jro_apps/redmine Commit - r15310:d7a6c09822bc

Use safe_attributes for auth sources....

Jean-Philippe Lang -

r15310:d7a6c09822bc

parent child

Context file:

r15310:d7a6c09822bc

Collapse all files

app/controllers/auth_sources_controller.rb +12 -5

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class AuthSourcesController < ApplicationController
               layout 'admin'
               menu_item :ldap_authentication
               before_action :require_admin
+              before_action :build_new_auth_source, :only => [:new, :create]
               before_action :find_auth_source, :only => [:edit, :update, :test_connection, :destroy]
               require_sudo_mode :update, :destroy
               def index
                 @auth_source_pages, @auth_sources = paginate AuthSource, :per_page => 25
               end
               def new
-                klass_name = params[:type] || 'AuthSourceLdap'
-                @auth_source = AuthSource.new_subclass_instance(klass_name, params[:auth_source])
-                render_404 unless @auth_source
               end
               def create
-                @auth_source = AuthSource.new_subclass_instance(params[:type], params[:auth_source])
                 if @auth_source.save
                   flash[:notice] = l(:notice_successful_create)
                   redirect_to auth_sources_path
                 else
                   render :action => 'new'
                 end
               end
               def edit
               end
               def update
-                if @auth_source.update_attributes(params[:auth_source])
+                @auth_source.safe_attributes = params[:auth_source]
+                if @auth_source.save
                   flash[:notice] = l(:notice_successful_update)
                   redirect_to auth_sources_path
                 else
                   render :action => 'edit'
                 end
               end
               def test_connection
                 begin
                   @auth_source.test_connection
                   flash[:notice] = l(:notice_successful_connection)
                 rescue Exception => e
                   flash[:error] = l(:error_unable_to_connect, e.message)
                 end
                 redirect_to auth_sources_path
               end
               def destroy
                 unless @auth_source.users.exists?
                   @auth_source.destroy
                   flash[:notice] = l(:notice_successful_delete)
                 end
                 redirect_to auth_sources_path
               end
               def autocomplete_for_new_user
                 results = AuthSource.search(params[:term])
                 render :json => results.map {|result| {
                   'value' => result[:login],
                   'label' => "#{result[:login]} (#{result[:firstname]} #{result[:lastname]})",
                   'login' => result[:login].to_s,
                   'firstname' => result[:firstname].to_s,
                   'lastname' => result[:lastname].to_s,
                   'mail' => result[:mail].to_s,
                   'auth_source_id' => result[:auth_source_id].to_s
                 }}
               end
               private
+              def build_new_auth_source
+                @auth_source = AuthSource.new_subclass_instance(params[:type] || 'AuthSourceLdap')
+                if @auth_source
+                  @auth_source.safe_attributes = params[:auth_source]
+                else
+                  render_404
+                end
+              end
               def find_auth_source
                 @auth_source = AuthSource.find(params[:id])
               rescue ActiveRecord::RecordNotFound
                 render_404
               end
             end

app/models/auth_source.rb +16 0

             # Redmine - project management software
             # Copyright (C) 2006-2016  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             # Generic exception for when the AuthSource can not be reached
             # (eg. can not connect to the LDAP)
             class AuthSourceException < Exception; end
             class AuthSourceTimeoutException < AuthSourceException; end
             class AuthSource < ActiveRecord::Base
+              include Redmine::SafeAttributes
               include Redmine::SubclassFactory
               include Redmine::Ciphering
               has_many :users
               validates_presence_of :name
               validates_uniqueness_of :name
               validates_length_of :name, :maximum => 60
               attr_protected :id
+              safe_attributes 'name',
+                'host',
+                'port',
+                'account',
+                'account_password',
+                'base_dn',
+                'attr_login',
+                'attr_firstname',
+                'attr_lastname',
+                'attr_mail',
+                'onthefly_register',
+                'tls',
+                'filter',
+                'timeout'
               def authenticate(login, password)
               end
               def test_connection
               end
               def auth_method_name
                 "Abstract"
               end
               def account_password
                 read_ciphered_attribute(:account_password)
               end
               def account_password=(arg)
                 write_ciphered_attribute(:account_password, arg)
               end
               def searchable?
                 false
               end
               def self.search(q)
                 results = []
                 AuthSource.all.each do |source|
                   begin
                     if source.searchable?
                       results += source.search(q)
                     end
                   rescue AuthSourceException => e
                     logger.error "Error while searching users in #{source.name}: #{e.message}"
                   end
                 end
                 results
               end
               def allow_password_changes?
                 self.class.allow_password_changes?
               end
               # Does this auth source backend allow password changes?
               def self.allow_password_changes?
                 false
               end
               # Try to authenticate a user not yet registered against available sources
               def self.authenticate(login, password)
                 AuthSource.where(:onthefly_register => true).each do |source|
                   begin
                     logger.debug "Authenticating '#{login}' against '#{source.name}'" if logger && logger.debug?
                     attrs = source.authenticate(login, password)
                   rescue => e
                     logger.error "Error during authentication: #{e.message}"
                     attrs = nil
                   end
                   return attrs if attrs
                 end
                 return nil
               end
             end

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages