Merge remote-tracking branch 'upstream/pull/5957'

diff --git a/app/assets/javascripts/login.js b/app/assets/javascripts/login.js
index 8297944f3720ff769043899715adcd655d765b80..c0d9fe57bd4139b1c0e74605b11798b1efc842b1 100644 (file)
--- a/app/assets/javascripts/login.js
+++ b/app/assets/javascripts/login.js
@@ -2,5 +2,6 @@ $(function () {
   // Preserve location hash in referer
   if (location.hash) {
     $("#referer").val($("#referer").val() + location.hash);
+    $("#referer_link").prop("hash", location.hash);
   }
 });

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 19fe05f3082574961423f1f3965abcd53e386a43..090a9ea5c7d2233868ef61682ca71332a9a181ba 100644 (file)
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -16,6 +16,9 @@ class SessionsController < ApplicationController
   def new
     referer = safe_referer(params[:referer]) if params[:referer]
 
+    @safe_referer = referer
+    @safe_referer = nil if referer != params[:referer]
+
     parse_oauth_referer referer
   end
 

diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index c2d96b63cc37ae2b9def6ba868cf8742927c3212..ec4e256dfce0d30d672e5697633161daf6a54ebb 100644 (file)
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -27,6 +27,22 @@
   <%= render :partial => "shared/section_divider", :locals => { :text => t(".or") } %>
 <% end %>
 
+<% if current_user %>
+  <div class="alert alert-warning pb-0">
+    <p>
+      <%= t ".already_logged_in_html", :user => tag.strong(current_user.display_name) %>
+    </p>
+    <% if @safe_referer %>
+      <p>
+        <%= t ".access_another_page" %>
+      </p>
+      <p class="text-center">
+        <%= link_to t(".visit_referring_page"), @safe_referer, :id => "referer_link", :class => "btn btn-warning" %>
+      </p>
+    <% end %>
+  </div>
+<% end %>
+
 <%= bootstrap_form_tag(:action => "login", :html => { :id => "login_form" }) do |f| %>
   <%= hidden_field_tag("referer", h(params[:referer]), :autocomplete => "off") %>
 

diff --git a/config/locales/en.yml b/config/locales/en.yml
index 7774a203a3cf73f34033c0e61b4489abfa67dd68..6e8ee4762a040c20c18f234afe8d636bf140c01d 100644 (file)
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -1975,6 +1975,9 @@ en:
     new:
       tab_title: "Log In"
       login_to_authorize_html: "Log in to OpenStreetMap to access %{client_app_name}."
+      already_logged_in_html: "You are already logged in as %{user}. Logging in again will change your current account."
+      access_another_page: "You arrived here while trying to access another page. If you want to access that page using your current account, click the button below:"
+      visit_referring_page: "Visit referring page"
       email or username: "Email Address or Username"
       password: "Password"
       remember: "Remember me"

diff --git a/test/integration/user_login_test.rb b/test/integration/login_test.rb
similarity index 99%
rename from test/integration/user_login_test.rb
rename to test/integration/login_test.rb
index a7301233d9eb2b37a9c78ca2b296bc6119c87504..2b7a851ad4fa1a3e9770861869fdc2b1372445b4 100644 (file)
--- a/test/integration/user_login_test.rb
+++ b/test/integration/login_test.rb
@@ -1,6 +1,6 @@
 require "test_helper"
 
-class UserLoginTest < ActionDispatch::IntegrationTest
+class LoginTest < ActionDispatch::IntegrationTest
   def setup
     OmniAuth.config.test_mode = true
   end

diff --git a/test/system/user_login_test.rb b/test/system/user_login_test.rb
new file mode 100644 (file)
index 0000000..ce17d04
--- /dev/null
+++ b/test/system/user_login_test.rb
@@ -0,0 +1,68 @@
+require "application_system_test_case"
+
+class UserLoginTest < ApplicationSystemTestCase
+  test "Warn on login page when already logged in" do
+    user1 = create(:user, :display_name => "First User")
+    user2 = create(:user, :display_name => "Second User")
+    sign_in_as(user1)
+
+    visit login_path
+
+    assert_button "First User"
+    within_content_body do
+      assert_text "logged in as First User"
+      assert_no_link "Visit referring page"
+    end
+
+    fill_in "username", :with => user2.email
+    fill_in "password", :with => "test"
+    click_on "Log in"
+
+    assert_button "Second User"
+  end
+
+  test "Warn on login page when already logged in with referer link" do
+    user1 = create(:user, :display_name => "First User")
+    sign_in_as(user1)
+
+    visit login_path(:referer => copyright_path, :anchor => "trademarks")
+
+    assert_button "First User"
+    within_content_body do
+      assert_text "logged in as First User"
+      assert_link "Visit referring page"
+
+      click_on "Visit referring page"
+    end
+
+    assert_current_path copyright_path
+    assert_equal "#trademarks", execute_script("return location.hash")
+  end
+
+  test "Only show safe referer links inside warnings" do
+    user1 = create(:user, :display_name => "First User")
+    sign_in_as(user1)
+
+    visit login_path(:referer => "https://example.com/")
+
+    assert_button "First User"
+    within_content_body do
+      assert_text "logged in as First User"
+      assert_no_link "Visit referring page"
+    end
+  end
+
+  test "Show OpenID form when OpenID provider button is clicked" do
+    visit login_path
+
+    within_content_body do
+      assert_no_field "OpenID URL"
+      assert_no_button "Continue"
+
+      click_on "Log in with OpenID"
+
+      assert_field "OpenID URL"
+      assert_button "Continue"
+    end
+  end
+end

diff --git a/test/system/user_signup_test.rb b/test/system/user_signup_test.rb
index 2d05447a6a280980128e605e4d4b16aee4b4eb59..5cd617e077b180181796da31b2ded7853563d792 100644 (file)
--- a/test/system/user_signup_test.rb
+++ b/test/system/user_signup_test.rb
@@ -87,18 +87,4 @@ class UserSignupTest < ApplicationSystemTestCase
       assert_content "Confirm Password"
     end
   end
-
-  test "Show OpenID form when OpenID provider button is clicked" do
-    visit login_path
-
-    within_content_body do
-      assert_no_field "OpenID URL"
-      assert_no_button "Continue"
-
-      click_on "Log in with OpenID"
-
-      assert_field "OpenID URL"
-      assert_button "Continue"
-    end
-  end
 end