5 Commits

Include renames

Author	SHA1	Message	Date
Robert Speicher	a602df3031	Pass the "Remember me" value to the 2FA token form ... Prior, if a user had 2FA enabled and checked the "Remember me" field, the setting was ignored because the OTP input was on a new form and the value was never passed. Closes #18000	2016-05-30 22:25:35 -04:00
Robert Speicher	75739e54be	Enable RSpec/NotToNot cop and auto-correct offenses ... Also removes the note from the development/testing.md guide	2016-05-24 15:40:29 -04:00
Grzegorz Bizon	33a8dfd04f	Make sessions controller specs more explicit	2016-04-07 13:16:48 +02:00
Grzegorz Bizon	00da609cfd	Fix 2FA authentication spoofing vulnerability ... This commit attempts to change default user search scope if otp_user_id session variable has been set. If it is present, it means that user has 2FA enabled, and has already been verified with login and password. In this case we should look for user with otp_user_id first, before picking it up by login.	2016-04-07 11:19:29 +02:00
Grzegorz Bizon	301f4074aa	Add specs for sessions controller including 2FA ... This also contains specs for a bug described in #14900	2016-04-06 12:26:10 +02:00