lino.jorzick
/
greenlight
forked from External/greenlight
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Prevented LDAP sign in without password (#1092) 

Co-authored-by: Jesus Federico <jesus@123it.ca>
This commit is contained in:
Ahmad Farhat 2020-04-01 10:45:45 -04:00 committed by GitHub
parent fab3b479c9
commit c72d77dbcb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/sessions_controller.rb
View File

@ -139,6 +139,8 @@ class SessionsController < ApplicationController
ldap_config[:base] = ENV['LDAP_BASE']
ldap_config[:uid] = ENV['LDAP_UID']
return redirect_to(ldap_signin_path, alert: I18n.t("invalid_credentials")) unless session_params[:password].present?
result = send_ldap_request(params[:session], ldap_config)
return redirect_to(ldap_signin_path, alert: I18n.t("invalid_credentials")) unless result

14
spec/controllers/sessions_controller_spec.rb
View File

@ -591,5 +591,19 @@ describe SessionsController, type: :controller do
expect(response).to redirect_to(ldap_signin_path)
expect(flash[:alert]).to eq(I18n.t("invalid_credentials"))
end
it "redirects to signin if no password provided" do
allow_any_instance_of(Net::LDAP).to receive(:bind_as).and_return(false)
post :ldap, params: {
session: {
user: "test",
password: '',
},
}
expect(response).to redirect_to(ldap_signin_path)
expect(flash[:alert]).to eq(I18n.t("invalid_credentials"))
end
end
end