Merge branch 'issue_14563' into 'master'

Fix user creation with stronger minimum password requirements ## What does this MR do? `doc/security/password_length_limits.md` Describes a way to increase minimum requirements of passwords, via `config/initializers/devise_password_length.rb`. However, user creation hardcoded password generation at 8 characters. If the minimum was set at any more than 8 characters, user creation will fail. Function now looks up minimum length requirement. ## What are the relevant issue numbers? Fixes #14563. ## Does this MR meet the acceptance criteria? - [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added - [x] [Documentation created/updated](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/doc/development/doc_styleguide.md) - Tests - [x] Added for this feature/bug - [x] All builds are passing - [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides) - [x] Branch has no merge conflicts with `master` (if you do - rebase it please) - [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits) See merge request !4054

Merge branch 'issue_14563' into 'master'
2f161208 · Rémy Coutable · 2f5e3ee6 · 64883faa · 2f161208 · 2f161208
Commit 2f161208 authored Jun 23, 2016 by Rémy Coutable
Show whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

CHANGELOG CHANGELOG +1 -0

user.rb app/models/user.rb +1 -1

No files found.
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -6,6 +6,7 @@ v 8.10.0 (unreleased)
  - Fix MR-auto-close text added to description. !4836
  - Fix pagination when sorting by columns with lots of ties (like priority)
  - Implement Subresource Integrity for CSS and JavaScript assets. This prevents malicious assets from loading in the case of a CDN compromise.
+  - Fix user creation with stronger minimum password requirements !4054 (nathan-pmt)
 v 8.9.1
  - Fix merge requests project settings help link anchor

--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -308,7 +308,7 @@ class User < ActiveRecord::Base
  def generate_password
    if self.force_random_password
-      self.password = self.password_confirmation = Devise.friendly_token.first(8)
+      self.password = self.password_confirmation = Devise.friendly_token.first(Devise.password_length.min)
    end
  end