| Age | Commit message (Collapse) | Author |
|---|
|
fixes #8796
Cleaned up UserController#update earlier but missed that it was
used to change fallback email addresses. Now it is back. This
time including an integration test.
|
|
feat: allow unauthenticated access to list of configs
Closes #8800
See merge request leap/webapp!45
|
|
fixes #8801
Includes a test reproducing 500 on lynx
We now make use of ActionController::Parameters require and permit
methods.
|
|
They used to be sorted by the code which was not helpful
fixes #8806
requires deploy of new design docs to the platform
|
|
On a failed login the warden failure app gets called.
Some of the params are changed accordingly but controller
and action remain.
set_locale would detect there was no locale in the path
and thus attempt to redirect. However the params still
belong to the previous request which was a POST to
Api::SessionsController.
This route does not respond to get requests and so it
would trigger a 404 in production and a 500 in development.
This commit prevents set_locale to act upon warden failure
app controller calls by adding /new to the list of
`NON_LOCALE_PATHS`. (The path is updated by warden to the
name of the action called in the failure app).
A test is included in this commit that tries to login
with an invalid username, password combination and a german
locale set.
fixes #8805
|
|
This should simplify client code significantly according to
platform#8849
|
|
We now use the hash of the token for comparison and as the id.
In order to use it you need the original token though. So forms and
thus the session should have token.to_s rather than token.id.
|
|
|
|
our special error handler for json requests would turn all exceptions
into 500s - removed it. now the rescue_responses can do their thing
again.
|
|
|
|
|
|
If you inherit respond to and call it again in your controller
it will not overwrite the previous but add to it.
Since we always have some exceptions from the rules it's probably
easiest to be explicit in the controllers that require it themselves.
|
|
It used to run the action and then trigger a 500 because the
template was not found.
fixes !3 .
|
|
for him/herself
So that it we do not expose the is_admin property to anyone else
including other admins.
|
|
This expresses the intent rather than the implementation.
Also replace temp with query refactoring.
|
|
There was a lot of special case handling going on in the users_controller
for this. Lot simpler this way.
|
|
There's no route to this right now and it also seems to be tested
nowhere. Since i am about to split up the users_controller let's
get rid of this and put it in the place we want it once we actually finish
the implementation
|
|
Actually this should live in a service_level_controller.
For now fix the security issue.
|
|
Now we test both api versions. We want this for backwards compatibility.
|
|
|
|
This avoids overwriting the PROVIDER_JSON constant in the
StaticConfigController and thus fixes test warnings.
Also moved away from using instance variables in the
ControllerExtension::JsonFile - instead querying the corresponding
functions now - less sideeffects and easier stubbing.
|
|
|
|
exists? is deprecated in ruby 2.1
|
|
CouchRest > 1.2 does not use RestClient anymore. So we should not try to
catch its errors.
|
|
|
|
|
|
|
|
create/delete test & tmp users.
|
|
configured auth token.
|
|
token, "tmp" users are users that exist only in tmp db, "test" users are either tmp users or users named "test_user_x"
|
|
are configured in the static config, to be used for infrastructure monitoring.
|
|
get re-enabled.
|
|
anymore. closes #7690
|
|
general.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
closes #6550
|
|
https://github.com/azul/leap_web into develop
|
|
develop
|
|
|
|
|
|
Also moved the location of the config files into a configuration setting.
|
|
There are some places where we only want to require login unless you can use EIP anonymously. So far we had an anonymous_certs_allowed? method in all these controllers. Now it's replaced with ApiController#anonymous_access_allowed?. The naming better reflects that there might be other services that allow anonymous use at some point.
This also fixed a typo name -> @filename that broke the ConfigsController.
|
|
includes test
|
|
|
