You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@allura.apache.org by br...@apache.org on 2025/01/02 20:48:41 UTC
(allura) branch master updated (e50160c83 -> 06b7b8909)
This is an automated email from the ASF dual-hosted git repository.
brondsem pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
from e50160c83 fix for wiki pages that don't have any history
new fc9d5280d enforce new passwords (not current one again) on pwd reset links
new 06b7b8909 fix and simplify beautifulsoup selector
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
Allura/allura/controllers/auth.py | 9 +++++++--
Allura/allura/tests/functional/test_admin.py | 4 ++--
Allura/allura/tests/functional/test_auth.py | 11 +++++++++++
3 files changed, 20 insertions(+), 4 deletions(-)
(allura) 02/02: fix and simplify beautifulsoup selector
Posted by br...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
brondsem pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit 06b7b8909253e3f856744a1994f1175ad962512a
Author: Dave Brondsema <db...@slashdotmedia.com>
AuthorDate: Thu Jan 2 15:45:12 2025 -0500
fix and simplify beautifulsoup selector
---
Allura/allura/tests/functional/test_admin.py | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Allura/allura/tests/functional/test_admin.py b/Allura/allura/tests/functional/test_admin.py
index fa3249276..9f334f1be 100644
--- a/Allura/allura/tests/functional/test_admin.py
+++ b/Allura/allura/tests/functional/test_admin.py
@@ -169,9 +169,9 @@ class TestProjectAdmin(TestController):
'features-1.feature': ' ',
'features-2.feature': ' Two '})
if resp.status_int == 200:
- errors = resp.html.findAll('', attrs={'class': 'fielderror'})
+ errors = resp.html.findAll(attrs={'class': 'fielderror'})
assert [] == errors
- errors = resp.html.findAll('', attrs={'class': 'error'})
+ errors = resp.html.findAll(attrs={'class': 'error'})
assert [] == errors
raise AssertionError('Should be a 301 not 200 response')
(allura) 01/02: enforce new passwords (not current one again) on pwd reset links
Posted by br...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
brondsem pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git
commit fc9d5280d348ed9388009f4613ffedae3dbddc0a
Author: Dave Brondsema <db...@slashdotmedia.com>
AuthorDate: Thu Jan 2 15:44:40 2025 -0500
enforce new passwords (not current one again) on pwd reset links
---
Allura/allura/controllers/auth.py | 9 +++++++--
Allura/allura/tests/functional/test_auth.py | 11 +++++++++++
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/Allura/allura/controllers/auth.py b/Allura/allura/controllers/auth.py
index 0b6a7e1d2..8857bdaa0 100644
--- a/Allura/allura/controllers/auth.py
+++ b/Allura/allura/controllers/auth.py
@@ -167,7 +167,7 @@ class AuthController(BaseController):
c.form = F.registration_form
return dict()
- def _validate_hash(self, hash):
+ def _validate_hash(self, hash) -> M.User:
login_url = config.get('auth.login_url', '/auth/')
if not hash:
redirect(login_url)
@@ -206,7 +206,12 @@ class AuthController(BaseController):
if not provider.forgotten_password_process:
raise wexc.HTTPNotFound()
user = self._validate_hash(hash)
- enforce_hibp_password_check(provider, pw, f'/auth/forgotten_password/{hash}')
+ restart_url = f'/auth/forgotten_password/{hash}'
+ enforce_hibp_password_check(provider, pw, restart_url)
+
+ if provider._validate_password(user, pw):
+ flash('Your old and new password should not be the same', 'error')
+ redirect(restart_url)
user.set_password(pw)
user.set_tool_data('AuthPasswordReset', hash='', hash_expiry='') # Clear password reset token
diff --git a/Allura/allura/tests/functional/test_auth.py b/Allura/allura/tests/functional/test_auth.py
index 7309495c9..3ca7741d0 100644
--- a/Allura/allura/tests/functional/test_auth.py
+++ b/Allura/allura/tests/functional/test_auth.py
@@ -1743,6 +1743,17 @@ To update your password on {}, please visit the following URL:
assert 'New Password:' in r
assert 'New Password (again):' in r
form = r.forms[0]
+ form['pw'] = form['pw2'] = 'foo' # old password
+ with h.push_config(config, **{'auth.min_password_len': 3}):
+ r = form.submit()
+ print(r)
+ if r.status == 200:
+ assert [] == r.html.findAll(attrs={'class': 'fielderror'})
+ assert 'Your old and new password should not be the same' in self.webflash(r)
+ r = r.follow()
+
+ # fill it out correctly
+ form = r.forms[0]
form['pw'] = form['pw2'] = new_password = '154321'
with td.audits(r'Password changed \(through recovery process\)', user=True):
# escape parentheses, so they would not be treated as regex group