Merge security fix into main

GHSA-mc6q-7qq6-ghg8

Author: jarednorman

lib/controllers/backend/spree/admin/user_passwords_controller.rb

@@ -24,8 +24,9 @@ def create
 
     set_flash_message(:notice, :send_instructions) if is_navigational_format?
 
-    if resource.errors.empty?
-      respond_with resource, location: admin_user_path(resource)
+    if successfully_sent?(resource)
+      location = (spree_current_user && resource.persisted?) ? admin_user_path(resource) : admin_login_path
+      respond_with resource, location: location
     else
       respond_with_navigational(resource) { render :new }
     end

lib/controllers/frontend/spree/user_passwords_controller.rb

@@ -20,7 +20,7 @@ def create
 
     set_flash_message(:notice, :send_instructions) if is_navigational_format?
 
-    if resource.errors.empty?
+    if successfully_sent?(resource)
       respond_with resource, location: spree.login_path
     else
       respond_with_navigational(resource) { render :new }

spec/controllers/spree/admin/user_passwords_controller_spec.rb

@@ -1,14 +1,45 @@
 # frozen_string_literal: true
 
 RSpec.describe Spree::Admin::UserPasswordsController, type: :controller do
-  before { @request.env["devise.mapping"] = Devise.mappings[:spree_user] }
+  before do
+    @request.env["devise.mapping"] = Devise.mappings[:spree_user]
+  end
 
   describe "#create" do
-    it "responds with success" do
+    before do
+      create(:store)
+      create(:user, email: "admin@example.com")
+    end
+
+    it "redirects to the login page" do
       post :create, params: {spree_user: {email: "admin@example.com"}}
 
       expect(assigns[:spree_user].email).to eq("admin@example.com")
-      expect(response.code).to eq("200")
+      expect(response).to have_http_status(302)
+    end
+
+    context "when the user email is not found" do
+      it "re-renders the form" do
+        post :create, params: {spree_user: {email: "unknown@example.com"}}
+
+        expect(response).to have_http_status(200)
+        expect(response).to render_template :new
+      end
+
+      context "when Devise is in paranoid mode" do
+        around do |example|
+          original_paranoid = Devise.paranoid
+          Devise.paranoid = true
+          example.run
+          Devise.paranoid = original_paranoid
+        end
+
+        it "does not reveal that the email is not found" do
+          post :create, params: {spree_user: {email: "unknown@example.com"}}
+
+          expect(response).to have_http_status(302)
+        end
+      end
     end
   end
 end

spec/controllers/spree/user_passwords_controller_spec.rb

@@ -42,4 +42,44 @@
       end
     end
   end
+
+  describe "POST create" do
+    before do
+      create(:store)
+      create(:user, email: "admin@example.com")
+    end
+
+    context "when the user email is not found" do
+      it "re-renders the form" do
+        post :create, params: {spree_user: {email: "unknown@example.com"}}
+
+        expect(response).to have_http_status(200)
+        expect(response).to render_template :new
+      end
+
+      context "when Devise is in paranoid mode" do
+        around do |example|
+          original_paranoid = Devise.paranoid
+          Devise.paranoid = true
+          example.run
+          Devise.paranoid = original_paranoid
+        end
+
+        it "does not reveal that the email is not found" do
+          post :create, params: {spree_user: {email: "unknown@example.com"}}
+
+          expect(response).to have_http_status(302)
+        end
+      end
+    end
+
+    context "when the user email is found" do
+      it "redirects back to the login page" do
+        post :create, params: {spree_user: {email: "admin@example.com"}}
+
+        expect(response).to redirect_to spree.login_path
+        expect(response).to have_http_status(302)
+      end
+    end
+  end
 end

spec/spec_helper.rb

@@ -36,4 +36,8 @@
   if Spree.solidus_gem_version < Gem::Version.new("2.11")
     config.extend Spree::TestingSupport::AuthorizationHelpers::Request, type: :system
   end
+
+  config.before(:each, type: :controller) do
+    ActionMailer::Base.default_url_options[:host] = "example.com"
+  end
 end