Redmine

  after_create :deliver_security_notification_create

  after_update :destroy_tokens, :deliver_security_notification_update

  after_destroy :destroy_tokens, :deliver_security_notification_destroy

  # send a security notification to user that a new email address was added

  def deliver_security_notification_create

    # only deliver if this isn't the only address.

    # in that case, the user is just being created and

    # should not receive this email.

    if user.mails != [address]

      deliver_security_notification(user,

        message: :mail_body_security_notification_add,

        field: :field_mail,

        value: address

      )

    end

  end

  # send a security notification to user that an email has been changed (notified/not notified)

  def deliver_security_notification_update

    if address_changed?

      recipients = [user, address_was]

      options = {

        message: :mail_body_security_notification_change_to,

        field: :field_mail,

        value: address

      }

    elsif notify_changed?

      recipients = [user, address]

      options = {

        message: notify_was ? :mail_body_security_notification_notify_disabled : :mail_body_security_notification_notify_enabled,

        value: address

      }

    end

    deliver_security_notification(recipients, options)

  end

  # send a security notification to user that an email address was deleted

  def deliver_security_notification_destroy

    deliver_security_notification([user, address],

      message: :mail_body_security_notification_remove,

      field: :field_mail,

      value: address

    )

  end

  # generic method to send security notifications for email addresses

  def deliver_security_notification(recipients, options={})

    Mailer.security_notification(recipients,

      options.merge(

        title: :label_my_account,

        url: {controller: 'my', action: 'account'}

      )

    ).deliver

  end

  mail_body_security_notification_notify_enabled: "E-Mail-Adresse %{value} erhält nun Benachrichtigungen."

  mail_body_security_notification_notify_disabled: "E-Mail-Adresse %{value} erhält keine Benachrichtigungen mehr."

  mail_body_security_notification_notify_enabled: "Email address %{value} now receives notifications."

  mail_body_security_notification_notify_disabled: "Email address %{value} no longer receives notifications."

  def test_create_should_send_security_notification

    @request.session[:user_id] = 2

    ActionMailer::Base.deliveries.clear

    post :create, :user_id => 2, :email_address => {:address => 'something@example.fr'}

    assert_not_nil (mail = ActionMailer::Base.deliveries.last)

    assert_mail_body_match '0.0.0.0', mail

    assert_mail_body_match I18n.t(:mail_body_security_notification_add, field: I18n.t(:field_mail), value: 'something@example.fr'), mail

    assert_select_email do

      assert_select 'a[href^=?]', 'http://localhost:3000/my/account', :text => 'My account'

    end

    # The old email address should be notified about a new address for security purposes

    assert [mail.bcc, mail.cc].flatten.include?(User.find(2).mail)

    assert [mail.bcc, mail.cc].flatten.include?('something@example.fr')

  end

  def test_update_should_send_security_notification

    @request.session[:user_id] = 2

    email = EmailAddress.create!(:user_id => 2, :address => 'another@somenet.foo')

    ActionMailer::Base.deliveries.clear

    xhr :put, :update, :user_id => 2, :id => email.id, :notify => '0'

    assert_not_nil (mail = ActionMailer::Base.deliveries.last)

    assert_mail_body_match I18n.t(:mail_body_security_notification_notify_disabled, value: 'another@somenet.foo'), mail

    # The changed address should be notified for security purposes

    assert [mail.bcc, mail.cc].flatten.include?('another@somenet.foo')

  end

  def test_destroy_should_send_security_notification

    @request.session[:user_id] = 2

    email = EmailAddress.create!(:user_id => 2, :address => 'another@somenet.foo')

    ActionMailer::Base.deliveries.clear

    xhr :delete, :destroy, :user_id => 2, :id => email.id

    assert_not_nil (mail = ActionMailer::Base.deliveries.last)

    assert_mail_body_match I18n.t(:mail_body_security_notification_remove, field: I18n.t(:field_mail), value: 'another@somenet.foo'), mail

    # The removed address should be notified for security purposes

    assert [mail.bcc, mail.cc].flatten.include?('another@somenet.foo')

  end

  def test_update_account_should_send_security_notification

    ActionMailer::Base.deliveries.clear

    post :account,

      :user => {

        :mail => 'foobar@example.com'

      }

    assert_not_nil (mail = ActionMailer::Base.deliveries.last)

    assert_mail_body_match '0.0.0.0', mail

    assert_mail_body_match I18n.t(:mail_body_security_notification_change_to, field: I18n.t(:field_mail), value: 'foobar@example.com'), mail

    assert_select_email do

      assert_select 'a[href^=?]', 'http://localhost:3000/my/account', :text => 'My account'

    end

    # The old email address should be notified about the change for security purposes

    assert [mail.bcc, mail.cc].flatten.include?(User.find(2).mail)

    assert [mail.bcc, mail.cc].flatten.include?('foobar@example.com')

  end