Skip to content

Commit 6613292

Browse files
mbhavembhave
committed
Only Reset Password code data should deserialize to PasswordChange
Signed-off-by: Madhura Bhave <[email protected]>
1 parent 08c0e1f commit 6613292

File tree

5 files changed

+44
-22
lines changed

5 files changed

+44
-22
lines changed

‎server/src/main/java/org/cloudfoundry/identity/uaa/account/UaaResetPasswordService.java‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -79,20 +79,22 @@ private ResetPasswordResponse changePasswordCodeAuthenticated(String code, Strin
7979
throw new InvalidCodeException("invalid_code", "Sorry, your reset password link is no longer valid. Please request a new one", 422);
8080
}
8181
String userId;
82-
String userName = null;
83-
Date passwordLastModified = null;
84-
String clientId = null;
85-
String redirectUri = null;
82+
String userName;
83+
Date passwordLastModified;
84+
String clientId;
85+
String redirectUri;
86+
PasswordChange change;
8687
try {
87-
PasswordChange change = JsonUtils.readValue(expiringCode.getData(), PasswordChange.class);
88-
userId = change.getUserId();
89-
userName = change.getUsername();
90-
passwordLastModified = change.getPasswordModifiedTime();
91-
clientId = change.getClientId();
92-
redirectUri = change.getRedirectUri();
88+
change = JsonUtils.readValue(expiringCode.getData(), PasswordChange.class);
9389
} catch (JsonUtils.JsonUtilException x) {
94-
userId = expiringCode.getData();
90+
throw new InvalidCodeException("invalid_code", "Sorry, your reset password link is no longer valid. Please request a new one", 422);
9591
}
92+
userId = change.getUserId();
93+
userName = change.getUsername();
94+
passwordLastModified = change.getPasswordModifiedTime();
95+
clientId = change.getClientId();
96+
redirectUri = change.getRedirectUri();
97+
9698
ScimUser user = scimUserProvisioning.retrieve(userId);
9799
try {
98100
if (isUserModified(user, expiringCode.getExpiresAt(), userName, passwordLastModified)) {

‎server/src/main/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordChange.java‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
package org.cloudfoundry.identity.uaa.scim.endpoints;
22

3-
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
43
import com.fasterxml.jackson.annotation.JsonProperty;
54

65
import java.util.Date;
76

8-
@JsonIgnoreProperties(ignoreUnknown = true)
97
public class PasswordChange {
108
public PasswordChange() {}
119

‎server/src/test/java/org/cloudfoundry/identity/uaa/login/UaaResetPasswordServiceTests.java‎

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ public void forgotPassword_PublishesResetPasswordRequestEvent() throws Exception
121121
ArgumentCaptor<ResetPasswordRequestEvent> captor = ArgumentCaptor.forClass(ResetPasswordRequestEvent.class);
122122
verify(publisher).publishEvent(captor.capture());
123123
ResetPasswordRequestEvent event = captor.getValue();
124-
assertThat((String) event.getSource(), equalTo("[email protected]"));
124+
assertThat(event.getSource(), equalTo("[email protected]"));
125125
assertThat(event.getCode(), equalTo("code"));
126126
assertThat(event.getAuthentication(), sameInstance(authentication));
127127
}
@@ -185,7 +185,7 @@ public void resetPassword_InvalidPasswordException_NewPasswordSameAsOld() {
185185
user.setMeta(new ScimMeta(new Date(), new Date(), 0));
186186
user.setPrimaryEmail("[email protected]");
187187
ExpiringCode expiringCode = new ExpiringCode("good_code",
188-
new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "user-id", null);
188+
new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "{\"user_id\":\"user-id\",\"username\":\"username\",\"passwordModifiedTime\":null,\"client_id\":\"\",\"redirect_uri\":\"\"}", null);
189189
when(codeStore.retrieveCode("good_code")).thenReturn(expiringCode);
190190
when(scimUserProvisioning.retrieve("user-id")).thenReturn(user);
191191
when(scimUserProvisioning.checkPasswordMatches("user-id", "Passwo3dAsOld"))
@@ -202,6 +202,22 @@ public void resetPassword_InvalidPasswordException_NewPasswordSameAsOld() {
202202
}
203203
}
204204

205+
@Test
206+
public void resetPassword_InvalidCodeData() {
207+
ExpiringCode expiringCode = new ExpiringCode("good_code",
208+
new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "user-id", null);
209+
when(codeStore.retrieveCode("good_code")).thenReturn(expiringCode);
210+
SecurityContext securityContext = mock(SecurityContext.class);
211+
when(securityContext.getAuthentication()).thenReturn(new MockAuthentication());
212+
SecurityContextHolder.setContext(securityContext);
213+
try {
214+
emailResetPasswordService.resetPassword("good_code", "password");
215+
fail();
216+
} catch (InvalidCodeException e) {
217+
assertEquals("Sorry, your reset password link is no longer valid. Please request a new one", e.getMessage());
218+
}
219+
}
220+
205221
@Test
206222
public void resetPassword_WithInvalidClientId() {
207223
setupResetPassword("invalid_client", "redirect.example.com");

‎server/src/test/java/org/cloudfoundry/identity/uaa/scim/endpoints/PasswordResetEndpointTest.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -237,7 +237,8 @@ public void testCreatingAPasswordResetWithAUsernameContainingSpecialCharacters()
237237
@Test
238238
public void testChangingAPasswordWithAValidCode() throws Exception {
239239
when(expiringCodeStore.retrieveCode("secret_code"))
240-
.thenReturn(new ExpiringCode("secret_code", new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "eyedee", null));
240+
.thenReturn(new ExpiringCode("secret_code", new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME),
241+
"{\"user_id\":\"eyedee\",\"username\":\"[email protected]\",\"passwordModifiedTime\":null,\"client_id\":\"\",\"redirect_uri\":\"\"}", null));
241242

242243
ScimUser scimUser = new ScimUser("eyedee", "[email protected]", "User", "Man");
243244
scimUser.setMeta(new ScimMeta(new Date(System.currentTimeMillis() - (1000 * 60 * 60 * 24)), new Date(System.currentTimeMillis() - (1000 * 60 * 60 * 24)), 0));
@@ -281,7 +282,9 @@ public void changing_password_with_invalid_code() throws Exception {
281282
@Test
282283
public void testChangingAPasswordForUnverifiedUser() throws Exception {
283284
when(expiringCodeStore.retrieveCode("secret_code"))
284-
.thenReturn(new ExpiringCode("secret_code", new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "eyedee", null));
285+
.thenReturn(new ExpiringCode("secret_code", new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME),
286+
"{\"user_id\":\"eyedee\",\"username\":\"[email protected]\",\"passwordModifiedTime\":null,\"client_id\":\"\",\"redirect_uri\":\"\"}",
287+
null));
285288

286289
ScimUser scimUser = new ScimUser("eyedee", "[email protected]", "User", "Man");
287290
scimUser.setMeta(new ScimMeta(new Date(System.currentTimeMillis() - (1000 * 60 * 60 * 24)), new Date(System.currentTimeMillis() - (1000 * 60 * 60 * 24)), 0));
@@ -338,7 +341,9 @@ public void changePassword_Returns422UnprocessableEntity_NewPasswordSameAsOld()
338341
Mockito.reset(passwordValidator);
339342

340343
when(expiringCodeStore.retrieveCode("emailed_code"))
341-
.thenReturn(new ExpiringCode("emailed_code", new Timestamp(System.currentTimeMillis()+ UaaResetPasswordService.PASSWORD_RESET_LIFETIME), "eyedee", null));
344+
.thenReturn(new ExpiringCode("emailed_code", new Timestamp(System.currentTimeMillis()+ UaaResetPasswordService.PASSWORD_RESET_LIFETIME),
345+
"{\"user_id\":\"eyedee\",\"username\":\"[email protected]\",\"passwordModifiedTime\":null,\"client_id\":\"\",\"redirect_uri\":\"\"}",
346+
null));
342347

343348
ScimUser scimUser = new ScimUser("eyedee", "[email protected]", "User", "Man");
344349
scimUser.setMeta(new ScimMeta(new Date(System.currentTimeMillis()-(1000*60*60*24)), new Date(System.currentTimeMillis()-(1000*60*60*24)), 0));

‎uaa/src/test/java/org/cloudfoundry/identity/uaa/login/ResetPasswordControllerMockMvcTests.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,8 @@ public void testResettingAPasswordUsingTimestampForUserModification() throws Exc
239239
List<ScimUser> users = getWebApplicationContext().getBean(ScimUserProvisioning.class).query("username eq \"marissa\"");
240240
assertNotNull(users);
241241
assertEquals(1, users.size());
242-
ExpiringCode code = codeStore.generateCode(users.get(0).getId(), new Timestamp(System.currentTimeMillis()+ UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
242+
PasswordChange passwordChange = new PasswordChange(users.get(0).getId(), users.get(0).getUserName(), null, null, null);
243+
ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(passwordChange), new Timestamp(System.currentTimeMillis()+ UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
243244

244245
MockHttpServletRequestBuilder post = createChangePasswordRequest(users.get(0), code,
245246
true, "newpassw0rD", "newpassw0rD");
@@ -266,11 +267,11 @@ public void resetPassword_ReturnsUnprocessableEntity_NewPasswordSameAsOld() thro
266267
assertNotNull(users);
267268
assertEquals(1, users.size());
268269
ScimUser user = users.get(0);
269-
270-
ExpiringCode code = codeStore.generateCode(user.getId(), new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
270+
PasswordChange passwordChange = new PasswordChange(user.getId(), user.getUserName(), null, null, null);
271+
ExpiringCode code = codeStore.generateCode(JsonUtils.writeValueAsString(passwordChange), new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
271272
getMockMvc().perform(createChangePasswordRequest(user, code, true, "d3faultPasswd", "d3faultPasswd"));
272273

273-
code = codeStore.generateCode(user.getId(), new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
274+
code = codeStore.generateCode(JsonUtils.writeValueAsString(passwordChange), new Timestamp(System.currentTimeMillis() + UaaResetPasswordService.PASSWORD_RESET_LIFETIME), null);
274275
getMockMvc().perform(createChangePasswordRequest(user, code, true, "d3faultPasswd", "d3faultPasswd"))
275276
.andExpect(status().isUnprocessableEntity())
276277
.andExpect(view().name("forgot_password"))

0 commit comments

Comments
 (0)