Redmine

  after_save :update_notified_project_ids, :destroy_tokens

  # Delete all outstanding password reset tokens on password or email change.

  # Delete the autologin tokens on password change to prohibit session leakage.

  # This helps to keep keep the account secure in case the associated email

  # account was compromised.

  def destroy_tokens

    tokens  = []

    tokens |= ['recovery', 'autologin'] if changes.has_key?('hashed_password')

    tokens |= ['recovery'] if changes.has_key?('mail')

    Token.delete_all(['user_id = ? AND action IN (?)', self.id, tokens]) if tokens.any?

  end

  def test_password_change_should_destroy_tokens

    recovery_token = Token.create!(:user_id => 2, :action => 'recovery')

    autologin_token = Token.create!(:user_id => 2, :action => 'autologin')

    user = User.find(2)

    user.password, user.password_confirmation = "a new password", "a new password"

    assert user.save

    assert_nil Token.find_by_id(recovery_token.id)

    assert_nil Token.find_by_id(autologin_token.id)

  end

  def test_mail_change_should_destroy_tokens

    recovery_token = Token.create!(:user_id => 2, :action => 'recovery')

    autologin_token = Token.create!(:user_id => 2, :action => 'autologin')

    user = User.find(2)

    user.mail = "user@somwehere.com"

    assert user.save

    assert_nil Token.find_by_id(recovery_token.id)

    assert_equal autologin_token, Token.find_by_id(autologin_token.id)

  end