Finish 12.3

tliss · Oct 11, 2018 · 7ab3cd3 · 7ab3cd3
1 parent 79a8373
commit 7ab3cd3
Show file tree

Hide file tree

Showing 3 changed files with 19 additions and 2 deletions.
diff --git a/app/controllers/password_resets_controller.rb b/app/controllers/password_resets_controller.rb
@@ -28,6 +28,7 @@ def update
       render 'edit'
     elsif @user.update_attributes(user_params)
       log_in @user
+      @user.update_attribute(:reset_digest, nil)
       flash[:success] = "Password has been reset."
       redirect_to @user
     else

diff --git a/app/models/user.rb b/app/models/user.rb
@@ -53,8 +53,7 @@ def send_activation_email
   # Sets the password reset attributes.
   def create_reset_digest
     self.reset_token = User.new_token
-    update_attribute(:reset_digest,  User.digest(reset_token))
-    update_attribute(:reset_sent_at, Time.zone.now)
+    update_columns(reset_digest:  User.digest(reset_token), reset_sent_at: Time.zone.now)
   end
 
   # Sends password reset email.

diff --git a/test/integration/password_resets_test.rb b/test/integration/password_resets_test.rb
@@ -59,5 +59,22 @@ def setup
     assert is_logged_in?
     assert_not flash.empty?
     assert_redirected_to user
+    assert_nil @user.reload.reset_digest
+  end
+
+  test "expired token" do
+    get new_password_reset_path
+    post password_resets_path,
+         params: { password_reset: { email: @user.email } }
+
+    @user = assigns(:user)
+    @user.update_attribute(:reset_sent_at, 3.hours.ago)
+    patch password_reset_path(@user.reset_token),
+          params: { email: @user.email,
+                    user: { password:              "foobar",
+                            password_confirmation: "foobar" } }
+    assert_response :redirect
+    follow_redirect!
+    assert_match /expired/i, response.body
   end
 end