Fix spam protection in the reset password screen#3215
Conversation
thalesmiguel
left a comment
thalesmiguel
left a comment
There was a problem hiding this comment.
Just a question about the test.
| When the buyer wants to reset their password | ||
| Then 15 seconds pass | ||
| Then the buyer doesn't need to pass the captcha after reset password form is filled wrong | ||
| But the buyer will need to pass the captcha after reset password form is filled in too quickly No newline at end of file |
There was a problem hiding this comment.
OCD-related-comment: We're missing an empty line by the end of this file.
There was a problem hiding this comment.
You are right, and I am sorry.
| params.require(:user).permit(:password, :password_confirmation) | ||
| end | ||
|
|
||
| def spam_protection_params |
There was a problem hiding this comment.
To me the name is a bit confusing, as it's fetching all the :account params, whether they are spam protection-related or not. At this point all of them are spam protection-related indeed.
I think I'd prefer to just call it account_params, and add a comment that fetching these params is for the spam protection mechanism. But well, maybe it's just me 🙃
|
|
||
| def buyer | ||
| @buyer ||= @provider.buyers.build | ||
| @buyer ||= @provider.buyers.build.tap do |account| |
There was a problem hiding this comment.
Is .tap needed here? I think it would work just with .build do |account|
There was a problem hiding this comment.
Indeed we can remove tap as build already returns newly built object.
jlledom
changed the title
3 participants
What this PR does / why we need it:
THREESCALE-7431 was not only about fixing the spam protection in the signup screen: the reset password screen had a broken recaptcha as well. The same fix should be good for both screens but the controller for the reset password form wasn't taking the spam check params correctly, so the checks always failed and the activity was always being marked as suspicious. Fixed in https://github.com/3scale/porta/pull/3215/files#diff-811e0b68328f92343b613fa4b352676067bc7e9f71fe951f627de512d2a21b62R49-R51
I also added some cukes to the reset password screen to test this behavior.
Which issue(s) this PR fixes
THREESCALE-7431
Verification steps