account_controller.rb
279 lines
| 9.1 KiB
| text/x-ruby
|
RubyLexer
Jean-Philippe Lang
|
r2064 | # Redmine - project management software | ||
|
Jean-Philippe Lang
|
r9453 | # Copyright (C) 2006-2012 Jean-Philippe Lang | ||
|
Jean-Philippe Lang
|
r330 | # | ||
| # This program is free software; you can redistribute it and/or | ||||
| # modify it under the terms of the GNU General Public License | ||||
| # as published by the Free Software Foundation; either version 2 | ||||
| # of the License, or (at your option) any later version. | ||||
Toshi MARUYAMA
|
r6780 | # | ||
|
Jean-Philippe Lang
|
r330 | # This program is distributed in the hope that it will be useful, | ||
| # but WITHOUT ANY WARRANTY; without even the implied warranty of | ||||
| # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||||
| # GNU General Public License for more details. | ||||
|
Toshi MARUYAMA
|
r6780 | # | ||
|
Jean-Philippe Lang
|
r330 | # You should have received a copy of the GNU General Public License | ||
| # along with this program; if not, write to the Free Software | ||||
| # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. | ||||
| class AccountController < ApplicationController | ||||
| helper :custom_fields | ||||
|
Toshi MARUYAMA
|
r6780 | include CustomFieldsHelper | ||
|
Jean-Philippe Lang
|
r330 | # prevents login action to be filtered by check_if_login_required application scope filter | ||
|
Jean-Philippe Lang
|
r2874 | skip_before_filter :check_if_login_required | ||
|
Jean-Philippe Lang
|
r330 | |||
| # Login request and validation | ||||
| def login | ||||
| if request.get? | ||||
Eric Davis
|
r3423 | logout_user | ||
|
Jean-Philippe Lang
|
r330 | else | ||
|
Eric Davis
|
r3424 | authenticate_user | ||
|
Jean-Philippe Lang
|
r330 | end | ||
|
Jean-Philippe Lang
|
r8791 | rescue AuthSourceException => e | ||
| logger.error "An error occured when authenticating #{params[:username]}: #{e.message}" | ||||
| render_error :message => e.message | ||||
|
Jean-Philippe Lang
|
r330 | end | ||
| # Log out current user and redirect to welcome page | ||||
| def logout | ||||
|
Eric Davis
|
r3423 | logout_user | ||
|
Jean-Philippe Lang
|
r749 | redirect_to home_url | ||
|
Jean-Philippe Lang
|
r330 | end | ||
|
Toshi MARUYAMA
|
r6780 | |||
|
Jean-Philippe Lang
|
r330 | # Enable user to choose a new password | ||
| def lost_password | ||||
|
Jean-Philippe Lang
|
r749 | redirect_to(home_url) && return unless Setting.lost_password? | ||
|
Jean-Philippe Lang
|
r330 | if params[:token] | ||
| @token = Token.find_by_action_and_value("recovery", params[:token]) | ||||
|
Jean-Philippe Lang
|
r749 | redirect_to(home_url) && return unless @token and !@token.expired? | ||
|
Jean-Philippe Lang
|
r330 | @user = @token.user | ||
| if request.post? | ||||
| @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation] | ||||
| if @user.save | ||||
| @token.destroy | ||||
| flash[:notice] = l(:notice_account_password_updated) | ||||
| redirect_to :action => 'login' | ||||
| return | ||||
|
Toshi MARUYAMA
|
r6780 | end | ||
|
Jean-Philippe Lang
|
r330 | end | ||
| render :template => "account/password_recovery" | ||||
| return | ||||
| else | ||||
| if request.post? | ||||
| user = User.find_by_mail(params[:mail]) | ||||
| # user not found in db | ||||
|
Jean-Philippe Lang
|
r3071 | (flash.now[:error] = l(:notice_account_unknown_email); return) unless user | ||
|
Jean-Philippe Lang
|
r330 | # user uses an external authentification | ||
|
Jean-Philippe Lang
|
r3071 | (flash.now[:error] = l(:notice_can_t_change_password); return) if user.auth_source_id | ||
|
Jean-Philippe Lang
|
r330 | # create a new token for password recovery | ||
| token = Token.new(:user => user, :action => "recovery") | ||||
| if token.save | ||||
|
Toshi MARUYAMA
|
r9455 | Mailer.lost_password(token).deliver | ||
|
Jean-Philippe Lang
|
r330 | flash[:notice] = l(:notice_account_lost_email_sent) | ||
| redirect_to :action => 'login' | ||||
| return | ||||
| end | ||||
| end | ||||
| end | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Jean-Philippe Lang
|
r330 | # User self-registration | ||
| def register | ||||
|
Jean-Philippe Lang
|
r1661 | redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration] | ||
|
Jean-Philippe Lang
|
r902 | if request.get? | ||
|
Jean-Philippe Lang
|
r1661 | session[:auth_source_registration] = nil | ||
|
Jean-Philippe Lang
|
r902 | @user = User.new(:language => Setting.default_language) | ||
|
Jean-Philippe Lang
|
r330 | else | ||
|
Jean-Philippe Lang
|
r8664 | @user = User.new | ||
| @user.safe_attributes = params[:user] | ||||
|
Jean-Philippe Lang
|
r902 | @user.admin = false | ||
|
Eric Davis
|
r3792 | @user.register | ||
|
Jean-Philippe Lang
|
r1661 | if session[:auth_source_registration] | ||
|
Eric Davis
|
r3792 | @user.activate | ||
|
Jean-Philippe Lang
|
r1661 | @user.login = session[:auth_source_registration][:login] | ||
| @user.auth_source_id = session[:auth_source_registration][:auth_source_id] | ||||
|
Jean-Philippe Lang
|
r902 | if @user.save | ||
|
Jean-Philippe Lang
|
r1661 | session[:auth_source_registration] = nil | ||
|
Jean-Philippe Lang
|
r1507 | self.logged_user = @user | ||
|
Jean-Philippe Lang
|
r902 | flash[:notice] = l(:notice_account_activated) | ||
|
Jean-Philippe Lang
|
r1507 | redirect_to :controller => 'my', :action => 'account' | ||
|
Jean-Philippe Lang
|
r902 | end | ||
| else | ||||
|
Jean-Philippe Lang
|
r1661 | @user.login = params[:user][:login] | ||
|
Jean-Philippe Lang
|
r8662 | @user.password, @user.password_confirmation = params[:user][:password], params[:user][:password_confirmation] | ||
|
Eric Davis
|
r2386 | |||
|
Jean-Philippe Lang
|
r1661 | case Setting.self_registration | ||
| when '1' | ||||
|
Eric Davis
|
r2386 | register_by_email_activation(@user) | ||
|
Jean-Philippe Lang
|
r1661 | when '3' | ||
|
Eric Davis
|
r2386 | register_automatically(@user) | ||
|
Jean-Philippe Lang
|
r1661 | else | ||
|
Eric Davis
|
r2386 | register_manually_by_administrator(@user) | ||
|
Jean-Philippe Lang
|
r330 | end | ||
| end | ||||
| end | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Jean-Philippe Lang
|
r902 | # Token based account activation | ||
| def activate | ||||
| redirect_to(home_url) && return unless Setting.self_registration? && params[:token] | ||||
| token = Token.find_by_action_and_value('register', params[:token]) | ||||
| redirect_to(home_url) && return unless token and !token.expired? | ||||
| user = token.user | ||||
|
Eric Davis
|
r3792 | redirect_to(home_url) && return unless user.registered? | ||
| user.activate | ||||
|
Jean-Philippe Lang
|
r902 | if user.save | ||
| token.destroy | ||||
| flash[:notice] = l(:notice_account_activated) | ||||
| end | ||||
| redirect_to :action => 'login' | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Jean-Philippe Lang
|
r2460 | private | ||
|
Toshi MARUYAMA
|
r6780 | |||
|
Eric Davis
|
r3424 | def authenticate_user | ||
| if Setting.openid? && using_open_id? | ||||
| open_id_authenticate(params[:openid_url]) | ||||
| else | ||||
| password_authentication | ||||
| end | ||||
| end | ||||
|
Eric Davis
|
r2381 | def password_authentication | ||
| user = User.try_to_login(params[:username], params[:password]) | ||||
|
Eric Davis
|
r3095 | |||
|
Eric Davis
|
r2381 | if user.nil? | ||
|
Eric Davis
|
r3095 | invalid_credentials | ||
|
Eric Davis
|
r2381 | elsif user.new_record? | ||
|
Eric Davis
|
r3094 | onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id }) | ||
|
Eric Davis
|
r2381 | else | ||
| # Valid user | ||||
| successful_authentication(user) | ||||
| end | ||||
| end | ||||
| def open_id_authenticate(openid_url) | ||||
|
Jean-Philippe Lang
|
r9396 | authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url, :method => :post) do |result, identity_url, registration| | ||
|
Eric Davis
|
r2381 | if result.successful? | ||
| user = User.find_or_initialize_by_identity_url(identity_url) | ||||
| if user.new_record? | ||||
|
Eric Davis
|
r2387 | # Self-registration off | ||
| redirect_to(home_url) && return unless Setting.self_registration? | ||||
|
Eric Davis
|
r2381 | # Create on the fly | ||
|
Eric Davis
|
r2384 | user.login = registration['nickname'] unless registration['nickname'].nil? | ||
| user.mail = registration['email'] unless registration['email'].nil? | ||||
| user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil? | ||||
|
Eric Davis
|
r2382 | user.random_password | ||
|
Eric Davis
|
r3792 | user.register | ||
|
Eric Davis
|
r2385 | |||
| case Setting.self_registration | ||||
| when '1' | ||||
|
Eric Davis
|
r2386 | register_by_email_activation(user) do | ||
|
Eric Davis
|
r2421 | onthefly_creation_failed(user) | ||
|
Eric Davis
|
r2385 | end | ||
| when '3' | ||||
|
Eric Davis
|
r2386 | register_automatically(user) do | ||
|
Eric Davis
|
r2421 | onthefly_creation_failed(user) | ||
|
Eric Davis
|
r2385 | end | ||
|
Eric Davis
|
r2382 | else | ||
|
Eric Davis
|
r2386 | register_manually_by_administrator(user) do | ||
|
Eric Davis
|
r2421 | onthefly_creation_failed(user) | ||
|
Eric Davis
|
r2385 | end | ||
|
Toshi MARUYAMA
|
r6780 | end | ||
|
Eric Davis
|
r2381 | else | ||
|
Eric Davis
|
r2382 | # Existing record | ||
|
Eric Davis
|
r2420 | if user.active? | ||
| successful_authentication(user) | ||||
| else | ||||
| account_pending | ||||
| end | ||||
|
Eric Davis
|
r2381 | end | ||
| end | ||||
| end | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Eric Davis
|
r2381 | def successful_authentication(user) | ||
| # Valid user | ||||
| self.logged_user = user | ||||
| # generate a key and set cookie if autologin | ||||
| if params[:autologin] && Setting.autologin? | ||||
|
Jean-Philippe Lang
|
r4636 | set_autologin_cookie(user) | ||
|
Eric Davis
|
r2381 | end | ||
|
Eric Davis
|
r2533 | call_hook(:controller_account_success_authentication_after, {:user => user }) | ||
|
Eric Davis
|
r2381 | redirect_back_or_default :controller => 'my', :action => 'page' | ||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Jean-Philippe Lang
|
r4636 | def set_autologin_cookie(user) | ||
| token = Token.create(:user => user, :action => 'autologin') | ||||
| cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin' | ||||
| cookie_options = { | ||||
| :value => token.value, | ||||
| :expires => 1.year.from_now, | ||||
| :path => (Redmine::Configuration['autologin_cookie_path'] || '/'), | ||||
|
Jean-Philippe Lang
|
r4637 | :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false), | ||
| :httponly => true | ||||
|
Jean-Philippe Lang
|
r4636 | } | ||
| cookies[cookie_name] = cookie_options | ||||
| end | ||||
|
Eric Davis
|
r2381 | |||
|
Eric Davis
|
r2385 | # Onthefly creation failed, display the registration form to fill/fix attributes | ||
| def onthefly_creation_failed(user, auth_source_options = { }) | ||||
| @user = user | ||||
| session[:auth_source_registration] = auth_source_options unless auth_source_options.empty? | ||||
| render :action => 'register' | ||||
| end | ||||
|
Eric Davis
|
r3095 | def invalid_credentials | ||
|
Eric Davis
|
r3297 | logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}" | ||
|
Eric Davis
|
r3095 | flash.now[:error] = l(:notice_account_invalid_creditentials) | ||
| end | ||||
|
Eric Davis
|
r2386 | # Register a user for email activation. | ||
| # | ||||
| # Pass a block for behavior when a user fails to save | ||||
| def register_by_email_activation(user, &block) | ||||
| token = Token.new(:user => user, :action => "register") | ||||
| if user.save and token.save | ||||
|
Toshi MARUYAMA
|
r9455 | Mailer.register(token).deliver | ||
|
Eric Davis
|
r2386 | flash[:notice] = l(:notice_account_register_done) | ||
| redirect_to :action => 'login' | ||||
| else | ||||
| yield if block_given? | ||||
| end | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Eric Davis
|
r2386 | # Automatically register a user | ||
| # | ||||
| # Pass a block for behavior when a user fails to save | ||||
| def register_automatically(user, &block) | ||||
| # Automatic activation | ||||
|
Eric Davis
|
r3792 | user.activate | ||
|
Jean-Philippe Lang
|
r2526 | user.last_login_on = Time.now | ||
|
Eric Davis
|
r2386 | if user.save | ||
| self.logged_user = user | ||||
| flash[:notice] = l(:notice_account_activated) | ||||
| redirect_to :controller => 'my', :action => 'account' | ||||
| else | ||||
| yield if block_given? | ||||
| end | ||||
| end | ||||
|
Toshi MARUYAMA
|
r6780 | |||
|
Eric Davis
|
r2386 | # Manual activation by the administrator | ||
| # | ||||
| # Pass a block for behavior when a user fails to save | ||||
| def register_manually_by_administrator(user, &block) | ||||
| if user.save | ||||
| # Sends an email to the administrators | ||||
|
Toshi MARUYAMA
|
r9455 | Mailer.account_activation_request(user).deliver | ||
|
Eric Davis
|
r2420 | account_pending | ||
|
Eric Davis
|
r2386 | else | ||
| yield if block_given? | ||||
| end | ||||
| end | ||||
|
Eric Davis
|
r2420 | |||
| def account_pending | ||||
| flash[:notice] = l(:notice_account_pending) | ||||
| redirect_to :action => 'login' | ||||
| end | ||||
|
Jean-Philippe Lang
|
r2 | end | ||