maverick/docbrown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add forem_owner_secret to params (#10938)

Browse source 
* Add forem_owner_secret to params

* Add forem_owner_secret to safe_params_list
This commit is contained in:
Alex 2020-10-19 16:43:21 -04:00 • committed by GitHub
parent 44eaab66e0
commit 7e9447ccd1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 34 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
app/views/shared/authentication/_email_registration_form.html.erb
View file

@ -54,10 +54,14 @@
</div>
<% if ENV["FOREM_OWNER_SECRET"].present? && SiteConfig.waiting_on_first_user %>
<div class="crayons-field mt-2">
<%= f.label :forem_owner_secret, "Few Forem Secret", class: "crayons-field__label" %>
<%= f.password_field :forem_owner_secret, autocomplete: "current-password", class: "crayons-textfield", required: true, placeholder: "As provided by your Forem host" %>
</div>
<% if params[:forem_owner_secret].present? %>
<%= f.hidden_field :forem_owner_secret, value: params[:forem_owner_secret] %>
<% else %>
<div class="crayons-field mt-2">
<%= f.label :forem_owner_secret, "New Forem Secret", class: "crayons-field__label" %>
<%= f.password_field :forem_owner_secret, class: "crayons-textfield", required: true, placeholder: "As provided by your Forem host" %>
</div>
<% end %>
<% end %>
<% if recaptcha_configured_and_enabled? %>

2
config/fastly/snippets/safe_params_list.vcl
View file

@ -2,6 +2,6 @@ import querystring;
sub vcl_recv {
# return this URL with only the parameters that match this regular expression
if (req.url !~ "/admin/" && req.url !~ "/search/" && req.url !~ "/bulk_show") {
set req.url = querystring.regfilter_except(req.url, "^(a_id|args|article_id|article_ids|articles|asc|callback_url|category|chat_channel_id|client_id|code|collection_id|commentable_id|commentable_type|confirmation_token|created_at|end|filter|followable_id|followable_type|fork_id|i|key|message_offset|name|oauth_token|oauth_verifier|offset|org_id|organization_id|p|page|per_page|p_id|prefill|preview|purchaser|reactable_ids|redirect_uri|reported_url|reporter_username|response_type|scope|search|signature|sort|source_id|source_type|start|state|status|tag|tag_list|top|type_of|url|username|invitation_token|reset_password_token|ut|verb|invitation_slug)$");
set req.url = querystring.regfilter_except(req.url, "^(a_id|args|article_id|article_ids|articles|asc|callback_url|category|chat_channel_id|client_id|code|collection_id|commentable_id|commentable_type|confirmation_token|created_at|end|filter|followable_id|followable_type|forem_owner_secret|fork_id|i|key|message_offset|name|oauth_token|oauth_verifier|offset|org_id|organization_id|p|page|per_page|p_id|prefill|preview|purchaser|reactable_ids|redirect_uri|reported_url|reporter_username|response_type|scope|search|signature|sort|source_id|source_type|start|state|status|tag|tag_list|top|type_of|url|username|invitation_token|reset_password_token|ut|verb|invitation_slug)$");
}
}

25
spec/requests/registrations_spec.rb
View file

@ -111,6 +111,31 @@ RSpec.describe "Registrations", type: :request do
end
end
describe "GET /users/signup" do
context "when site is in waiting_on_first_user state" do
before do
SiteConfig.waiting_on_first_user = true
ENV["FOREM_OWNER_SECRET"] = "test"
end
after do
SiteConfig.waiting_on_first_user = false
ENV["FOREM_OWNER_SECRET"] = nil
end
it "auto-populates forem_owner_secret if included in querystring params" do
get new_user_registration_path(forem_owner_secret: ENV["FOREM_OWNER_SECRET"])
expect(response.body).not_to include("New Forem Secret")
expect(response.body).to include(ENV["FOREM_OWNER_SECRET"])
end
it "shows forem_owner_secret field if it's not included in querystring params" do
get new_user_registration_path
expect(response.body).to include("New Forem Secret")
end
end
end
describe "POST /users" do
def mock_recaptcha_verification
# rubocop:disable RSpec/AnyInstance