mirror of
https://github.com/wahyd4/gitlabhq.git
synced 2026-08-12 06:06:05 +10:00
Robert SpeicherandRobert Speicher
0c0854c86a
Enable Devise paranoid mode and ensure the returned message is the same every time. This will prevent user enumeration (low impact). Prior to this change a user could type an email in the password reset field and if the email didn't exist it returned an error. If the email was valid it returned a message saying the forgot password link had been emailed. After this change the user will receive a message that if the email is in our database the reset link will be emailed. I also changed the throttle mechanism so it still works the same but now returns the exact same message as above. Previously it would say 'You've already sent a request. Wait a few minutes'. This also allows user enumeration, although it requires a double-check. Related to https://dev.gitlab.org/gitlab/gitlabhq/issues/2624 See merge request !2044
49 lines
1.4 KiB
Ruby
49 lines
1.4 KiB
Ruby
class PasswordsController < Devise::PasswordsController
|
|
before_action :resource_from_email, only: [:create]
|
|
before_action :prevent_ldap_reset, only: [:create]
|
|
before_action :throttle_reset, only: [:create]
|
|
|
|
def edit
|
|
super
|
|
reset_password_token = Devise.token_generator.digest(
|
|
User,
|
|
:reset_password_token,
|
|
resource.reset_password_token
|
|
)
|
|
|
|
unless reset_password_token.nil?
|
|
user = User.where(
|
|
reset_password_token: reset_password_token
|
|
).first_or_initialize
|
|
|
|
unless user.reset_password_period_valid?
|
|
flash[:alert] = 'Your password reset token has expired.'
|
|
redirect_to(new_user_password_url(user_email: user['email']))
|
|
end
|
|
end
|
|
end
|
|
|
|
protected
|
|
|
|
def resource_from_email
|
|
email = resource_params[:email]
|
|
self.resource = resource_class.find_by_email(email)
|
|
end
|
|
|
|
def prevent_ldap_reset
|
|
return unless resource && resource.ldap_user?
|
|
|
|
redirect_to after_sending_reset_password_instructions_path_for(resource_name),
|
|
alert: "Cannot reset password for LDAP user."
|
|
end
|
|
|
|
def throttle_reset
|
|
return unless resource && resource.recently_sent_password_reset?
|
|
|
|
# Throttle reset attempts, but return a normal message to
|
|
# avoid user enumeration attack.
|
|
redirect_to new_user_session_path,
|
|
notice: I18n.t('devise.passwords.send_paranoid_instructions')
|
|
end
|
|
end
|