Redirect to root after password reset

2026-08-10 11:22:03 -06:00
parent 29a9dee1cb
commit 89184cd851
3 changed files with 63 additions and 1 deletions
@@ -50,5 +50,26 @@ RSpec.describe 'Password reset', type: :feature do
      expect(page).to have_content 'Your password has been changed successfully'
      expect(user.reload.reset_password_token).to be_nil
    end
+
+    scenario "Ignores a stale return location left by an rs/oauth request" do
+      expect(Devise::LDAP::Adapter).to receive(:update_password)
+        .with(user.cn, 'catch me if you can').and_return(true)
+
+      # Simulate an earlier rs/oauth authorization request that stored a
+      # return URL in the session (the original cause of issue #235).
+      visit new_rs_oauth_path(user.cn,
+                              redirect_uri: "https://example.com",
+                              client_id: "https://example.com",
+                              scope: "documents")
+
+      visit edit_user_password_path(reset_password_token: token)
+      fill_in :user_password, with: 'catch me if you can'
+      fill_in :user_password_confirmation, with: 'catch me if you can'
+      click_button 'Change my password'
+
+      expect(page).to have_content 'Your password has been changed successfully'
+      expect(page).to have_current_path(root_path)
+      expect(page).not_to have_content 'Bad request'
+    end
  end
 end