##// END OF EJS Templates
jro_apps » redmine
RSS
Merged r11521 from trunk (#3371)....
Jean-Philippe Lang -
r11333:511099e9cac4
parent child
Show More
Side by Side Unified
Context file:
r11333:511099e9cac4 Loading diff...:
Show file before | Show file after | Hide comments
@@ -1,303 +1,305
1 # Redmine - project management software
1 # Redmine - project management software
2 # Copyright (C) 2006-2013 Jean-Philippe Lang
2 # Copyright (C) 2006-2013 Jean-Philippe Lang
3 #
3 #
4 # This program is free software; you can redistribute it and/or
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
7 # of the License, or (at your option) any later version.
8 #
8 #
9 # This program is distributed in the hope that it will be useful,
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
12 # GNU General Public License for more details.
13 #
13 #
14 # You should have received a copy of the GNU General Public License
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
17
18 class AccountController < ApplicationController
18 class AccountController < ApplicationController
19 helper :custom_fields
19 helper :custom_fields
20 include CustomFieldsHelper
20 include CustomFieldsHelper
21
21
22 # prevents login action to be filtered by check_if_login_required application scope filter
22 # prevents login action to be filtered by check_if_login_required application scope filter
23 skip_before_filter :check_if_login_required
23 skip_before_filter :check_if_login_required
24
24
25 # Login request and validation
25 # Login request and validation
26 def login
26 def login
27 if request.get?
27 if request.get?
28 if User.current.logged?
28 if User.current.logged?
29 redirect_to home_url
29 redirect_to home_url
30 end
30 end
31 else
31 else
32 authenticate_user
32 authenticate_user
33 end
33 end
34 rescue AuthSourceException => e
34 rescue AuthSourceException => e
35 logger.error "An error occured when authenticating #{params[:username]}: #{e.message}"
35 logger.error "An error occured when authenticating #{params[:username]}: #{e.message}"
36 render_error :message => e.message
36 render_error :message => e.message
37 end
37 end
38
38
39 # Log out current user and redirect to welcome page
39 # Log out current user and redirect to welcome page
40 def logout
40 def logout
41 if User.current.anonymous?
41 if User.current.anonymous?
42 redirect_to home_url
42 redirect_to home_url
43 elsif request.post?
43 elsif request.post?
44 logout_user
44 logout_user
45 redirect_to home_url
45 redirect_to home_url
46 end
46 end
47 # display the logout form
47 # display the logout form
48 end
48 end
49
49
50 # Lets user choose a new password
50 # Lets user choose a new password
51 def lost_password
51 def lost_password
52 (redirect_to(home_url); return) unless Setting.lost_password?
52 (redirect_to(home_url); return) unless Setting.lost_password?
53 if params[:token]
53 if params[:token]
54 @token = Token.find_token("recovery", params[:token].to_s)
54 @token = Token.find_token("recovery", params[:token].to_s)
55 if @token.nil? || @token.expired?
55 if @token.nil? || @token.expired?
56 redirect_to home_url
56 redirect_to home_url
57 return
57 return
58 end
58 end
59 @user = @token.user
59 @user = @token.user
60 unless @user && @user.active?
60 unless @user && @user.active?
61 redirect_to home_url
61 redirect_to home_url
62 return
62 return
63 end
63 end
64 if request.post?
64 if request.post?
65 @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation]
65 @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation]
66 if @user.save
66 if @user.save
67 @token.destroy
67 @token.destroy
68 flash[:notice] = l(:notice_account_password_updated)
68 flash[:notice] = l(:notice_account_password_updated)
69 redirect_to signin_path
69 redirect_to signin_path
70 return
70 return
71 end
71 end
72 end
72 end
73 render :template => "account/password_recovery"
73 render :template => "account/password_recovery"
74 return
74 return
75 else
75 else
76 if request.post?
76 if request.post?
77 user = User.find_by_mail(params[:mail].to_s)
77 user = User.find_by_mail(params[:mail].to_s)
78 # user not found or not active
78 # user not found or not active
79 unless user && user.active?
79 unless user && user.active?
80 flash.now[:error] = l(:notice_account_unknown_email)
80 flash.now[:error] = l(:notice_account_unknown_email)
81 return
81 return
82 end
82 end
83 # user cannot change its password
83 # user cannot change its password
84 unless user.change_password_allowed?
84 unless user.change_password_allowed?
85 flash.now[:error] = l(:notice_can_t_change_password)
85 flash.now[:error] = l(:notice_can_t_change_password)
86 return
86 return
87 end
87 end
88 # create a new token for password recovery
88 # create a new token for password recovery
89 token = Token.new(:user => user, :action => "recovery")
89 token = Token.new(:user => user, :action => "recovery")
90 if token.save
90 if token.save
91 Mailer.lost_password(token).deliver
91 Mailer.lost_password(token).deliver
92 flash[:notice] = l(:notice_account_lost_email_sent)
92 flash[:notice] = l(:notice_account_lost_email_sent)
93 redirect_to signin_path
93 redirect_to signin_path
94 return
94 return
95 end
95 end
96 end
96 end
97 end
97 end
98 end
98 end
99
99
100 # User self-registration
100 # User self-registration
101 def register
101 def register
102 (redirect_to(home_url); return) unless Setting.self_registration? || session[:auth_source_registration]
102 (redirect_to(home_url); return) unless Setting.self_registration? || session[:auth_source_registration]
103 if request.get?
103 if request.get?
104 session[:auth_source_registration] = nil
104 session[:auth_source_registration] = nil
105 @user = User.new(:language => current_language.to_s)
105 @user = User.new(:language => current_language.to_s)
106 else
106 else
107 user_params = params[:user] || {}
107 user_params = params[:user] || {}
108 @user = User.new
108 @user = User.new
109 @user.safe_attributes = user_params
109 @user.safe_attributes = user_params
110 @user.admin = false
110 @user.admin = false
111 @user.register
111 @user.register
112 if session[:auth_source_registration]
112 if session[:auth_source_registration]
113 @user.activate
113 @user.activate
114 @user.login = session[:auth_source_registration][:login]
114 @user.login = session[:auth_source_registration][:login]
115 @user.auth_source_id = session[:auth_source_registration][:auth_source_id]
115 @user.auth_source_id = session[:auth_source_registration][:auth_source_id]
116 if @user.save
116 if @user.save
117 session[:auth_source_registration] = nil
117 session[:auth_source_registration] = nil
118 self.logged_user = @user
118 self.logged_user = @user
119 flash[:notice] = l(:notice_account_activated)
119 flash[:notice] = l(:notice_account_activated)
120 redirect_to my_account_path
120 redirect_to my_account_path
121 end
121 end
122 else
122 else
123 @user.login = params[:user][:login]
123 @user.login = params[:user][:login]
124 unless user_params[:identity_url].present? && user_params[:password].blank? && user_params[:password_confirmation].blank?
124 unless user_params[:identity_url].present? && user_params[:password].blank? && user_params[:password_confirmation].blank?
125 @user.password, @user.password_confirmation = user_params[:password], user_params[:password_confirmation]
125 @user.password, @user.password_confirmation = user_params[:password], user_params[:password_confirmation]
126 end
126 end
127
127
128 case Setting.self_registration
128 case Setting.self_registration
129 when '1'
129 when '1'
130 register_by_email_activation(@user)
130 register_by_email_activation(@user)
131 when '3'
131 when '3'
132 register_automatically(@user)
132 register_automatically(@user)
133 else
133 else
134 register_manually_by_administrator(@user)
134 register_manually_by_administrator(@user)
135 end
135 end
136 end
136 end
137 end
137 end
138 end
138 end
139
139
140 # Token based account activation
140 # Token based account activation
141 def activate
141 def activate
142 (redirect_to(home_url); return) unless Setting.self_registration? && params[:token].present?
142 (redirect_to(home_url); return) unless Setting.self_registration? && params[:token].present?
143 token = Token.find_token('register', params[:token].to_s)
143 token = Token.find_token('register', params[:token].to_s)
144 (redirect_to(home_url); return) unless token and !token.expired?
144 (redirect_to(home_url); return) unless token and !token.expired?
145 user = token.user
145 user = token.user
146 (redirect_to(home_url); return) unless user.registered?
146 (redirect_to(home_url); return) unless user.registered?
147 user.activate
147 user.activate
148 if user.save
148 if user.save
149 token.destroy
149 token.destroy
150 flash[:notice] = l(:notice_account_activated)
150 flash[:notice] = l(:notice_account_activated)
151 end
151 end
152 redirect_to signin_path
152 redirect_to signin_path
153 end
153 end
154
154
155 private
155 private
156
156
157 def authenticate_user
157 def authenticate_user
158 if Setting.openid? && using_open_id?
158 if Setting.openid? && using_open_id?
159 open_id_authenticate(params[:openid_url])
159 open_id_authenticate(params[:openid_url])
160 else
160 else
161 password_authentication
161 password_authentication
162 end
162 end
163 end
163 end
164
164
165 def password_authentication
165 def password_authentication
166 user = User.try_to_login(params[:username], params[:password])
166 user = User.try_to_login(params[:username], params[:password])
167
167
168 if user.nil?
168 if user.nil?
169 invalid_credentials
169 invalid_credentials
170 elsif user.new_record?
170 elsif user.new_record?
171 onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id })
171 onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id })
172 else
172 else
173 # Valid user
173 # Valid user
174 successful_authentication(user)
174 successful_authentication(user)
175 end
175 end
176 end
176 end
177
177
178 def open_id_authenticate(openid_url)
178 def open_id_authenticate(openid_url)
179 authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url, :method => :post) do |result, identity_url, registration|
179 back_url = signin_url(:autologin => params[:autologin])
180
181 authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => back_url, :method => :post) do |result, identity_url, registration|
180 if result.successful?
182 if result.successful?
181 user = User.find_or_initialize_by_identity_url(identity_url)
183 user = User.find_or_initialize_by_identity_url(identity_url)
182 if user.new_record?
184 if user.new_record?
183 # Self-registration off
185 # Self-registration off
184 (redirect_to(home_url); return) unless Setting.self_registration?
186 (redirect_to(home_url); return) unless Setting.self_registration?
185
187
186 # Create on the fly
188 # Create on the fly
187 user.login = registration['nickname'] unless registration['nickname'].nil?
189 user.login = registration['nickname'] unless registration['nickname'].nil?
188 user.mail = registration['email'] unless registration['email'].nil?
190 user.mail = registration['email'] unless registration['email'].nil?
189 user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil?
191 user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil?
190 user.random_password
192 user.random_password
191 user.register
193 user.register
192
194
193 case Setting.self_registration
195 case Setting.self_registration
194 when '1'
196 when '1'
195 register_by_email_activation(user) do
197 register_by_email_activation(user) do
196 onthefly_creation_failed(user)
198 onthefly_creation_failed(user)
197 end
199 end
198 when '3'
200 when '3'
199 register_automatically(user) do
201 register_automatically(user) do
200 onthefly_creation_failed(user)
202 onthefly_creation_failed(user)
201 end
203 end
202 else
204 else
203 register_manually_by_administrator(user) do
205 register_manually_by_administrator(user) do
204 onthefly_creation_failed(user)
206 onthefly_creation_failed(user)
205 end
207 end
206 end
208 end
207 else
209 else
208 # Existing record
210 # Existing record
209 if user.active?
211 if user.active?
210 successful_authentication(user)
212 successful_authentication(user)
211 else
213 else
212 account_pending
214 account_pending
213 end
215 end
214 end
216 end
215 end
217 end
216 end
218 end
217 end
219 end
218
220
219 def successful_authentication(user)
221 def successful_authentication(user)
220 logger.info "Successful authentication for '#{user.login}' from #{request.remote_ip} at #{Time.now.utc}"
222 logger.info "Successful authentication for '#{user.login}' from #{request.remote_ip} at #{Time.now.utc}"
221 # Valid user
223 # Valid user
222 self.logged_user = user
224 self.logged_user = user
223 # generate a key and set cookie if autologin
225 # generate a key and set cookie if autologin
224 if params[:autologin] && Setting.autologin?
226 if params[:autologin] && Setting.autologin?
225 set_autologin_cookie(user)
227 set_autologin_cookie(user)
226 end
228 end
227 call_hook(:controller_account_success_authentication_after, {:user => user })
229 call_hook(:controller_account_success_authentication_after, {:user => user })
228 redirect_back_or_default my_page_path
230 redirect_back_or_default my_page_path
229 end
231 end
230
232
231 def set_autologin_cookie(user)
233 def set_autologin_cookie(user)
232 token = Token.create(:user => user, :action => 'autologin')
234 token = Token.create(:user => user, :action => 'autologin')
233 cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin'
235 cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin'
234 cookie_options = {
236 cookie_options = {
235 :value => token.value,
237 :value => token.value,
236 :expires => 1.year.from_now,
238 :expires => 1.year.from_now,
237 :path => (Redmine::Configuration['autologin_cookie_path'] || '/'),
239 :path => (Redmine::Configuration['autologin_cookie_path'] || '/'),
238 :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false),
240 :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false),
239 :httponly => true
241 :httponly => true
240 }
242 }
241 cookies[cookie_name] = cookie_options
243 cookies[cookie_name] = cookie_options
242 end
244 end
243
245
244 # Onthefly creation failed, display the registration form to fill/fix attributes
246 # Onthefly creation failed, display the registration form to fill/fix attributes
245 def onthefly_creation_failed(user, auth_source_options = { })
247 def onthefly_creation_failed(user, auth_source_options = { })
246 @user = user
248 @user = user
247 session[:auth_source_registration] = auth_source_options unless auth_source_options.empty?
249 session[:auth_source_registration] = auth_source_options unless auth_source_options.empty?
248 render :action => 'register'
250 render :action => 'register'
249 end
251 end
250
252
251 def invalid_credentials
253 def invalid_credentials
252 logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}"
254 logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}"
253 flash.now[:error] = l(:notice_account_invalid_creditentials)
255 flash.now[:error] = l(:notice_account_invalid_creditentials)
254 end
256 end
255
257
256 # Register a user for email activation.
258 # Register a user for email activation.
257 #
259 #
258 # Pass a block for behavior when a user fails to save
260 # Pass a block for behavior when a user fails to save
259 def register_by_email_activation(user, &block)
261 def register_by_email_activation(user, &block)
260 token = Token.new(:user => user, :action => "register")
262 token = Token.new(:user => user, :action => "register")
261 if user.save and token.save
263 if user.save and token.save
262 Mailer.register(token).deliver
264 Mailer.register(token).deliver
263 flash[:notice] = l(:notice_account_register_done)
265 flash[:notice] = l(:notice_account_register_done)
264 redirect_to signin_path
266 redirect_to signin_path
265 else
267 else
266 yield if block_given?
268 yield if block_given?
267 end
269 end
268 end
270 end
269
271
270 # Automatically register a user
272 # Automatically register a user
271 #
273 #
272 # Pass a block for behavior when a user fails to save
274 # Pass a block for behavior when a user fails to save
273 def register_automatically(user, &block)
275 def register_automatically(user, &block)
274 # Automatic activation
276 # Automatic activation
275 user.activate
277 user.activate
276 user.last_login_on = Time.now
278 user.last_login_on = Time.now
277 if user.save
279 if user.save
278 self.logged_user = user
280 self.logged_user = user
279 flash[:notice] = l(:notice_account_activated)
281 flash[:notice] = l(:notice_account_activated)
280 redirect_to my_account_path
282 redirect_to my_account_path
281 else
283 else
282 yield if block_given?
284 yield if block_given?
283 end
285 end
284 end
286 end
285
287
286 # Manual activation by the administrator
288 # Manual activation by the administrator
287 #
289 #
288 # Pass a block for behavior when a user fails to save
290 # Pass a block for behavior when a user fails to save
289 def register_manually_by_administrator(user, &block)
291 def register_manually_by_administrator(user, &block)
290 if user.save
292 if user.save
291 # Sends an email to the administrators
293 # Sends an email to the administrators
292 Mailer.account_activation_request(user).deliver
294 Mailer.account_activation_request(user).deliver
293 account_pending
295 account_pending
294 else
296 else
295 yield if block_given?
297 yield if block_given?
296 end
298 end
297 end
299 end
298
300
299 def account_pending
301 def account_pending
300 flash[:notice] = l(:notice_account_pending)
302 flash[:notice] = l(:notice_account_pending)
301 redirect_to signin_path
303 redirect_to signin_path
302 end
304 end
303 end
305 end
General Comments 0
You need to be logged in to leave comments. Login now