litvinovg/vitro
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NIHVIVO-638 don't require an immediate login after password change.

Browse source
This commit is contained in:
jeb228 2010-07-07 21:14:11 +00:00
parent 74c7660321
commit 722bcdac0f
1 changed files with 7 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
webapp/src/edu/cornell/mannlib/vitro/webapp/controller/edit/Authenticate.java
View file

@ -172,7 +172,7 @@ public class Authenticate extends FreeMarkerHttpServlet {
LoginProcessBean bean = getLoginProcessBean(request); LoginProcessBean bean = getLoginProcessBean(request);
bean.setState(State.FORCED_PASSWORD_CHANGE); bean.setState(State.FORCED_PASSWORD_CHANGE);
} else { } else {
recordLoginInfo(request, user); recordLoginInfo(request, user.getUsername());
} }
} }
@ -226,8 +226,7 @@ public class Authenticate extends FreeMarkerHttpServlet {
} }
/** /**
* Store the changed password. They're not logged in yet, but they no longer * Store the changed password. They are logged in.
* need to change their password.
*/ */
private void recordSuccessfulPasswordChange(HttpServletRequest request, private void recordSuccessfulPasswordChange(HttpServletRequest request,
User user) { User user) {
@ -235,22 +234,22 @@ public class Authenticate extends FreeMarkerHttpServlet {
String md5NewPassword = applyMd5Encoding(newPassword); String md5NewPassword = applyMd5Encoding(newPassword);
user.setOldPassword(user.getMd5password()); user.setOldPassword(user.getMd5password());
user.setMd5password(md5NewPassword); user.setMd5password(md5NewPassword);
user.setLoginCount(user.getLoginCount() + 1);
getUserDao(request).updateUser(user); getUserDao(request).updateUser(user);
log.debug("Completed first-time password change."); log.debug("Completed first-time password change.");
LoginProcessBean bean = getLoginProcessBean(request); recordLoginInfo(request, user.getUsername());
bean.setState(State.LOGGING_IN);
bean.setMessage(Message.PASSWORD_CHANGE_SAVED);
} }
/** /**
* The user provided the correct information, and changed the password if * The user provided the correct information, and changed the password if
* that was required. Record that they have logged in. * that was required. Record that they have logged in.
*/ */
private void recordLoginInfo(HttpServletRequest request, User user) { private void recordLoginInfo(HttpServletRequest request, String username) {
log.debug("Completed login."); log.debug("Completed login.");
// Get a fresh user object, so we know it's not stale.
User user = getUserDao(request).getUserByUsername(username);
HttpSession session = request.getSession(); HttpSession session = request.getSession();
// Put the login info into the session. // Put the login info into the session.