Repository navigation
Fixed password bugs - #807
jupiter007 wants to merge 4 commits into
Conversation
|
Oh I forgot to update gem dependencies and JS dependencies. Will put into DRAFT mode. |
|
I updated gem dependencies (patch and minor) and |
| extend ActiveSupport::Concern | ||
|
|
||
| included do | ||
| # Not every including controller defines both :create and :update (e.g. SessionsController |
There was a problem hiding this comment.
Changed the callbacks from only: %i[create update] to an if: condition. SessionsController has no update action, and with raise_on_missing_callback_actions enabled in development and test, Rails raised an error on login. The callbacks still run only on create and update. Also restored before_action :assign_instance_variables, which was accidentally removed and broke SSO on stage.
| resource.firstname = nil | ||
| resource.surname = nil | ||
| resource.org = org_from_email_domain(email_domain: resource.email&.split('@')&.last) | ||
| # Keep the User's existing Org if one could not be determined from the email domain |
There was a problem hiding this comment.
This is the fix the issue where a user stays on the sign-in form after logging in.
| // those JS files anymore, so commenting out below | ||
| // ---------------------------------------------------------- | ||
| import './src/devise/passwords/edit'; | ||
| //import './src/devise/passwords/edit'; - totally identical to dmptool/users/passwords/edit.js, so commenting out |
There was a problem hiding this comment.
Commented this identical import out, because togglisePasswords was loaded twice breaking the show/hide password checkbox on the reset password page
There was a problem hiding this comment.
this all looks good @jupiter007
Fixes # 805 and 806
Changes proposed in this PR:
For the bug where the user stays on the password form view after submitting, this is what I found:
The account that had the sign-in bug has an
invitationthat was never accepted. It looks likeauthenticatable.rb(L52-L58) sets new user data in memory, and tries to set the user's org equal to the one from email domain, so the original org_id value is wiped out in memory.Then in
sessions_controller.rbin thecreatefunction, in theelse, the code assumes that only anemailwas provided, so it always renders the next password sign-up form.Fix: Updated the
createfunction insessions_controller.rbto keep the User's existing Org if one could not be determined from the email domain. Also, fixed password show/hide toggle not working on reset password. Two identical files were loading and had the same calls totogglisePasswords../src/devise/passwords/editwas commented out inapplication.js.For the
show/hidetoggle not working on the Password reset page, the problem was arising from the fact thattogglisePasswordswas being loaded twice by two different identical files inapplication.js:./src/devise/passwords/editanddmptool/users/passwords/edit.js.Fix: I commented out the
./src/devise/passwords/editand kept the one under./dmptoolsince it's the newer one.patchandminorgemdependencies and addressedhighvulnerabilities inJSpackages.Testing
stageand tested this. Could no longer reproduce the two bugs.