Created a function to delete accountAuthorizations in the
accountDAO. Create an activeFlag column in the accountAuthorizations
entity. Updated the AccountService to check the passwords to make sure
that there are not duplicates, mark old passwords as inactive, and
delete all passwords that go over the max limit that we want to be
stored.
Updated the resource bundles to have a new validation message when an
admin password matches a previous one. Created a function so that the
create password and change password functions could utilize the same
code without it being written twice.
Merge branch 'develop' of https://github.com/ten24/Slatwall.git into feature-passwordManagement
Updated the HQl in the getInternalAccountAuthenticationsByEmailAddress
function to only include the authentications that have an activeFlag of
true
Added the accountFailedLogin settings for both the admin and the public
accounts
Fixed the properties file by removing the unneeded lines of
code, reorganized how the code was structured in the files, renamed
functions and updated the entities to remove the defaults.
Main.cfc was updated to create a function to handle what happens when an
admin unlocks an account. Detail.account was updated to display a
message alerting a user that an account has been lock and provides a
link to unlock it. Resource bundle updated for the two new messages
created (account locked and account unlocked). A function was added to
Account Service to unlock the account on the back end. The Hibachi scope
was updated to use allow the stringReplace function to work on
messages. This was used to allow the accountId to be passed to the
unlock function via a url parameter in the link.
Updated the account entity to set the failedLoginAttemptCount to not be
hb_auditable and also added the unlock function to the
processContexts.Updated variables name to properly reflect the data
that will be assigned to it. Added an expiration date of 90 days when
admin passwords get created. Update the function that deletes old
passwords to utilize a more efficient loop.
Added conditional to check to make sure that if the account is an admin
that it will be logged off after 15 min of inactivity.
Removed the delete account function
Commit to save work as I move to work on a hot fix
The work for the password update required functionality. The login has
been updated to redirect to a new form whenever a user who has the
resetPasswordOnNextLogin flag set to true. This form has fields related
to the email address, old password, new password, and confirm password.
This form then submits the data to the processAccount_updatePassword
which then determines if everything is accurate before creating the new
password for the user and then logging them in.
Added conditional to the create password process to see if the
resetPasswordOnNextLoginFlag needs to be set. It checks that the account
is an admin account and that another user is the one doing the update.
Removed the code that set expiration date on password creation.
Update the reset password conditional on login to also check for whether
or not the account is an admin account and if their password was created
over 90 days ago.
Removed the code that set the resetPasswordFlag to true upon create
password. Moved the conditional to check if a password reset was
required to its own private function. Added the check if the password
was created by another user. Also added a conditional to that function
to make sure that admin passwords are strong.
Added validation messages for admin passwords that are not strong enough
Added RBKey for when an account gets locked
Created a new function in the account entity to return a list of all
accountAuthentications for that account minus passwords that have an
active flag of false. This then is used to display the authentications
in the view instead of just using the getAccountAuthentiations function.
Updated the getActiveAccountAuthentications to not delete the actually
authentications in the entity. So instead of the arrayDelete, we are
arrayAppending to a new array.
Updated the delete authentication function to have a more accurate
name.Also adjusted the function call to return to make sure that only
'4' are kept instead of '5'. Updated the math for how many to loop over
so that the correct number of records get deleted.