From 3d5f7f207c81f9f7daef865b7d1896c918e1ac9f Mon Sep 17 00:00:00 2001
From: Jaime Iniesta <%= t("devise.password_expired.expire_password") %>
+
+<%= form_for(resource, :as => resource_name, :url => [resource_name, :password_expired], :html => { :method => :put }) do |f| %>
+ <%= devise_error_messages! %>
+
+ <%= f.password_field :current_password %>
<%= f.submit t("devise.password_expired.change_password") %>
+<% end %> \ No newline at end of file diff --git a/config/i18n-tasks.yml b/config/i18n-tasks.yml index 250ed18f9..9cf9f8137 100644 --- a/config/i18n-tasks.yml +++ b/config/i18n-tasks.yml @@ -101,6 +101,7 @@ ignore_missing: - 'errors.messages.taken' - 'devise.failure.invalid' - 'devise.registrations.destroyed' + - 'devise.password_expired.*' ## Consider these keys used: ignore_unused: diff --git a/config/initializers/devise_security_extension.rb b/config/initializers/devise_security_extension.rb new file mode 100644 index 000000000..83b88200e --- /dev/null +++ b/config/initializers/devise_security_extension.rb @@ -0,0 +1,127 @@ +Devise.setup do |config| + # ==> Security Extension + # Configure security extension for devise + + # Should the password expire (e.g 3.months) + # config.expire_password_after = false + config.expire_password_after = 1.year + + # Need 1 char of A-Z, a-z and 0-9 + # config.password_regex = /(?=.*\\d)(?=.*[a-z])(?=.*[A-Z])/ + + # How many passwords to keep in archive + # config.password_archiving_count = 5 + + # Deny old password (true, false, count) + # config.deny_old_passwords = true + + # enable email validation for :secure_validatable. (true, false, validation_options) + # dependency: need an email validator like rails_email_validator + # config.email_validation = true + + # captcha integration for recover form + # config.captcha_for_recover = true + + # captcha integration for sign up form + # config.captcha_for_sign_up = true + + # captcha integration for sign in form + # config.captcha_for_sign_in = true + + # captcha integration for unlock form + # config.captcha_for_unlock = true + + # captcha integration for confirmation form + # config.captcha_for_confirmation = true + + # Time period for account expiry from last_activity_at + # config.expire_after = 90.days +end + +module Devise + module Models + module PasswordExpirable + def need_change_password? + if self.administrator? + #is administrator + if self.expire_password_after.is_a? Fixnum or self.expire_password_after.is_a? Float + self.password_changed_at.nil? or self.password_changed_at < self.expire_password_after.ago + else + #not change password + false + end + else + #It is not an administrator + false + end + end + end + + module SecureValidatable + def self.included(base) + base.extend ClassMethods + assert_secure_validations_api!(base) + + base.class_eval do + # validate login in a strict way if not yet validated + unless devise_validation_enabled? + validates :email, :presence => true, :if => :email_required? + validates :email, :uniqueness => true, :allow_blank => true, :if => :email_changed? # check uniq for email ever + validates :password, :presence => true, :length => password_length, :confirmation => true, :if => :password_required? + end + + # extra validations + #validates :password, :format => { :with => password_regex, :message => :password_format }, :if => :password_required? + # don't allow use same password + validate :current_equal_password_validation + end + end + + def self.assert_secure_validations_api!(base) + raise "Could not use SecureValidatable on #{base}" unless base.respond_to?(:validates) + end + + def current_equal_password_validation + if !self.new_record? && !self.encrypted_password_change.nil? && !self.erased? + dummy = self.class.new + dummy.encrypted_password = self.encrypted_password_change.first + dummy.password_salt = self.password_salt_change.first if self.respond_to? :password_salt_change and not self.password_salt_change.nil? + self.errors.add(:password, :equal_to_current_password) if dummy.valid_password?(self.password) + end + end + + protected + + # Checks whether a password is needed or not. For validations only. + # Passwords are always required if it's a new record, or if the password + # or confirmation are being set somewhere. + def password_required? + !persisted? || !password.nil? || !password_confirmation.nil? + end + + def email_required? + true + end + + module ClassMethods + Devise::Models.config(self, :password_regex, :password_length, :email_validation) + + private + def has_uniqueness_validation_of_login? + validators.any? do |validator| + validator.kind_of?(ActiveRecord::Validations::UniquenessValidator) && + validator.attributes.include?(login_attribute) + end + end + + def login_attribute + authentication_keys[0] + end + + def devise_validation_enabled? + self.ancestors.map(&:to_s).include? 'Devise::Models::Validatable' + end + end + end + end +end \ No newline at end of file diff --git a/config/locales/activerecord.en.yml b/config/locales/activerecord.en.yml index 07791e53c..7de5b340e 100644 --- a/config/locales/activerecord.en.yml +++ b/config/locales/activerecord.en.yml @@ -54,6 +54,7 @@ en: username: "Username" password_confirmation: "Password confirmation" password: "Password" + current_password: "Current password" phone_number: "Phone number" official_position: "Official position" official_level: "Official level" diff --git a/config/locales/activerecord.es.yml b/config/locales/activerecord.es.yml index d5b7f0005..4dae4cb56 100644 --- a/config/locales/activerecord.es.yml +++ b/config/locales/activerecord.es.yml @@ -54,6 +54,7 @@ es: username: "Nombre de usuario" password_confirmation: "Confirmación de contraseña" password: "Contraseña" + current_password: "Contraseña actual" phone_number: "Teléfono" official_position: "Cargo público" official_level: "Nivel del cargo" diff --git a/config/locales/devise.en.yml b/config/locales/devise.en.yml index 30fb488ce..f031d62b5 100755 --- a/config/locales/devise.en.yml +++ b/config/locales/devise.en.yml @@ -2,6 +2,12 @@ en: devise: + password_expired: + expire_password: "Password expired" + change_required: "Your password has expired" + change_password: "Change your password" + new_password: "New password" + updated: "Password successfully updated" confirmations: confirmed: "Your account has been confirmed." send_instructions: "In a few minutes you will receive an email containing instructions on how to reset your password." @@ -62,3 +68,4 @@ en: not_saved: one: "1 error prevented this %{resource} from being saved:" other: "%{count} errors prevented this %{resource} from being saved:" + equal_to_current_password: "must be different than the current password." diff --git a/config/locales/devise.es.yml b/config/locales/devise.es.yml index 1a9c3a3b8..6ede31f7d 100644 --- a/config/locales/devise.es.yml +++ b/config/locales/devise.es.yml @@ -1,5 +1,11 @@ es: devise: + password_expired: + expire_password: "Contraseña caducada" + change_required: "Tu contraseña ha caducado" + change_password: "Cambia tu contraseña" + new_password: "Nueva contraseña" + updated: "Contraseña actualizada con éxito" confirmations: confirmed: "Tu cuenta ha sido confirmada. Por favor autentifícate con tu red social o tu usuario y contraseña" send_instructions: "Recibirás un correo electrónico en unos minutos con instrucciones sobre cómo restablecer tu contraseña." @@ -60,3 +66,4 @@ es: not_saved: one: "1 error impidió que este %{resource} fuera guardado:" other: "%{count} errores impidieron que este %{resource} fuera guardado:" + equal_to_current_password: "debe ser diferente a la contraseña actual" diff --git a/config/locales/devise.security_extension.de.yml b/config/locales/devise.security_extension.de.yml new file mode 100644 index 000000000..cad39d9b7 --- /dev/null +++ b/config/locales/devise.security_extension.de.yml @@ -0,0 +1,16 @@ +de: + errors: + messages: + taken_in_past: "wurde bereits in der Vergangenheit verwendet!" + equal_to_current_password: "darf nicht dem aktuellen Passwort entsprechen!" + password_format: "müssen große, kleine Buchstaben und Ziffern enthalten" + devise: + invalid_captcha: "Die Captchaeingabe ist nicht gültig!" + paranoid_verify: + code_required: "Bitte geben Sie den Code unser Support-Team zur Verfügung gestellt" + password_expired: + updated: "Das neue Passwort wurde übernommen." + change_required: "Ihr Passwort ist abgelaufen. Bitte vergeben sie ein neues Passwort!" + failure: + session_limited: 'Ihre Anmeldedaten wurden in einem anderen Browser genutzt. Bitte melden Sie sich erneut an, um in diesem Browser fortzufahren.' + expired: 'Ihr Account ist aufgrund zu langer Inaktiviät abgelaufen. Bitte kontaktieren Sie den Administrator.' diff --git a/config/locales/devise.security_extension.en.yml b/config/locales/devise.security_extension.en.yml new file mode 100644 index 000000000..e73d6e245 --- /dev/null +++ b/config/locales/devise.security_extension.en.yml @@ -0,0 +1,16 @@ +en: + errors: + messages: + taken_in_past: "was used previously." + equal_to_current_password: "must be different than the current password." + password_format: "must contain big, small letters and digits" + devise: + invalid_captcha: "The captcha input was invalid." + paranoid_verify: + code_required: "Please enter the code our support team provided" + password_expired: + updated: "Your new password is saved." + change_required: "Your password is expired. Please renew your password." + failure: + session_limited: 'Your login credentials were used in another browser. Please sign in again to continue in this browser.' + expired: 'Your account has expired due to inactivity. Please contact the site administrator.' diff --git a/config/locales/devise.security_extension.it.yml b/config/locales/devise.security_extension.it.yml new file mode 100644 index 000000000..646ae4ea0 --- /dev/null +++ b/config/locales/devise.security_extension.it.yml @@ -0,0 +1,10 @@ +it: + errors: + messages: + taken_in_past: "e' stata gia' utilizzata in passato!" + equal_to_current_password: " deve essere differente dalla password corrente!" + devise: + invalid_captcha: "Il captcha inserito non e' valido!" + password_expired: + updated: "La tua nuova password e' stata salvata." + change_required: "La tua password e' scaduta. Si prega di rinnovarla!" \ No newline at end of file diff --git a/db/migrate/20160901104320_add_password_expired.rb b/db/migrate/20160901104320_add_password_expired.rb new file mode 100644 index 000000000..aa759dd61 --- /dev/null +++ b/db/migrate/20160901104320_add_password_expired.rb @@ -0,0 +1,6 @@ +class AddPasswordExpired < ActiveRecord::Migration + def change + add_column :users, :password_changed_at, :datetime + add_index :users, :password_changed_at + end +end diff --git a/db/migrate/20160901104320_add_password_expired.rb~ b/db/migrate/20160901104320_add_password_expired.rb~ new file mode 100644 index 000000000..ac3a48f49 --- /dev/null +++ b/db/migrate/20160901104320_add_password_expired.rb~ @@ -0,0 +1,4 @@ +class AddPasswordExpired < ActiveRecord::Migration + def change + end +end diff --git a/db/schema.rb b/db/schema.rb index becde4f8a..339ce7675 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -11,7 +11,7 @@ # # It's strongly recommended that you check this file into your version control system. -ActiveRecord::Schema.define(version: 20160803154011) do +ActiveRecord::Schema.define(version: 20160901104320) do # These are extensions that must be enabled in order to support this database enable_extension "plpgsql" @@ -464,12 +464,14 @@ ActiveRecord::Schema.define(version: 20160803154011) do t.boolean "email_digest", default: true t.boolean "email_on_direct_message", default: true t.boolean "official_position_badge", default: false + t.datetime "password_changed_at" end add_index "users", ["confirmation_token"], name: "index_users_on_confirmation_token", unique: true, using: :btree add_index "users", ["email"], name: "index_users_on_email", unique: true, using: :btree add_index "users", ["geozone_id"], name: "index_users_on_geozone_id", using: :btree add_index "users", ["hidden_at"], name: "index_users_on_hidden_at", using: :btree + add_index "users", ["password_changed_at"], name: "index_users_on_password_changed_at", using: :btree add_index "users", ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true, using: :btree add_index "users", ["username"], name: "index_users_on_username", using: :btree diff --git a/spec/features/users_auth_spec.rb b/spec/features/users_auth_spec.rb index 9e1e67ef9..573e34a27 100644 --- a/spec/features/users_auth_spec.rb +++ b/spec/features/users_auth_spec.rb @@ -285,4 +285,41 @@ feature 'Users' do expect(page).to have_content "Your password has been changed successfully." end + + scenario 'Sign in, admin with password expired' do + user = create(:user, password_changed_at: Time.now - 1.year) + admin = create(:administrator, user: user) + + login_as(admin.user) + visit root_path + + expect(page).to have_content "Your password has expired" + + fill_in 'user_current_password', with: 'judgmentday' + fill_in 'user_password', with: '123456789' + fill_in 'user_password_confirmation', with: '123456789' + + click_button 'Change your password' + + expect(page).to have_content "Password successfully updated" + end + + scenario 'Sign in, admin without password expired' do + user = create(:user, password_changed_at: Time.now - 360.days) + admin = create(:administrator, user: user) + + login_as(admin.user) + visit root_path + + expect(page).to_not have_content "Your password has expired" + end + + scenario 'Sign in, user with password expired' do + user = create(:user, password_changed_at: Time.now - 1.year) + + login_as(user) + visit root_path + expect(page).to_not have_content "Your password has expired" + end + end From 48325589485207108aa5cc239da0b0b024fde32d Mon Sep 17 00:00:00 2001 From: Marcia<%= @direct_message.body %>
+<%= simple_format text_with_links(@direct_message.body), {}, sanitize: false %>
diff --git a/app/views/mailer/direct_message_for_receiver.html.erb b/app/views/mailer/direct_message_for_receiver.html.erb index 2523f3502..ac86b994a 100644 --- a/app/views/mailer/direct_message_for_receiver.html.erb +++ b/app/views/mailer/direct_message_for_receiver.html.erb @@ -3,9 +3,9 @@ <%= @direct_message.title %> -- <%= @direct_message.body %> -
+