Merge branch 'duduribeiro/gitlab-ce-current_password_when_auto_set'

See merge request !5712.

3 files changed, 47 insertions, 0 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 8d1143554da..7bfeff2a4ec 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -81,6 +81,7 @@ v 8.11.0 (unreleased)
   - Add unfold links for Side-by-Side view. !5415 (Tim Masliuchenko)
   - Adds support for pending invitation project members importing projects
   - Update devise initializer to turn on changed password notification emails. !5648 (tombell)
+  - Avoid to show the original password field when password is automatically set. !5712 (duduribeiro)
 
 v 8.10.5 (unreleased)
 
diff --git a/app/controllers/profiles/passwords_controller.rb b/app/controllers/profiles/passwords_controller.rb
index c780e0983f9..6217ec5ecef 100644
--- a/app/controllers/profiles/passwords_controller.rb
+++ b/app/controllers/profiles/passwords_controller.rb
@@ -50,6 +50,7 @@ class Profiles::PasswordsController < Profiles::ApplicationController
       flash[:notice] = "Password was successfully updated. Please login with it"
       redirect_to new_user_session_path
     else
+      @user.reload
       render 'edit'
     end
   end
diff --git a/spec/features/profiles/password_spec.rb b/spec/features/profiles/password_spec.rb
new file mode 100644
index 00000000000..4cbdd89d46f
--- /dev/null
+++ b/spec/features/profiles/password_spec.rb
@@ -0,0 +1,45 @@
+require 'spec_helper'
+
+describe 'Profile > Password', feature: true do
+  let(:user) { create(:user, password_automatically_set: true) }
+
+  before do
+    login_as(user)
+    visit edit_profile_password_path
+  end
+
+  def fill_passwords(password, confirmation)
+    fill_in 'New password',          with: password
+    fill_in 'Password confirmation', with: confirmation
+
+    click_button 'Save password'
+  end
+
+  context 'User with password automatically set' do
+    describe 'User puts different passwords in the field and in the confirmation' do
+      it 'shows an error message' do
+        fill_passwords('mypassword', 'mypassword2')
+
+        page.within('.alert-danger') do
+          expect(page).to have_content("Password confirmation doesn't match Password")
+        end
+      end
+
+      it 'does not contains the current password field after an error' do
+        fill_passwords('mypassword', 'mypassword2')
+
+        expect(page).to have_no_field('user[current_password]')
+      end
+    end
+
+    describe 'User puts the same passwords in the field and in the confirmation' do
+      it 'shows a success message' do
+        fill_passwords('mypassword', 'mypassword')
+
+        page.within('.flash-notice') do
+          expect(page).to have_content('Password was successfully updated. Please login with it')
+        end
+      end
+    end
+  end
+end