Split password reset functionality into PasswordsController

app/abilities/ability.rb

@@ -18,10 +18,11 @@ class Ability
       can :index, ChangesetComment
       can [:index, :rss, :show, :comments], DiaryEntry
       can [:index], Note
+      can [:lost_password, :reset_password], :password
       can [:index, :show], Redaction
       can [:new, :create, :destroy], :session
       can [:index, :show, :data, :georss, :picture, :icon], Trace
-      can [:terms, :new, :create, :save, :confirm, :confirm_resend, :confirm_email, :lost_password, :reset_password, :show, :auth_success, :auth_failure], User
+      can [:terms, :new, :create, :save, :confirm, :confirm_resend, :confirm_email, :show, :auth_success, :auth_failure], User
       can [:index, :show, :blocks_on, :blocks_by], UserBlock
       can [:index, :show], Node
       can [:index, :show, :full, :ways_for_node], Way

app/controllers/passwords_controller.rb

@@ -0,0 +1,67 @@
+class PasswordsController < ApplicationController
+  include SessionMethods
+
+  layout "site"
+
+  before_action :authorize_web
+  before_action :set_locale
+  before_action :check_database_readable
+
+  authorize_resource :class => false
+
+  before_action :check_database_writable, :only => [:lost_password, :reset_password]
+
+  def lost_password
+    @title = t "passwords.lost_password.title"
+
+    if request.post?
+      user = User.visible.find_by(:email => params[:email])
+
+      if user.nil?
+        users = User.visible.where("LOWER(email) = LOWER(?)", params[:email])
+
+        user = users.first if users.count == 1
+      end
+
+      if user
+        token = user.tokens.create
+        UserMailer.lost_password(user, token).deliver_later
+        flash[:notice] = t "passwords.lost_password.notice email on way"
+        redirect_to login_path
+      else
+        flash.now[:error] = t "passwords.lost_password.notice email cannot find"
+      end
+    end
+  end
+
+  def reset_password
+    @title = t "passwords.reset_password.title"
+
+    if params[:token]
+      token = UserToken.find_by(:token => params[:token])
+
+      if token
+        self.current_user = token.user
+
+        if params[:user]
+          current_user.pass_crypt = params[:user][:pass_crypt]
+          current_user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]
+          current_user.status = "active" if current_user.status == "pending"
+          current_user.email_valid = true
+
+          if current_user.save
+            token.destroy
+            session[:fingerprint] = current_user.fingerprint
+            flash[:notice] = t "passwords.reset_password.flash changed"
+            successful_login(current_user)
+          end
+        end
+      else
+        flash[:error] = t "passwords.reset_password.flash token bad"
+        redirect_to :action => "lost_password"
+      end
+    else
+      head :bad_request
+    end
+  end
+end

app/controllers/users_controller.rb

@@ -12,7 +12,7 @@ class UsersController < ApplicationController
   authorize_resource
 
   before_action :require_self, :only => [:account]
-  before_action :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public]
+  before_action :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :go_public]
   before_action :require_cookies, :only => [:new, :confirm]
   before_action :lookup_user_by_name, :only => [:set_status, :destroy]
   before_action :allow_thirdparty_images, :only => [:show, :account]
@@ -150,60 +150,6 @@ class UsersController < ApplicationController
     redirect_to :action => "account", :display_name => current_user.display_name
   end
 
-  def lost_password
-    @title = t "users.lost_password.title"
-
-    if request.post?
-      user = User.visible.find_by(:email => params[:email])
-
-      if user.nil?
-        users = User.visible.where("LOWER(email) = LOWER(?)", params[:email])
-
-        user = users.first if users.count == 1
-      end
-
-      if user
-        token = user.tokens.create
-        UserMailer.lost_password(user, token).deliver_later
-        flash[:notice] = t "users.lost_password.notice email on way"
-        redirect_to login_path
-      else
-        flash.now[:error] = t "users.lost_password.notice email cannot find"
-      end
-    end
-  end
-
-  def reset_password
-    @title = t "users.reset_password.title"
-
-    if params[:token]
-      token = UserToken.find_by(:token => params[:token])
-
-      if token
-        self.current_user = token.user
-
-        if params[:user]
-          current_user.pass_crypt = params[:user][:pass_crypt]
-          current_user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]
-          current_user.status = "active" if current_user.status == "pending"
-          current_user.email_valid = true
-
-          if current_user.save
-            token.destroy
-            session[:fingerprint] = current_user.fingerprint
-            flash[:notice] = t "users.reset_password.flash changed"
-            successful_login(current_user)
-          end
-        end
-      else
-        flash[:error] = t "users.reset_password.flash token bad"
-        redirect_to :action => "lost_password"
-      end
-    else
-      head :bad_request
-    end
-  end
-
   def new
     @title = t "users.new.title"
     @referer = if params[:referer]

app/mailers/user_mailer.rb

@@ -34,7 +34,7 @@ class UserMailer < ApplicationMailer
 
   def lost_password(user, token)
     with_recipient_locale user do
-      @url = url_for(:controller => "users", :action => "reset_password",
+      @url = url_for(:controller => "passwords", :action => "reset_password",
                      :token => token.token)
 
       mail :to => user.email,

app/views/sessions/new.html.erb

@@ -13,7 +13,7 @@
     <%= hidden_field_tag("referer", h(params[:referer])) %>
 
     <%= f.text_field :username, :label => t(".email or username"), :tabindex => 1, :value => params[:username] %>
-    <%= f.password_field :password, :label => t(".password"), :tabindex => 2, :value => "", :help => link_to(t(".lost password link"), :controller => "users", :action => "lost_password") %>
+    <%= f.password_field :password, :label => t(".password"), :tabindex => 2, :value => "", :help => link_to(t(".lost password link"), :controller => "passwords", :action => "lost_password") %>
     <%= f.form_group do %>
       <%= f.check_box :remember_me, { :label => t(".remember"), :tabindex => 3, :checked => (params[:remember_me] == "yes") }, "yes" %>
     <% end %>