VFRS-402

lib/jam_ruby/app/mailers/user_mailer.rb

@@ -42,7 +42,6 @@ module JamRuby
 
     def password_reset(user, password_reset_url)
       @user = user
-    #  /reset_password_token?token=#{@user.reset_password_token}&email=#{CGI.escape(@user.email)}"
       @password_reset_url = password_reset_url
       sendgrid_unique_args :type => "password_reset"
       mail(:to => user.email, :subject => "Jamkazam Password Reset") do |format|

lib/jam_ruby/models/user.rb

@@ -305,7 +305,7 @@ module JamRuby
 
     def self.set_password_from_token(email, token, new_password, new_password_confirmation)
       user = User.find_by_email(email)
-      if user.nil? || user.reset_password_token != token || Time.now - user.reset_password_token_created > 3.days
+      if user.nil? || user.reset_password_token != token || Time.now - user.reset_password_token_created > 3.days || new_password.length < 6 || new_password != new_password_confirmation
         raise JamRuby::JamArgumentError
       end
       user.reset_password_token = nil
@@ -324,7 +324,7 @@ module JamRuby
       UserMailer.password_changed(self).deliver  
     end
 
-    def self.reset_password(email, reset_password_url)
+    def self.reset_password(email, base_uri)
       user = User.find_by_email(email)
       raise JamRuby::JamArgumentError if user.nil?
 
@@ -332,7 +332,8 @@ module JamRuby
       user.reset_password_token_created = Time.now
       user.save
 
-      UserMailer.password_reset(user, reset_password_url).deliver
+      reset_url = "#{base_uri}/reset_password_token?token=#{user.reset_password_token}&email=#{CGI.escape(email)}"
+      UserMailer.password_reset(user, reset_url).deliver
       
       user
     end

spec/jam_ruby/models/user_spec.rb

@@ -191,7 +191,7 @@ describe User do
       @user.reset_password_token_created.should >= Time.now - 1.minute
     end
 
-    it "errors if the wrong token is comes in" do
+    it "errors if the wrong token comes in" do
       User.reset_password(@user.email, RESET_PASSWORD_URL)
       @user.reload
       expect { User.set_password_from_token(@user.email, "wrongtoken", "newpassword", "newpassword") }.to raise_error