Fix 2FA-based login for LDAP users
The OTP input form is shared by both LDAP and standard logins, but when
coming from an LDAP-based form, the form parameters aren't nested in a
Hash based on the `resource_name` value.
Now we check for a nested `remember_me` parameter and use that if it
exists, or fall back to the non-nested parameters if it doesn't.
Somewhat confusingly, the OTP input form _does_ nest parameters under
the `resource_name`, regardless of what type of login we're coming from,
so that allows everything else to work as normal.
Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/18185
See merge request !4493
Allow custom text on 'almost there' page
Add a new application setting, after_sign_up_text. This is text to be
rendered as Markdown and shown on the 'almost there' page after a user
signs up, but before they've confirmed their account.
Closes#14098.
See merge request !4098
Added minimum password length to password field
Add a placeholder to the password field in the register form with the minimum number of characters required. Also added a pattern to the field to stop it submitting if less than that.
Closes#17765
See merge request !4458
Add a new application setting, after_sign_up_text. This is text to be
rendered as Markdown and shown on the 'almost there' page after a user
signs up, but before they've confirmed their account.
Tweak the styles for that page so that centered lists look reasonable.
The OTP input form is shared by both LDAP and standard logins, but when
coming from an LDAP-based form, the form parameters aren't nested in a
Hash based on the `resource_name` value.
Now we check for a nested `remember_me` parameter and use that if it
exists, or fall back to the non-nested parameters if it doesn't.
Somewhat confusingly, the OTP input form _does_ nest parameters under
the `resource_name`, regardless of what type of login we're coming from,
so that allows everything else to work as normal.
Prior, if a user had 2FA enabled and checked the "Remember me" field,
the setting was ignored because the OTP input was on a new form and the
value was never passed.
Closes#18000
- Previously, we were pulling `params[:user][:password] as the default
value for the password field. This is incorrect; we should be pulling
it from `@user.password` or the like.
We were doing all kinds of code gymnastics to "enable" Crowd in the
feature spec and this would sometimes cause a transient failure.
Really what it's testing is if the Crowd login form shows when Crowd's
enabled, so this is much better suited to a view spec.
Robert Speicher
Robert Speicher
Sean McGivern
Timothy Andrew
Phil Hughes
Connor Shea
Andrei Gliga
Douwe Maan
Arinde Eniola
Peter HudecandRémy Coutable
Dmitriy Zaporozhets
Gabriel Mazetto
Stan Hu
Drew Blessing
Christian Speich
Valery Sizov
Daryl Chan
Vinnie Okada
Dmitriy Zaporozhets