jro_apps/redmine Commit - r3047:21b52d2fd968

1

# Redmine - project management software

1

# Redmine - project management software

2

3

#

3

#

4

# This program is free software; you can redistribute it and/or

4

# This program is free software; you can redistribute it and/or

5

# modify it under the terms of the GNU General Public License

5

# modify it under the terms of the GNU General Public License

6

# as published by the Free Software Foundation; either version 2

6

# as published by the Free Software Foundation; either version 2

7

# of the License, or (at your option) any later version.

7

# of the License, or (at your option) any later version.

8

#

8

#

9

# This program is distributed in the hope that it will be useful,

9

# This program is distributed in the hope that it will be useful,

10

# but WITHOUT ANY WARRANTY; without even the implied warranty of

10

# but WITHOUT ANY WARRANTY; without even the implied warranty of

11

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

11

# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

12

# GNU General Public License for more details.

12

# GNU General Public License for more details.

13

#

13

#

14

# You should have received a copy of the GNU General Public License

14

# You should have received a copy of the GNU General Public License

15

# along with this program; if not, write to the Free Software

15

# along with this program; if not, write to the Free Software

16

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

16

# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

17

18

require "digest/sha1"

18

require "digest/sha1"

19

20

class User < Principal

20

class User < Principal

21

22

# Account statuses

22

# Account statuses

23

STATUS_ANONYMOUS = 0

23

STATUS_ANONYMOUS = 0

24

STATUS_ACTIVE = 1

24

STATUS_ACTIVE = 1

25

STATUS_REGISTERED = 2

25

STATUS_REGISTERED = 2

26

STATUS_LOCKED = 3

26

STATUS_LOCKED = 3

27

28

USER_FORMATS = {

28

USER_FORMATS = {

29

:firstname_lastname => '#{firstname} #{lastname}',

29

:firstname_lastname => '#{firstname} #{lastname}',

30

:firstname => '#{firstname}',

30

:firstname => '#{firstname}',

31

:lastname_firstname => '#{lastname} #{firstname}',

31

:lastname_firstname => '#{lastname} #{firstname}',

32

:lastname_coma_firstname => '#{lastname}, #{firstname}',

32

:lastname_coma_firstname => '#{lastname}, #{firstname}',

33

:username => '#{login}'

33

:username => '#{login}'

34

}

34

}

35

36

has_and_belongs_to_many :groups, :after_add => Proc.new {|user, group| group.user_added(user)},

36

has_and_belongs_to_many :groups, :after_add => Proc.new {|user, group| group.user_added(user)},

37

:after_remove => Proc.new {|user, group| group.user_removed(user)}

37

:after_remove => Proc.new {|user, group| group.user_removed(user)}

38

has_many :issue_categories, :foreign_key => 'assigned_to_id', :dependent => :nullify

38

has_many :issue_categories, :foreign_key => 'assigned_to_id', :dependent => :nullify

39

has_many :changesets, :dependent => :nullify

39

has_many :changesets, :dependent => :nullify

40

has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'

40

has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'

41

has_one :rss_token, :dependent => :destroy, :class_name => 'Token', :conditions => "action='feeds'"

41

has_one :rss_token, :dependent => :destroy, :class_name => 'Token', :conditions => "action='feeds'"

42

belongs_to :auth_source

42

belongs_to :auth_source

43

44

# Active non-anonymous users scope

44

# Active non-anonymous users scope

45

named_scope :active, :conditions => "#{User.table_name}.status = #{STATUS_ACTIVE}"

45

named_scope :active, :conditions => "#{User.table_name}.status = #{STATUS_ACTIVE}"

46

47

acts_as_customizable

47

acts_as_customizable

48

49

attr_accessor :password, :password_confirmation

49

attr_accessor :password, :password_confirmation

50

attr_accessor :last_before_login_on

50

attr_accessor :last_before_login_on

51

# Prevents unauthorized assignments

51

# Prevents unauthorized assignments

52

attr_protected :login, :admin, :password, :password_confirmation, :hashed_password, :group_ids

52

attr_protected :login, :admin, :password, :password_confirmation, :hashed_password, :group_ids

53

54

validates_presence_of :login, :firstname, :lastname, :mail, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }

54

validates_presence_of :login, :firstname, :lastname, :mail, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }

55

validates_uniqueness_of :login, :if => Proc.new { |user| !user.login.blank? }

55

validates_uniqueness_of :login, :if => Proc.new { |user| !user.login.blank? }

56

validates_uniqueness_of :mail, :if => Proc.new { |user| !user.mail.blank? }, :case_sensitive => false

56

validates_uniqueness_of :mail, :if => Proc.new { |user| !user.mail.blank? }, :case_sensitive => false

57

# Login must contain lettres, numbers, underscores only

57

# Login must contain lettres, numbers, underscores only

58

validates_format_of :login, :with => /^[a-z0-9_\-@\.]*$/i

58

validates_format_of :login, :with => /^[a-z0-9_\-@\.]*$/i

59

validates_length_of :login, :maximum => 30

59

validates_length_of :login, :maximum => 30

60

validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-\.]*$/i

60

validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-\.]*$/i

61

validates_length_of :firstname, :lastname, :maximum => 30

61

validates_length_of :firstname, :lastname, :maximum => 30

62

validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :allow_nil => true

62

validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :allow_nil => true

63

validates_length_of :mail, :maximum => 60, :allow_nil => true

63

validates_length_of :mail, :maximum => 60, :allow_nil => true

64

validates_confirmation_of :password, :allow_nil => true

64

validates_confirmation_of :password, :allow_nil => true

65

66

def before_create

66

def before_create

67

self.mail_notification = false

67

self.mail_notification = false

68

true

68

true

69

end

69

end

70

71

def before_save

71

def before_save

72

# update hashed_password if password was set

72

# update hashed_password if password was set

73

self.hashed_password = User.hash_password(self.password) if self.password

73

self.hashed_password = User.hash_password(self.password) if self.password

74

end

74

end

75

76

def reload(*args)

76

def reload(*args)

77

@name = nil

77

@name = nil

78

super

78

super

79

end

79

end

80

81

def identity_url=(url)

81

def identity_url=(url)

82

if url.blank?

82

if url.blank?

83

write_attribute(:identity_url, '')

83

write_attribute(:identity_url, '')

84

else

84

else

85

begin

85

begin

86

write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))

86

write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))

87

rescue OpenIdAuthentication::InvalidOpenId

87

rescue OpenIdAuthentication::InvalidOpenId

88

# Invlaid url, don't save

88

# Invlaid url, don't save

89

end

89

end

90

end

90

end

91

self.read_attribute(:identity_url)

91

self.read_attribute(:identity_url)

92

end

92

end

93

94

# Returns the user that matches provided login and password, or nil

94

# Returns the user that matches provided login and password, or nil

95

def self.try_to_login(login, password)

95

def self.try_to_login(login, password)

96

# Make sure no one can sign in with an empty password

96

# Make sure no one can sign in with an empty password

97

return nil if password.to_s.empty?

97

return nil if password.to_s.empty?

98

user = find(:first, :conditions => ["login=?", login])

98

user = find(:first, :conditions => ["login=?", login])

99

if user

99

if user

100

# user is already in local database

100

# user is already in local database

101

return nil if !user.active?

101

return nil if !user.active?

102

if user.auth_source

102

if user.auth_source

103

# user has an external authentication method

103

# user has an external authentication method

104

return nil unless user.auth_source.authenticate(login, password)

104

return nil unless user.auth_source.authenticate(login, password)

105

else

105

else

106

# authentication with local password

106

# authentication with local password

107

return nil unless User.hash_password(password) == user.hashed_password

107

return nil unless User.hash_password(password) == user.hashed_password

108

end

108

end

109

else

109

else

110

# user is not yet registered, try to authenticate with available sources

110

# user is not yet registered, try to authenticate with available sources

111

attrs = AuthSource.authenticate(login, password)

111

attrs = AuthSource.authenticate(login, password)

112

if attrs

112

if attrs

113

user = new(*attrs)

113

user = new(*attrs)

114

user.login = login

114

user.login = login

115

user.language = Setting.default_language

115

user.language = Setting.default_language

116

if user.save

116

if user.save

117

user.reload

117

user.reload

118

logger.info("User '#{user.login}' created from the LDAP") if logger

118

logger.info("User '#{user.login}' created from the LDAP") if logger

119

end

119

end

120

end

120

end

121

end

121

end

122

user.update_attribute(:last_login_on, Time.now) if user && !user.new_record?

122

user.update_attribute(:last_login_on, Time.now) if user && !user.new_record?

123

user

123

user

124

rescue => text

124

rescue => text

125

raise text

125

raise text

126

end

126

end

127

128

# Returns the user who matches the given autologin +key+ or nil

128

# Returns the user who matches the given autologin +key+ or nil

129

def self.try_to_autologin(key)

129

def self.try_to_autologin(key)

130

tokens = Token.find_all_by_action_and_value('autologin', key)

130

tokens = Token.find_all_by_action_and_value('autologin', key)

131

# Make sure there's only 1 token that matches the key

131

# Make sure there's only 1 token that matches the key

132

if tokens.size == 1

132

if tokens.size == 1

133

token = tokens.first

133

token = tokens.first

134

if (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?

134

if (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?

135

token.user.update_attribute(:last_login_on, Time.now)

135

token.user.update_attribute(:last_login_on, Time.now)

136

token.user

136

token.user

137

end

137

end

138

end

138

end

139

end

139

end

140

141

# Return user's full name for display

141

# Return user's full name for display

142

def name(formatter = nil)

142

def name(formatter = nil)

143

if formatter

143

if formatter

144

eval('"' + (USER_FORMATS[formatter] || USER_FORMATS[:firstname_lastname]) + '"')

144

eval('"' + (USER_FORMATS[formatter] || USER_FORMATS[:firstname_lastname]) + '"')

145

else

145

else

146

@name ||= eval('"' + (USER_FORMATS[Setting.user_format] || USER_FORMATS[:firstname_lastname]) + '"')

146

@name ||= eval('"' + (USER_FORMATS[Setting.user_format] || USER_FORMATS[:firstname_lastname]) + '"')

147

end

147

end

148

end

148

end

149

150

def active?

150

def active?

151

self.status == STATUS_ACTIVE

151

self.status == STATUS_ACTIVE

152

end

152

end

153

154

def registered?

154

def registered?

155

self.status == STATUS_REGISTERED

155

self.status == STATUS_REGISTERED

156

end

156

end

157

158

def locked?

158

def locked?

159

self.status == STATUS_LOCKED

159

self.status == STATUS_LOCKED

160

end

160

end

161

162

def check_password?(clear_password)

162

def check_password?(clear_password)

163

User.hash_password(clear_password) == self.hashed_password

163

User.hash_password(clear_password) == self.hashed_password

164

end

164

end

165

166

# Generate and set a random password. Useful for automated user creation

166

# Generate and set a random password. Useful for automated user creation

167

# Based on Token#generate_token_value

167

# Based on Token#generate_token_value

168

#

168

#

169

def random_password

169

def random_password

170

chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a

170

chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a

171

password = ''

171

password = ''

172

40.times { |i| password << chars[rand(chars.size-1)] }

172

40.times { |i| password << chars[rand(chars.size-1)] }

173

self.password = password

173

self.password = password

174

self.password_confirmation = password

174

self.password_confirmation = password

175

self

175

self

176

end

176

end

177

178

def pref

178

def pref

179

self.preference ||= UserPreference.new(:user => self)

179

self.preference ||= UserPreference.new(:user => self)

180

end

180

end

181

182

def time_zone

182

def time_zone

183

@time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])

183

@time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])

184

end

184

end

185

186

def wants_comments_in_reverse_order?

186

def wants_comments_in_reverse_order?

187

self.pref[:comments_sorting] == 'desc'

187

self.pref[:comments_sorting] == 'desc'

188

end

188

end

189

190

# Return user's RSS key (a 40 chars long string), used to access feeds

190

# Return user's RSS key (a 40 chars long string), used to access feeds

191

def rss_key

191

def rss_key

192

token = self.rss_token || Token.create(:user => self, :action => 'feeds')

192

token = self.rss_token || Token.create(:user => self, :action => 'feeds')

193

token.value

193

token.value

194

end

194

end

195

196

# Return an array of project ids for which the user has explicitly turned mail notifications on

196

# Return an array of project ids for which the user has explicitly turned mail notifications on

197

def notified_projects_ids

197

def notified_projects_ids

198

@notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)

198

@notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)

199

end

199

end

200

201

def notified_project_ids=(ids)

201

def notified_project_ids=(ids)

202

Member.update_all("mail_notification = #{connection.quoted_false}", ['user_id = ?', id])

202

Member.update_all("mail_notification = #{connection.quoted_false}", ['user_id = ?', id])

203

Member.update_all("mail_notification = #{connection.quoted_true}", ['user_id = ? AND project_id IN (?)', id, ids]) if ids && !ids.empty?

203

Member.update_all("mail_notification = #{connection.quoted_true}", ['user_id = ? AND project_id IN (?)', id, ids]) if ids && !ids.empty?

204

@notified_projects_ids = nil

204

@notified_projects_ids = nil

205

notified_projects_ids

205

notified_projects_ids

206

end

206

end

207

208

def self.find_by_rss_key(key)

208

def self.find_by_rss_key(key)

209

token = Token.find_by_value(key)

209

token = Token.find_by_value(key)

210

token && token.user.active? ? token.user : nil

210

token && token.user.active? ? token.user : nil

211

end

211

end

212

213

# Makes find_by_mail case-insensitive

213

# Makes find_by_mail case-insensitive

214

def self.find_by_mail(mail)

214

def self.find_by_mail(mail)

215

find(:first, :conditions => ["LOWER(mail) = ?", mail.to_s.downcase])

215

find(:first, :conditions => ["LOWER(mail) = ?", mail.to_s.downcase])

216

end

216

end

217

218

# Sort users by their display names

219

def <=>(user)

220

self.to_s.downcase <=> user.to_s.downcase

221

end

222

217

223

def to_s

218

def to_s

224

name

219

name

225

end

220

end

226

221

227

# Returns the current day according to user's time zone

222

# Returns the current day according to user's time zone

228

def today

223

def today

229

if time_zone.nil?

224

if time_zone.nil?

230

Date.today

225

Date.today

231

else

226

else

232

Time.now.in_time_zone(time_zone).to_date

227

Time.now.in_time_zone(time_zone).to_date

233

end

228

end

234

end

229

end

235

230

236

def logged?

231

def logged?

237

true

232

true

238

end

233

end

239

234

240

def anonymous?

235

def anonymous?

241

!logged?

236

!logged?

242

end

237

end

243

238

244

# Return user's roles for project

239

# Return user's roles for project

245

def roles_for_project(project)

240

def roles_for_project(project)

246

roles = []

241

roles = []

247

# No role on archived projects

242

# No role on archived projects

248

return roles unless project && project.active?

243

return roles unless project && project.active?

249

if logged?

244

if logged?

250

# Find project membership

245

# Find project membership

251

membership = memberships.detect {|m| m.project_id == project.id}

246

membership = memberships.detect {|m| m.project_id == project.id}

252

if membership

247

if membership

253

roles = membership.roles

248

roles = membership.roles

254

else

249

else

255

@role_non_member ||= Role.non_member

250

@role_non_member ||= Role.non_member

256

roles << @role_non_member

251

roles << @role_non_member

257

end

252

end

258

else

253

else

259

@role_anonymous ||= Role.anonymous

254

@role_anonymous ||= Role.anonymous

260

roles << @role_anonymous

255

roles << @role_anonymous

261

end

256

end

262

roles

257

roles

263

end

258

end

264

259

265

# Return true if the user is a member of project

260

# Return true if the user is a member of project

266

def member_of?(project)

261

def member_of?(project)

267

!roles_for_project(project).detect {|role| role.member?}.nil?

262

!roles_for_project(project).detect {|role| role.member?}.nil?

268

end

263

end

269

264

270

# Return true if the user is allowed to do the specified action on project

265

# Return true if the user is allowed to do the specified action on project

271

# action can be:

266

# action can be:

272

# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')

267

# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')

273

# * a permission Symbol (eg. :edit_project)

268

# * a permission Symbol (eg. :edit_project)

274

def allowed_to?(action, project, options={})

269

def allowed_to?(action, project, options={})

275

if project

270

if project

276

# No action allowed on archived projects

271

# No action allowed on archived projects

277

return false unless project.active?

272

return false unless project.active?

278

# No action allowed on disabled modules

273

# No action allowed on disabled modules

279

return false unless project.allows_to?(action)

274

return false unless project.allows_to?(action)

280

# Admin users are authorized for anything else

275

# Admin users are authorized for anything else

281

return true if admin?

276

return true if admin?

282

277

283

roles = roles_for_project(project)

278

roles = roles_for_project(project)

284

return false unless roles

279

return false unless roles

285

roles.detect {|role| (project.is_public? || role.member?) && role.allowed_to?(action)}

280

roles.detect {|role| (project.is_public? || role.member?) && role.allowed_to?(action)}

286

281

287

elsif options[:global]

282

elsif options[:global]

288

# Admin users are always authorized

283

# Admin users are always authorized

289

return true if admin?

284

return true if admin?

290

285

291

# authorize if user has at least one role that has this permission

286

# authorize if user has at least one role that has this permission

292

roles = memberships.collect {|m| m.roles}.flatten.uniq

287

roles = memberships.collect {|m| m.roles}.flatten.uniq

293

roles.detect {|r| r.allowed_to?(action)} || (self.logged? ? Role.non_member.allowed_to?(action) : Role.anonymous.allowed_to?(action))

288

roles.detect {|r| r.allowed_to?(action)} || (self.logged? ? Role.non_member.allowed_to?(action) : Role.anonymous.allowed_to?(action))

294

else

289

else

295

false

290

false

296

end

291

end

297

end

292

end

298

293

299

def self.current=(user)

294

def self.current=(user)

300

@current_user = user

295

@current_user = user

301

end

296

end

302

297

303

def self.current

298

def self.current

304

@current_user ||= User.anonymous

299

@current_user ||= User.anonymous

305

end

300

end

306

301

307

# Returns the anonymous user. If the anonymous user does not exist, it is created. There can be only

302

# Returns the anonymous user. If the anonymous user does not exist, it is created. There can be only

308

# one anonymous user per database.

303

# one anonymous user per database.

309

def self.anonymous

304

def self.anonymous

310

anonymous_user = AnonymousUser.find(:first)

305

anonymous_user = AnonymousUser.find(:first)

311

if anonymous_user.nil?

306

if anonymous_user.nil?

312

anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :mail => '', :login => '', :status => 0)

307

anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :mail => '', :login => '', :status => 0)

313

raise 'Unable to create the anonymous user.' if anonymous_user.new_record?

308

raise 'Unable to create the anonymous user.' if anonymous_user.new_record?

314

end

309

end

315

anonymous_user

310

anonymous_user

316

end

311

end

317

312

318

protected

313

protected

319

314

320

def validate

315

def validate

321

# Password length validation based on setting

316

# Password length validation based on setting

322

if !password.nil? && password.size < Setting.password_min_length.to_i

317

if !password.nil? && password.size < Setting.password_min_length.to_i

323

errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)

318

errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)

324

end

319

end

325

end

320

end

326

321

327

private

322

private

328

323

329

# Return password digest

324

# Return password digest

330

def self.hash_password(clear_password)

325

def self.hash_password(clear_password)

331

Digest::SHA1.hexdigest(clear_password || "")

326

Digest::SHA1.hexdigest(clear_password || "")

332

end

327

end

333

end

328

end

334

329

335

class AnonymousUser < User

330

class AnonymousUser < User

336

331

337

def validate_on_create

332

def validate_on_create

338

# There should be only one AnonymousUser in the database

333

# There should be only one AnonymousUser in the database

339

errors.add_to_base 'An anonymous user already exists.' if AnonymousUser.find(:first)

334

errors.add_to_base 'An anonymous user already exists.' if AnonymousUser.find(:first)

340

end

335

end

341

336

342

def available_custom_fields

337

def available_custom_fields

343

[]

338

[]

344

end

339

end

345

340

346

# Overrides a few properties

341

# Overrides a few properties

347

def logged?; false end

342

def logged?; false end

348

def admin; false end

343

def admin; false end

349

def name(*args); I18n.t(:label_user_anonymous) end

344

def name(*args); I18n.t(:label_user_anonymous) end

350

def mail; nil end

345

def mail; nil end

351

def time_zone; nil end

346

def time_zone; nil end

352

def rss_key; nil end

347

def rss_key; nil end

353

end

348

end

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages

             # Redmine - project management software
             # Copyright (C) 2006-2009  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class Principal < ActiveRecord::Base
               set_table_name 'users'
               has_many :members, :foreign_key => 'user_id', :dependent => :destroy
               has_many :memberships, :class_name => 'Member', :foreign_key => 'user_id', :include => [ :project, :roles ], :conditions => "#{Project.table_name}.status=#{Project::STATUS_ACTIVE}", :order => "#{Project.table_name}.name"
               has_many :projects, :through => :memberships
               # Groups and active users
               named_scope :active, :conditions => "#{Principal.table_name}.type='Group' OR (#{Principal.table_name}.type='User' AND #{Principal.table_name}.status = 1)"
               named_scope :like, lambda {|q|
                 s = "%#{q.to_s.strip.downcase}%"
                 {:conditions => ["LOWER(login) LIKE :s OR LOWER(firstname) LIKE :s OR LOWER(lastname) LIKE :s OR LOWER(mail) LIKE :s", {:s => s}],
                  :order => 'type, login, lastname, firstname, mail'
                 }
               }
               def <=>(principal)
-                self.to_s.downcase <=> principal.to_s.downcase
+                if self.class.name == principal.class.name
+                  self.to_s.downcase <=> principal.to_s.downcase
+                else
+                  # groups after users
+                  principal.class.name <=> self.class.name
+                end
               end
             end

             # Redmine - project management software
             # Copyright (C) 2006-2009  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             require "digest/sha1"
             class User < Principal
               # Account statuses
               STATUS_ANONYMOUS  = 0
               STATUS_ACTIVE     = 1
               STATUS_REGISTERED = 2
               STATUS_LOCKED     = 3
               USER_FORMATS = {
                 :firstname_lastname => '#{firstname} #{lastname}',
                 :firstname => '#{firstname}',
                 :lastname_firstname => '#{lastname} #{firstname}',
                 :lastname_coma_firstname => '#{lastname}, #{firstname}',
                 :username => '#{login}'
               }
               has_and_belongs_to_many :groups, :after_add => Proc.new {|user, group| group.user_added(user)},
                                                :after_remove => Proc.new {|user, group| group.user_removed(user)}
               has_many :issue_categories, :foreign_key => 'assigned_to_id', :dependent => :nullify
               has_many :changesets, :dependent => :nullify
               has_one :preference, :dependent => :destroy, :class_name => 'UserPreference'
               has_one :rss_token, :dependent => :destroy, :class_name => 'Token', :conditions => "action='feeds'"
               belongs_to :auth_source
               # Active non-anonymous users scope
               named_scope :active, :conditions => "#{User.table_name}.status = #{STATUS_ACTIVE}"
               acts_as_customizable
               attr_accessor :password, :password_confirmation
               attr_accessor :last_before_login_on
               # Prevents unauthorized assignments
               attr_protected :login, :admin, :password, :password_confirmation, :hashed_password, :group_ids
               validates_presence_of :login, :firstname, :lastname, :mail, :if => Proc.new { |user| !user.is_a?(AnonymousUser) }
               validates_uniqueness_of :login, :if => Proc.new { |user| !user.login.blank? }
               validates_uniqueness_of :mail, :if => Proc.new { |user| !user.mail.blank? }, :case_sensitive => false
               # Login must contain lettres, numbers, underscores only
               validates_format_of :login, :with => /^[a-z0-9_\-@\.]*$/i
               validates_length_of :login, :maximum => 30
               validates_format_of :firstname, :lastname, :with => /^[\w\s\'\-\.]*$/i
               validates_length_of :firstname, :lastname, :maximum => 30
               validates_format_of :mail, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :allow_nil => true
               validates_length_of :mail, :maximum => 60, :allow_nil => true
               validates_confirmation_of :password, :allow_nil => true
               def before_create
                 self.mail_notification = false
                 true
               end
               def before_save
                 # update hashed_password if password was set
                 self.hashed_password = User.hash_password(self.password) if self.password
               end
               def reload(*args)
                 @name = nil
                 super
               end
               def identity_url=(url)
                 if url.blank?
                   write_attribute(:identity_url, '')
                 else
                   begin
                     write_attribute(:identity_url, OpenIdAuthentication.normalize_identifier(url))
                   rescue OpenIdAuthentication::InvalidOpenId
                     # Invlaid url, don't save
                   end
                 end
                 self.read_attribute(:identity_url)
               end
               # Returns the user that matches provided login and password, or nil
               def self.try_to_login(login, password)
                 # Make sure no one can sign in with an empty password
                 return nil if password.to_s.empty?
                 user = find(:first, :conditions => ["login=?", login])
                 if user
                   # user is already in local database
                   return nil if !user.active?
                   if user.auth_source
                     # user has an external authentication method
                     return nil unless user.auth_source.authenticate(login, password)
                   else
                     # authentication with local password
                     return nil unless User.hash_password(password) == user.hashed_password
                   end
                 else
                   # user is not yet registered, try to authenticate with available sources
                   attrs = AuthSource.authenticate(login, password)
                   if attrs
                     user = new(*attrs)
                     user.login = login
                     user.language = Setting.default_language
                     if user.save
                       user.reload
                       logger.info("User '#{user.login}' created from the LDAP") if logger
                     end
                   end
                 end
                 user.update_attribute(:last_login_on, Time.now) if user && !user.new_record?
                 user
               rescue => text
                 raise text
               end
               # Returns the user who matches the given autologin +key+ or nil
               def self.try_to_autologin(key)
                 tokens = Token.find_all_by_action_and_value('autologin', key)
                 # Make sure there's only 1 token that matches the key
                 if tokens.size == 1
                   token = tokens.first
                   if (token.created_on > Setting.autologin.to_i.day.ago) && token.user && token.user.active?
                     token.user.update_attribute(:last_login_on, Time.now)
                     token.user
                   end
                 end
               end
               # Return user's full name for display
               def name(formatter = nil)
                 if formatter
                   eval('"' + (USER_FORMATS[formatter] || USER_FORMATS[:firstname_lastname]) + '"')
                 else
                   @name ||= eval('"' + (USER_FORMATS[Setting.user_format] || USER_FORMATS[:firstname_lastname]) + '"')
                 end
               end
               def active?
                 self.status == STATUS_ACTIVE
               end
               def registered?
                 self.status == STATUS_REGISTERED
               end
               def locked?
                 self.status == STATUS_LOCKED
               end
               def check_password?(clear_password)
                 User.hash_password(clear_password) == self.hashed_password
               end
               # Generate and set a random password.  Useful for automated user creation
               # Based on Token#generate_token_value
               #
               def random_password
                 chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
                 password = ''
 .times { |i| password << chars[rand(chars.size-1)] }
                 self.password = password
                 self.password_confirmation = password
                 self
               end
               def pref
                 self.preference ||= UserPreference.new(:user => self)
               end
               def time_zone
                 @time_zone ||= (self.pref.time_zone.blank? ? nil : ActiveSupport::TimeZone[self.pref.time_zone])
               end
               def wants_comments_in_reverse_order?
                 self.pref[:comments_sorting] == 'desc'
               end
               # Return user's RSS key (a 40 chars long string), used to access feeds
               def rss_key
                 token = self.rss_token || Token.create(:user => self, :action => 'feeds')
                 token.value
               end
               # Return an array of project ids for which the user has explicitly turned mail notifications on
               def notified_projects_ids
                 @notified_projects_ids ||= memberships.select {|m| m.mail_notification?}.collect(&:project_id)
               end
               def notified_project_ids=(ids)
                 Member.update_all("mail_notification = #{connection.quoted_false}", ['user_id = ?', id])
                 Member.update_all("mail_notification = #{connection.quoted_true}", ['user_id = ? AND project_id IN (?)', id, ids]) if ids && !ids.empty?
                 @notified_projects_ids = nil
                 notified_projects_ids
               end
               def self.find_by_rss_key(key)
                 token = Token.find_by_value(key)
                 token && token.user.active? ? token.user : nil
               end
               # Makes find_by_mail case-insensitive
               def self.find_by_mail(mail)
                 find(:first, :conditions => ["LOWER(mail) = ?", mail.to_s.downcase])
               end
-              # Sort users by their display names
-              def <=>(user)
-                self.to_s.downcase <=> user.to_s.downcase
-              end
               def to_s
                 name
               end
               # Returns the current day according to user's time zone
               def today
                 if time_zone.nil?
                   Date.today
                 else
                   Time.now.in_time_zone(time_zone).to_date
                 end
               end
               def logged?
                 true
               end
               def anonymous?
                 !logged?
               end
               # Return user's roles for project
               def roles_for_project(project)
                 roles = []
                 # No role on archived projects
                 return roles unless project && project.active?
                 if logged?
                   # Find project membership
                   membership = memberships.detect {|m| m.project_id == project.id}
                   if membership
                     roles = membership.roles
                   else
                     @role_non_member ||= Role.non_member
                     roles << @role_non_member
                   end
                 else
                   @role_anonymous ||= Role.anonymous
                   roles << @role_anonymous
                 end
                 roles
               end
               # Return true if the user is a member of project
               def member_of?(project)
                 !roles_for_project(project).detect {|role| role.member?}.nil?
               end
               # Return true if the user is allowed to do the specified action on project
               # action can be:
               # * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
               # * a permission Symbol (eg. :edit_project)
               def allowed_to?(action, project, options={})
                 if project
                   # No action allowed on archived projects
                   return false unless project.active?
                   # No action allowed on disabled modules
                   return false unless project.allows_to?(action)
                   # Admin users are authorized for anything else
                   return true if admin?
                   roles = roles_for_project(project)
                   return false unless roles
                   roles.detect {|role| (project.is_public? || role.member?) && role.allowed_to?(action)}
                 elsif options[:global]
                   # Admin users are always authorized
                   return true if admin?
                   # authorize if user has at least one role that has this permission
                   roles = memberships.collect {|m| m.roles}.flatten.uniq
                   roles.detect {|r| r.allowed_to?(action)} || (self.logged? ? Role.non_member.allowed_to?(action) : Role.anonymous.allowed_to?(action))
                 else
                   false
                 end
               end
               def self.current=(user)
                 @current_user = user
               end
               def self.current
                 @current_user ||= User.anonymous
               end
               # Returns the anonymous user.  If the anonymous user does not exist, it is created.  There can be only
               # one anonymous user per database.
               def self.anonymous
                 anonymous_user = AnonymousUser.find(:first)
                 if anonymous_user.nil?
                   anonymous_user = AnonymousUser.create(:lastname => 'Anonymous', :firstname => '', :mail => '', :login => '', :status => 0)
                   raise 'Unable to create the anonymous user.' if anonymous_user.new_record?
                 end
                 anonymous_user
               end
               protected
               def validate
                 # Password length validation based on setting
                 if !password.nil? && password.size < Setting.password_min_length.to_i
                   errors.add(:password, :too_short, :count => Setting.password_min_length.to_i)
                 end
               end
               private
               # Return password digest
               def self.hash_password(clear_password)
                 Digest::SHA1.hexdigest(clear_password || "")
               end
             end
             class AnonymousUser < User
               def validate_on_create
                 # There should be only one AnonymousUser in the database
                 errors.add_to_base 'An anonymous user already exists.' if AnonymousUser.find(:first)
               end
               def available_custom_fields
                 []
               end
               # Overrides a few properties
               def logged?; false end
               def admin; false end
               def name(*args); I18n.t(:label_user_anonymous) end
               def mail; nil end
               def time_zone; nil end
               def rss_key; nil end
             end