summaryrefslogtreecommitdiff
path: root/spec
diff options
context:
space:
mode:
authorGitLab Bot <gitlab-bot@gitlab.com>2021-09-29 13:00:00 +0000
committerGitLab Bot <gitlab-bot@gitlab.com>2021-09-29 13:00:19 +0000
commit95328dd30a55cb66da05352131e7a981b44e1348 (patch)
tree0777a77e26ce6cc0ced4536914fd49408df59eeb /spec
parent77e5b153659e884a5fa8442d675f2b88e9de2dd2 (diff)
downloadgitlab-ce-95328dd30a55cb66da05352131e7a981b44e1348.tar.gz
Add latest changes from gitlab-org/security/gitlab@14-3-stable-ee
Diffstat (limited to 'spec')
-rw-r--r--spec/controllers/admin/users_controller_spec.rb15
-rw-r--r--spec/features/profiles/password_spec.rb78
2 files changed, 19 insertions, 74 deletions
diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb
index 3a2b5dcb99d..4d2c311c9a4 100644
--- a/spec/controllers/admin/users_controller_spec.rb
+++ b/spec/controllers/admin/users_controller_spec.rb
@@ -815,20 +815,5 @@ RSpec.describe Admin::UsersController do
expect(response).to have_gitlab_http_status(:not_found)
end
end
-
- context 'when impersonating an admin and attempting to impersonate again' do
- let(:admin2) { create(:admin) }
-
- before do
- post :impersonate, params: { id: admin2.username }
- end
-
- it 'does not allow double impersonation', :aggregate_failures do
- post :impersonate, params: { id: user.username }
-
- expect(flash[:alert]).to eq(_('You are already impersonating another user'))
- expect(warden.user).to eq(admin2)
- end
- end
end
end
diff --git a/spec/features/profiles/password_spec.rb b/spec/features/profiles/password_spec.rb
index 893dd2c76e0..c9059395377 100644
--- a/spec/features/profiles/password_spec.rb
+++ b/spec/features/profiles/password_spec.rb
@@ -78,80 +78,40 @@ RSpec.describe 'Profile > Password' do
end
end
- context 'Change password' do
- let(:new_password) { '22233344' }
-
+ context 'Change passowrd' do
before do
sign_in(user)
visit(edit_profile_password_path)
end
- shared_examples 'user enters an incorrect current password' do
- subject do
- page.within '.update-password' do
- fill_in 'user_current_password', with: user_current_password
- fill_passwords(new_password, new_password)
- end
+ it 'does not change user passowrd without old one' do
+ page.within '.update-password' do
+ fill_passwords('22233344', '22233344')
end
- it 'handles the invalid password attempt, and prompts the user to try again', :aggregate_failures do
- expect(Gitlab::AppLogger).to receive(:info)
- .with(message: 'Invalid current password when attempting to update user password', username: user.username, ip: user.current_sign_in_ip)
-
- subject
-
- user.reload
-
- expect(user.failed_attempts).to eq(1)
- expect(user.valid_password?(new_password)).to eq(false)
- expect(current_path).to eq(edit_profile_password_path)
-
- page.within '.flash-container' do
- expect(page).to have_content('You must provide a valid current password')
- end
+ page.within '.flash-container' do
+ expect(page).to have_content 'You must provide a valid current password'
end
-
- it 'locks the user account when user passes the maximum attempts threshold', :aggregate_failures do
- user.update!(failed_attempts: User.maximum_attempts.pred)
-
- subject
-
- expect(current_path).to eq(new_user_session_path)
-
- page.within '.flash-container' do
- expect(page).to have_content('Your account is locked.')
- end
- end
- end
-
- context 'when current password is blank' do
- let(:user_current_password) { nil }
-
- it_behaves_like 'user enters an incorrect current password'
end
- context 'when current password is incorrect' do
- let(:user_current_password) {'invalid' }
+ it 'does not change password with invalid old password' do
+ page.within '.update-password' do
+ fill_in 'user_current_password', with: 'invalid'
+ fill_passwords('password', 'confirmation')
+ end
- it_behaves_like 'user enters an incorrect current password'
+ page.within '.flash-container' do
+ expect(page).to have_content 'You must provide a valid current password'
+ end
end
- context 'when the password reset is successful' do
- subject do
- page.within '.update-password' do
- fill_in "user_current_password", with: user.password
- fill_passwords(new_password, new_password)
- end
+ it 'changes user password' do
+ page.within '.update-password' do
+ fill_in "user_current_password", with: user.password
+ fill_passwords('22233344', '22233344')
end
- it 'changes the password, logs the user out and prompts them to sign in again', :aggregate_failures do
- expect { subject }.to change { user.reload.valid_password?(new_password) }.to(true)
- expect(current_path).to eq new_user_session_path
-
- page.within '.flash-container' do
- expect(page).to have_content('Password was successfully updated. Please sign in again.')
- end
- end
+ expect(current_path).to eq new_user_session_path
end
end