passwords_controller.rb 1.94 KB
Newer Older
1
class PasswordsController < Devise::PasswordsController
2
  before_action :resource_from_email, only: [:create]
3
  before_action :prevent_ldap_reset, only: [:create]
4
  before_action :throttle_reset,      only: [:create]
5
  before_action :log_audit_event,      only: [:create]
6

7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
  def edit
    super
    reset_password_token = Devise.token_generator.digest(
      User,
      :reset_password_token,
      resource.reset_password_token
    )

    unless reset_password_token.nil?
      user = User.where(
        reset_password_token: reset_password_token
      ).first_or_initialize

      unless user.reset_password_period_valid?
        flash[:alert] = 'Your password reset token has expired.'
22
        redirect_to(new_user_password_url(user_email: user['email']))
23 24 25
      end
    end
  end
26

27 28
  def update
    super do |resource|
29
      if resource.valid? && resource.require_password_creation?
30 31 32 33 34
        resource.update_attribute(:password_automatically_set, false)
      end
    end
  end

35 36 37 38 39 40 41
  protected

  def resource_from_email
    email = resource_params[:email]
    self.resource = resource_class.find_by_email(email)
  end

42 43
  def prevent_ldap_reset
    return unless resource&.ldap_user?
44 45

    redirect_to after_sending_reset_password_instructions_path_for(resource_name),
46
      alert: "Cannot reset password for LDAP user."
47 48 49 50
  end

  def throttle_reset
    return unless resource && resource.recently_sent_password_reset?
51

52 53 54 55
    # Throttle reset attempts, but return a normal message to
    # avoid user enumeration attack.
    redirect_to new_user_session_path,
      notice: I18n.t('devise.passwords.send_paranoid_instructions')
56
  end
57 58 59 60 61 62 63 64 65 66 67

  private

  def log_audit_event
    AuditEventService.new(current_user,
                          resource,
                          action: :custom,
                          custom_message: 'Ask for password reset',
                          ip_address: request.remote_ip)
        .for_user(resource_params[:email]).unauth_security_event
  end
68
end