search

solidusio / solidus_auth_devise

🔑 Devise authentication for your Solidus store.
http://solidus.io
BSD 3-Clause "New" or "Revised" License
52 stars 124 forks source link

Fixes #202 : infinite redirection bug on password change #204

Closed nomad-mando closed 3 years ago

nomad-mando commented 3 years ago

Issue: Infinite redirection was happening when, config signout_after_password_change was set to true, and user tries to change the password.

Root cause: When signout_after_password_change is enabled, on password change the user gets logged out. But in controller (Spree::UsersController#update) we were redirecting the user to account page. This was resulting in unauthorized access and previous URL being same account_edit page, it results in infinite redirection loop. (Unauthorized access logic here tries to redirect to previous page first, which seems correct.)

Solution: When user is logged out already we shouldn't redirect it to the account edit page, so changing it to redirect on log_in page.

Fixes #202

nomad-mando commented 3 years ago

Thanks @aldesantis, I have addressed the comment now 👍

nomad-mando commented 3 years ago

@aldesantis seems like some feature test started failing after that code refactoring. It doesn't look related to my change. Will check why it started failing later when I get chance.

nomad-mando commented 3 years ago

same specs are also failing in master, I suspect they started failing after #203 got merged.

aldesantis commented 3 years ago

@nomad-mando you're right, the failing specs are not related to your change.

Code-wise, this is looking good. Can you just squash the commits together so we don't pollute the history?

nomad-mando commented 3 years ago

@aldesantis / @jarednorman Done 👍 squashed both commits in to a single commit.