
@@ -0,0 +1,38 @@
+class PasswordsController < ApplicationController
+  layout 'navless'
+
+  skip_before_filter :check_password_expiration
+
+  before_filter :set_user
+  before_filter :set_title
+
+  def new
+  end
+
+  def create
+    new_password = params[:user][:password]
+    new_password_confirmation = params[:user][:password_confirmation]
+
+    result = @user.update_attributes(
+      password: new_password,
+      password_confirmation: new_password_confirmation
+    )
+
+    if result
+      @user.update_attributes(password_expires_at: nil)
+      redirect_to root_path, notice: 'Password successfully changed'
+    else
+      render :new
+    end
+  end
+
+  private
+
+  def set_user
+    @user = current_user
+  end
+
+  def set_title
+    @title = "New password"
+  end
+end
@@ -42,8 +42,11 @@ class User &lt; ActiveRecord::Base
   attr_accessible :email, :password, :password_confirmation, :remember_me, :bio, :name, :username,
                   :skype, :linkedin, :twitter, :color_scheme_id, :theme_id, :force_random_password,
-                  :extern_uid, :provider, as: [:default, :admin]
-  attr_accessible :projects_limit, :can_create_team, :can_create_group, as: :admin
+                  :extern_uid, :provider, :password_expires_at,
+                  as: [:default, :admin]
+
+  attr_accessible :projects_limit, :can_create_team, :can_create_group,
+                  as: :admin
   attr_accessor :force_random_password
@@ -364,4 +367,8 @@ class User &lt; ActiveRecord::Base
   def accessible_deploy_keys
     DeployKey.in_projects(self.master_projects).uniq
   end
+
+  def created_by
+    User.find_by_id(created_by_id) if created_by_id
+  end
 end
@@ -24,19 +24,25 @@
           = f.text_field :email, required: true, autocomplete: "off"
           %span.help-inline * required
-    %fieldset
-      %legend Password
-      .clearfix
-        = f.label :password
-        .input= f.password_field :password, disabled: f.object.force_random_password
-      .clearfix
-        = f.label :password_confirmation
-        .input= f.password_field :password_confirmation, disabled: f.object.force_random_password
-      -if f.object.new_record?
+    - if @admin_user.new_record?
+      %fieldset
+        %legend Password
+        .clearfix
+          = f.label :password
+          .input
+            %strong
+              A temporary password will be generated and sent to user.
+              %br
+              User will be forced to change it after first sign in
+    - else
+      %fieldset
+        %legend Password
+        .clearfix
+          = f.label :password
+          .input= f.password_field :password, disabled: f.object.force_random_password
         .clearfix
-          = f.label :force_random_password do
-            %span Generate random password
-          .input= f.check_box :force_random_password, {}, true, nil
+          = f.label :password_confirmation
+          .input= f.password_field :password_confirmation, disabled: f.object.force_random_password
     %fieldset
       %legend Access
+%h3.page_title
+  User:
+  = @admin_user.name
+  - if @admin_user.blocked?
+    %span.cred (Blocked)
+  - if @admin_user.admin
+    %span.cred (Admin)
+
+  .pull-right
+    = link_to edit_admin_user_path(@admin_user), class: "btn grouped btn-small" do
+      %i.icon-edit
+      Edit
+    - unless @admin_user == current_user
+      - if @admin_user.blocked?
+        = link_to 'Unblock', unblock_admin_user_path(@admin_user), method: :put, class: "btn grouped btn-small success"
+      - else
+        = link_to 'Block', block_admin_user_path(@admin_user), confirm: 'USER WILL BE BLOCKED! Are you sure?', method: :put, class: "btn grouped btn-small btn-remove"
+      = link_to 'Destroy', [:admin, @admin_user], confirm: "USER #{@admin_user.name} WILL BE REMOVED! Are you sure?", method: :delete, class: "btn grouped btn-small btn-remove"
+%hr
+
 .row
   .span6
-    %h3.page_title
-      = image_tag gravatar_icon(@admin_user.email, 90), class: "avatar s90"
-      = @admin_user.name
-      - if @admin_user.blocked?
-        %span.cred (Blocked)
-      - if @admin_user.admin
-        %span.cred (Admin)
-      .pull-right
-        = link_to edit_admin_user_path(@admin_user), class: "btn pull-right" do
-          %i.icon-edit
-          Edit
-      %br
-      %small @#{@admin_user.username}
-      %br
-      %small member since #{@admin_user.created_at.stamp("Nov 12, 2031")}
-    .clearfix
-    %hr
-    %p
-      %span.btn.btn-small
-        %i.icon-envelope
-        = mail_to @admin_user.email
-      - unless @admin_user == current_user
-        - if @admin_user.blocked?
-          = link_to 'Unblock', unblock_admin_user_path(@admin_user), method: :put, class: "btn btn-small success"
-        - else
-          = link_to 'Block', block_admin_user_path(@admin_user), confirm: 'USER WILL BE BLOCKED! Are you sure?', method: :put, class: "btn btn-small btn-remove"
-        = link_to 'Destroy', [:admin, @admin_user], confirm: "USER #{@admin_user.name} WILL BE REMOVED! Are you sure?", method: :delete, class: "btn btn-small btn-remove"
+    .ui-box
+      %h5.title
+        Account:
+        .pull-right
+          = image_tag gravatar_icon(@admin_user.email, 32), class: "avatar s32"
+      %ul.well-list
+        %li
+          %span.light Name:
+          %strong= @admin_user.name
+        %li
+          %span.light Username:
+          %strong
+            = @admin_user.username
+        %li
+          %span.light Email:
+          %strong
+            = mail_to @admin_user.email
+
+        %li
+          %span.light Member since:
+          %strong
+            = @admin_user.created_at.stamp("Nov 12, 2031")
+
+        %li
+          %span.light Last sign-in at:
+          %strong
+            = @admin_user.last_sign_in_at.stamp("Nov 12, 2031")
+
+        - if @admin_user.ldap_user?
+          %li
+            %span.light LDAP uid:
+            %strong
+              = @admin_user.extern_uid
+
+        - if @admin_user.created_by
+          %li
+            %span.light Created by:
+            %strong
+              = link_to @admin_user.created_by.name, [:admin, @admin_user.created_by]
+
     %hr
     %h5
       Add User to Projects
@@ -67,11 +100,11 @@
   .span6
-    = render 'users/profile', user: @admin_user
     .ui-box
       %h5.title Projects (#{@projects.count})
       %ul.well-list
         - @projects.sort_by(&:name_with_namespace).each do |project|
+          - tm = project.team.get_tm(@admin_user.id)
           %li
             = link_to admin_project_path(project), class: dom_class(project) do
               - if project.namespace
@@ -79,16 +112,17 @@
                 \/
               %strong.well-title
                 = truncate(project.name, length: 45)
-            %span.pull-right.light
-              - if project.owner == @admin_user
-                %i.icon-wrench
-              - tm = project.team.get_tm(@admin_user.id)
-              - if tm
-                = tm.project_access_human
-                = link_to edit_admin_project_member_path(project, tm.user), class: "btn btn-small" do
+
+            - if project.owner == @admin_user
+              %span.label.label-info owner
+
+            - if tm
+              .pull-right
+                = link_to edit_admin_project_member_path(project, tm.user), class: "btn grouped btn-small" do
                   %i.icon-edit
-                = link_to admin_project_member_path(project, tm.user), confirm: remove_from_project_team_message(project, @admin_user), method: :delete, class: "btn btn-small btn-remove" do
+                = link_to admin_project_member_path(project, tm.user), confirm: remove_from_project_team_message(project, @admin_user), method: :delete, class: "btn grouped btn-small btn-remove" do
                   %i.icon-remove
-    %p.light
-      %i.icon-wrench
-      &ndash; user is a project owner
+
+              .pull-right.light
+                = tm.project_access_human
+                &nbsp;
@@ -8,13 +8,14 @@
 %p
   login..........................................
   %code= @user['email']
-%p
-  - unless Gitlab.config.gitlab.signup_enabled
+
+- if @user.created_by_id
+  %p
     password..................................
     %code= @password
-%p
-  Please change your password immediately after login.
+  %p
+    You will be forced to change this password immediately after login.
 %p
   = link_to "Click here to login", root_url
@@ -3,10 +3,11 @@ Hi &lt;%= @user.name %&gt;!
 The Administrator created an account for you. Now you are a member of company GitLab application.
 login.................. <%= @user.email %>
-<% unless Gitlab.config.gitlab.signup_enabled %>
+<% if @user.created_by_id %>
   password............... <%= @password %>
+  
+  You will be forced to change this password immediately after login.
 <% end %>
-Please change your password immediately after login.
 Click here to login: <%= url_for(root_url) %>
@@ -0,0 +1,22 @@
+= form_for @user, url: profile_password_path, method: :post do |f|
+  .light-well.padded
+    %p.slead
+      Please set new password before proceed.
+      %br
+      After successful password update you will be redirected to login screen
+    -if @user.errors.any?
+      .alert.alert-error
+        %ul
+          - @user.errors.full_messages.each do |msg|
+            %li= msg
+
+    .clearfix
+      = f.label :password
+      .input= f.password_field :password, required: true
+    .clearfix
+      = f.label :password_confirmation
+      .input
+        = f.password_field :password_confirmation, required: true
+    .clearfix
+      .input
+        = f.submit 'Set new password', class: "btn btn-create"
@@ -123,6 +123,7 @@ Gitlab::Application.routes.draw do
     end
     resource :notifications
+    resource :password
   end
   resources :keys
@@ -3,7 +3,8 @@ admin = User.create(
   name: "Administrator",
   username: 'root',
   password: "5iveL!fe",
-  password_confirmation: "5iveL!fe"
+  password_confirmation: "5iveL!fe",
+  password_expires_at: Time.now
 )
 admin.projects_limit = 10000
@@ -0,0 +1,5 @@
+class AddPasswordExpiresAtToUsers < ActiveRecord::Migration
+  def change
+    add_column :users, :password_expires_at, :datetime
+  end
+end
@@ -0,0 +1,5 @@
+class AddCreatedByIdToUser < ActiveRecord::Migration
+  def change
+    add_column :users, :created_by_id, :integer
+  end
+end
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended to check this file into your version control system.
-ActiveRecord::Schema.define(:version => 20130522141856) do
+ActiveRecord::Schema.define(:version => 20130613173246) do
   create_table "deploy_keys_projects", :force => true do |t|
     t.integer  "deploy_key_id", :null => false
@@ -292,6 +292,8 @@ ActiveRecord::Schema.define(:version =&gt; 20130522141856) do
     t.string   "state"
     t.integer  "color_scheme_id",        :default => 1,     :null => false
     t.integer  "notification_level",     :default => 1,     :null => false
+    t.datetime "password_expires_at"
+    t.integer  "created_by_id"
   end
   add_index "users", ["admin"], :name => "index_users_on_admin"
@@ -20,13 +20,10 @@ describe &quot;Admin::Users&quot; do
   describe "GET /admin/users/new" do
     before do
-      @password = "123ABC"
       visit new_admin_user_path
       fill_in "user_name", with: "Big Bang"
       fill_in "user_username", with: "bang"
       fill_in "user_email", with: "bigbang@mail.com"
-      fill_in "user_password", with: @password
-      fill_in "user_password_confirmation", with: @password
     end
     it "should create new user" do
@@ -57,26 +54,13 @@ describe &quot;Admin::Users&quot; do
     end
     it "should send valid email to user with email & password" do
-      Gitlab.config.gitlab.stub(:signup_enabled).and_return(false)
       User.observers.enable :user_observer do
         click_button "Create user"
         user = User.last
         email = ActionMailer::Base.deliveries.last
         email.subject.should have_content("Account was created")
         email.text_part.body.should have_content(user.email)
-        email.text_part.body.should have_content(@password)
-      end
-    end
-
-    it "should send valid email to user with email without password when signup is enabled" do
-      Gitlab.config.gitlab.stub(:signup_enabled).and_return(true)
-      User.observers.enable :user_observer do
-        click_button "Create user"
-        user = User.last
-        email = ActionMailer::Base.deliveries.last
-        email.subject.should have_content("Account was created")
-        email.text_part.body.should have_content(user.email)
-        email.text_part.body.should_not have_content(@password)
+        email.text_part.body.should have_content('password')
       end
     end
   end
@@ -0,0 +1,38 @@		@@ -0,0 +1,38 @@
	1	+class PasswordsController < ApplicationController
	2	+ layout 'navless'
	3	+
	4	+ skip_before_filter :check_password_expiration
	5	+
	6	+ before_filter :set_user
	7	+ before_filter :set_title
	8	+
	9	+ def new
	10	+ end
	11	+
	12	+ def create
	13	+ new_password = params[:user][:password]
	14	+ new_password_confirmation = params[:user][:password_confirmation]
	15	+
	16	+ result = @user.update_attributes(
	17	+ password: new_password,
	18	+ password_confirmation: new_password_confirmation
	19	+ )
	20	+
	21	+ if result
	22	+ @user.update_attributes(password_expires_at: nil)
	23	+ redirect_to root_path, notice: 'Password successfully changed'
	24	+ else
	25	+ render :new
	26	+ end
	27	+ end
	28	+
	29	+ private
	30	+
	31	+ def set_user
	32	+ @user = current_user
	33	+ end
	34	+
	35	+ def set_title
	36	+ @title = "New password"
	37	+ end
	38	+end
		1	+%h3.page_title
		2	+ User:
		3	+ = @admin_user.name
		4	+ - if @admin_user.blocked?
		5	+ %span.cred (Blocked)
		6	+ - if @admin_user.admin
		7	+ %span.cred (Admin)
		8	+
		9	+ .pull-right
		10	+ = link_to edit_admin_user_path(@admin_user), class: "btn grouped btn-small" do
		11	+ %i.icon-edit
		12	+ Edit
		13	+ - unless @admin_user == current_user
		14	+ - if @admin_user.blocked?
		15	+ = link_to 'Unblock', unblock_admin_user_path(@admin_user), method: :put, class: "btn grouped btn-small success"
		16	+ - else
		17	+ = link_to 'Block', block_admin_user_path(@admin_user), confirm: 'USER WILL BE BLOCKED! Are you sure?', method: :put, class: "btn grouped btn-small btn-remove"
		18	+ = link_to 'Destroy', [:admin, @admin_user], confirm: "USER #{@admin_user.name} WILL BE REMOVED! Are you sure?", method: :delete, class: "btn grouped btn-small btn-remove"
		19	+%hr
		20	+
1	.row	21	.row
2	.span6	22	.span6
3	- %h3.page_title
4	- = image_tag gravatar_icon(@admin_user.email, 90), class: "avatar s90"
5	- = @admin_user.name
6	- - if @admin_user.blocked?
7	- %span.cred (Blocked)
8	- - if @admin_user.admin
9	- %span.cred (Admin)
10	- .pull-right
11	- = link_to edit_admin_user_path(@admin_user), class: "btn pull-right" do
12	- %i.icon-edit
13	- Edit
14	- %br
15	- %small @#{@admin_user.username}
16	- %br
17	- %small member since #{@admin_user.created_at.stamp("Nov 12, 2031")}
18	- .clearfix
19	- %hr
20	- %p
21	- %span.btn.btn-small
22	- %i.icon-envelope
23	- = mail_to @admin_user.email
24	- - unless @admin_user == current_user
25	- - if @admin_user.blocked?
26	- = link_to 'Unblock', unblock_admin_user_path(@admin_user), method: :put, class: "btn btn-small success"
27	- - else
28	- = link_to 'Block', block_admin_user_path(@admin_user), confirm: 'USER WILL BE BLOCKED! Are you sure?', method: :put, class: "btn btn-small btn-remove"
29	- = link_to 'Destroy', [:admin, @admin_user], confirm: "USER #{@admin_user.name} WILL BE REMOVED! Are you sure?", method: :delete, class: "btn btn-small btn-remove"	23	+ .ui-box
		24	+ %h5.title
		25	+ Account:
		26	+ .pull-right
		27	+ = image_tag gravatar_icon(@admin_user.email, 32), class: "avatar s32"
		28	+ %ul.well-list
		29	+ %li
		30	+ %span.light Name:
		31	+ %strong= @admin_user.name
		32	+ %li
		33	+ %span.light Username:
		34	+ %strong
		35	+ = @admin_user.username
		36	+ %li
		37	+ %span.light Email:
		38	+ %strong
		39	+ = mail_to @admin_user.email
		40	+
		41	+ %li
		42	+ %span.light Member since:
		43	+ %strong
		44	+ = @admin_user.created_at.stamp("Nov 12, 2031")
		45	+
		46	+ %li
		47	+ %span.light Last sign-in at:
		48	+ %strong
		49	+ = @admin_user.last_sign_in_at.stamp("Nov 12, 2031")
		50	+
		51	+ - if @admin_user.ldap_user?
		52	+ %li
		53	+ %span.light LDAP uid:
		54	+ %strong
		55	+ = @admin_user.extern_uid
		56	+
		57	+ - if @admin_user.created_by
		58	+ %li
		59	+ %span.light Created by:
		60	+ %strong
		61	+ = link_to @admin_user.created_by.name, [:admin, @admin_user.created_by]
		62	+
30	%hr	63	%hr
31	%h5	64	%h5
32	Add User to Projects	65	Add User to Projects
	@@ -67,11 +100,11 @@		@@ -67,11 +100,11 @@
67		100
68		101
69	.span6	102	.span6
70	- = render 'users/profile', user: @admin_user
71	.ui-box	103	.ui-box
72	%h5.title Projects (#{@projects.count})	104	%h5.title Projects (#{@projects.count})
73	%ul.well-list	105	%ul.well-list
74	- @projects.sort_by(&:name_with_namespace).each do \|project\|	106	- @projects.sort_by(&:name_with_namespace).each do \|project\|
		107	+ - tm = project.team.get_tm(@admin_user.id)
75	%li	108	%li
76	= link_to admin_project_path(project), class: dom_class(project) do	109	= link_to admin_project_path(project), class: dom_class(project) do
77	- if project.namespace	110	- if project.namespace
	@@ -79,16 +112,17 @@		@@ -79,16 +112,17 @@
79	\/	112	\/
80	%strong.well-title	113	%strong.well-title
81	= truncate(project.name, length: 45)	114	= truncate(project.name, length: 45)
82	- %span.pull-right.light
83	- - if project.owner == @admin_user
84	- %i.icon-wrench
85	- - tm = project.team.get_tm(@admin_user.id)
86	- - if tm
87	- = tm.project_access_human
88	- = link_to edit_admin_project_member_path(project, tm.user), class: "btn btn-small" do	115	+
		116	+ - if project.owner == @admin_user
		117	+ %span.label.label-info owner
		118	+
		119	+ - if tm
		120	+ .pull-right
		121	+ = link_to edit_admin_project_member_path(project, tm.user), class: "btn grouped btn-small" do
89	%i.icon-edit	122	%i.icon-edit
90	- = link_to admin_project_member_path(project, tm.user), confirm: remove_from_project_team_message(project, @admin_user), method: :delete, class: "btn btn-small btn-remove" do	123	+ = link_to admin_project_member_path(project, tm.user), confirm: remove_from_project_team_message(project, @admin_user), method: :delete, class: "btn grouped btn-small btn-remove" do
91	%i.icon-remove	124	%i.icon-remove
92	- %p.light
93	- %i.icon-wrench
94	- – user is a project owner	125	+
		126	+ .pull-right.light
		127	+ = tm.project_access_human
		128	+
@@ -0,0 +1,22 @@		@@ -0,0 +1,22 @@
	1	+= form_for @user, url: profile_password_path, method: :post do \|f\|
	2	+ .light-well.padded
	3	+ %p.slead
	4	+ Please set new password before proceed.
	5	+ %br
	6	+ After successful password update you will be redirected to login screen
	7	+ -if @user.errors.any?
	8	+ .alert.alert-error
	9	+ %ul
	10	+ - @user.errors.full_messages.each do \|msg\|
	11	+ %li= msg
	12	+
	13	+ .clearfix
	14	+ = f.label :password
	15	+ .input= f.password_field :password, required: true
	16	+ .clearfix
	17	+ = f.label :password_confirmation
	18	+ .input
	19	+ = f.password_field :password_confirmation, required: true
	20	+ .clearfix
	21	+ .input
	22	+ = f.submit 'Set new password', class: "btn btn-create"
	@@ -123,6 +123,7 @@ Gitlab::Application.routes.draw do		@@ -123,6 +123,7 @@ Gitlab::Application.routes.draw do
123	end	123	end
124		124
125	resource :notifications	125	resource :notifications
		126	+ resource :password
126	end	127	end
127		128
128	resources :keys	129	resources :keys
@@ -0,0 +1,5 @@		@@ -0,0 +1,5 @@
	1	+class AddPasswordExpiresAtToUsers < ActiveRecord::Migration
	2	+ def change
	3	+ add_column :users, :password_expires_at, :datetime
	4	+ end
	5	+end
@@ -0,0 +1,5 @@		@@ -0,0 +1,5 @@
	1	+class AddCreatedByIdToUser < ActiveRecord::Migration
	2	+ def change
	3	+ add_column :users, :created_by_id, :integer
	4	+ end
	5	+end