diff --git a/ee/app/controllers/ee/sessions_controller.rb b/ee/app/controllers/ee/sessions_controller.rb index d078ae0e897e6634b5415045eb5b1ef41f1c0b3d..f4dd92074a68b8239090fee0130e888ee7dd9034 100644 --- a/ee/app/controllers/ee/sessions_controller.rb +++ b/ee/app/controllers/ee/sessions_controller.rb @@ -134,7 +134,9 @@ def failed_login_captcha def check_user_confirmation user = ::User.find_by_login(user_params[:login]) + return if !user || !user.valid_password?(user_params[:password]) || user.access_locked? || user.identity_verified? + return if ::Gitlab::Qa.request?(request.user_agent) service_class = ::Users::EmailVerification::SendCustomConfirmationInstructionsService return unless service_class.identity_verification_enabled?(user.email) diff --git a/ee/spec/requests/sessions_controller_spec.rb b/ee/spec/requests/sessions_controller_spec.rb index 9fc8100d34d6fec2584061b5178df070368397d8..0f7ce997ee5daf47d51df8e150f7e806e2b8c934 100644 --- a/ee/spec/requests/sessions_controller_spec.rb +++ b/ee/spec/requests/sessions_controller_spec.rb @@ -56,6 +56,14 @@ it { is_expected.not_to have_gitlab_http_status(:redirect) } end + + context 'when the user is a GitLab QA user' do + before do + allow(Gitlab::Qa).to receive(:request?).and_return(true) + end + + it { is_expected.not_to redirect_to(identity_verification_path) } + end end end end