Chris@0: # Redmine - project management software Chris@0: # Copyright (C) 2006-2009 Jean-Philippe Lang Chris@0: # Chris@0: # This program is free software; you can redistribute it and/or Chris@0: # modify it under the terms of the GNU General Public License Chris@0: # as published by the Free Software Foundation; either version 2 Chris@0: # of the License, or (at your option) any later version. Chris@0: # Chris@0: # This program is distributed in the hope that it will be useful, Chris@0: # but WITHOUT ANY WARRANTY; without even the implied warranty of Chris@0: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the Chris@0: # GNU General Public License for more details. Chris@0: # Chris@0: # You should have received a copy of the GNU General Public License Chris@0: # along with this program; if not, write to the Free Software Chris@0: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Chris@0: Chris@0: class AccountController < ApplicationController Chris@0: helper :custom_fields Chris@0: include CustomFieldsHelper Chris@0: Chris@0: # prevents login action to be filtered by check_if_login_required application scope filter Chris@0: skip_before_filter :check_if_login_required Chris@0: Chris@0: # Login request and validation Chris@0: def login Chris@0: if request.get? Chris@0: logout_user Chris@0: else Chris@0: authenticate_user Chris@0: end Chris@0: end Chris@0: Chris@0: # Log out current user and redirect to welcome page Chris@0: def logout Chris@0: logout_user Chris@0: redirect_to home_url Chris@0: end Chris@0: Chris@0: # Enable user to choose a new password Chris@0: def lost_password Chris@0: redirect_to(home_url) && return unless Setting.lost_password? Chris@0: if params[:token] Chris@0: @token = Token.find_by_action_and_value("recovery", params[:token]) Chris@0: redirect_to(home_url) && return unless @token and !@token.expired? Chris@0: @user = @token.user Chris@0: if request.post? Chris@0: @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation] Chris@0: if @user.save Chris@0: @token.destroy Chris@0: flash[:notice] = l(:notice_account_password_updated) Chris@0: redirect_to :action => 'login' Chris@0: return Chris@0: end Chris@0: end Chris@0: render :template => "account/password_recovery" Chris@0: return Chris@0: else Chris@0: if request.post? Chris@0: user = User.find_by_mail(params[:mail]) Chris@0: # user not found in db Chris@0: (flash.now[:error] = l(:notice_account_unknown_email); return) unless user Chris@0: # user uses an external authentification Chris@0: (flash.now[:error] = l(:notice_can_t_change_password); return) if user.auth_source_id Chris@0: # create a new token for password recovery Chris@0: token = Token.new(:user => user, :action => "recovery") Chris@0: if token.save Chris@0: Mailer.deliver_lost_password(token) Chris@0: flash[:notice] = l(:notice_account_lost_email_sent) Chris@0: redirect_to :action => 'login' Chris@0: return Chris@0: end Chris@0: end Chris@0: end Chris@0: end Chris@0: Chris@0: # User self-registration Chris@0: def register Chris@0: redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration] Chris@0: if request.get? Chris@0: session[:auth_source_registration] = nil Chris@0: @user = User.new(:language => Setting.default_language) Chris@0: else Chris@0: @user = User.new(params[:user]) Chris@0: @user.admin = false Chris@14: @user.register Chris@0: if session[:auth_source_registration] Chris@14: @user.activate Chris@0: @user.login = session[:auth_source_registration][:login] Chris@0: @user.auth_source_id = session[:auth_source_registration][:auth_source_id] Chris@0: if @user.save Chris@0: session[:auth_source_registration] = nil Chris@0: self.logged_user = @user Chris@0: flash[:notice] = l(:notice_account_activated) Chris@0: redirect_to :controller => 'my', :action => 'account' Chris@0: end Chris@0: else Chris@0: @user.login = params[:user][:login] Chris@0: @user.password, @user.password_confirmation = params[:password], params[:password_confirmation] Chris@0: Chris@0: case Setting.self_registration Chris@0: when '1' Chris@0: register_by_email_activation(@user) Chris@0: when '3' Chris@0: register_automatically(@user) Chris@0: else Chris@0: register_manually_by_administrator(@user) Chris@0: end Chris@0: end Chris@0: end Chris@0: end Chris@0: Chris@0: # Token based account activation Chris@0: def activate Chris@0: redirect_to(home_url) && return unless Setting.self_registration? && params[:token] Chris@0: token = Token.find_by_action_and_value('register', params[:token]) Chris@0: redirect_to(home_url) && return unless token and !token.expired? Chris@0: user = token.user Chris@14: redirect_to(home_url) && return unless user.registered? Chris@14: user.activate Chris@0: if user.save Chris@0: token.destroy Chris@0: flash[:notice] = l(:notice_account_activated) Chris@0: end Chris@0: redirect_to :action => 'login' Chris@0: end Chris@0: Chris@0: private Chris@0: Chris@0: def logout_user Chris@0: if User.current.logged? Chris@0: cookies.delete :autologin Chris@0: Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin']) Chris@0: self.logged_user = nil Chris@0: end Chris@0: end Chris@0: Chris@0: def authenticate_user Chris@0: if Setting.openid? && using_open_id? Chris@0: open_id_authenticate(params[:openid_url]) Chris@0: else Chris@0: password_authentication Chris@0: end Chris@0: end Chris@0: Chris@0: def password_authentication Chris@0: user = User.try_to_login(params[:username], params[:password]) Chris@0: Chris@0: if user.nil? Chris@0: invalid_credentials Chris@0: elsif user.new_record? Chris@0: onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id }) Chris@0: else Chris@0: # Valid user Chris@0: successful_authentication(user) Chris@0: end Chris@0: end Chris@0: Chris@0: Chris@0: def open_id_authenticate(openid_url) Chris@0: authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url) do |result, identity_url, registration| Chris@0: if result.successful? Chris@0: user = User.find_or_initialize_by_identity_url(identity_url) Chris@0: if user.new_record? Chris@0: # Self-registration off Chris@0: redirect_to(home_url) && return unless Setting.self_registration? Chris@0: Chris@0: # Create on the fly Chris@0: user.login = registration['nickname'] unless registration['nickname'].nil? Chris@0: user.mail = registration['email'] unless registration['email'].nil? Chris@0: user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil? Chris@0: user.random_password Chris@14: user.register Chris@0: Chris@0: case Setting.self_registration Chris@0: when '1' Chris@0: register_by_email_activation(user) do Chris@0: onthefly_creation_failed(user) Chris@0: end Chris@0: when '3' Chris@0: register_automatically(user) do Chris@0: onthefly_creation_failed(user) Chris@0: end Chris@0: else Chris@0: register_manually_by_administrator(user) do Chris@0: onthefly_creation_failed(user) Chris@0: end Chris@0: end Chris@0: else Chris@0: # Existing record Chris@0: if user.active? Chris@0: successful_authentication(user) Chris@0: else Chris@0: account_pending Chris@0: end Chris@0: end Chris@0: end Chris@0: end Chris@0: end Chris@0: Chris@0: def successful_authentication(user) Chris@0: # Valid user Chris@0: self.logged_user = user Chris@0: # generate a key and set cookie if autologin Chris@0: if params[:autologin] && Setting.autologin? Chris@0: token = Token.create(:user => user, :action => 'autologin') Chris@0: cookies[:autologin] = { :value => token.value, :expires => 1.year.from_now } Chris@0: end Chris@0: call_hook(:controller_account_success_authentication_after, {:user => user }) Chris@0: redirect_back_or_default :controller => 'my', :action => 'page' Chris@0: end Chris@0: Chris@0: # Onthefly creation failed, display the registration form to fill/fix attributes Chris@0: def onthefly_creation_failed(user, auth_source_options = { }) Chris@0: @user = user Chris@0: session[:auth_source_registration] = auth_source_options unless auth_source_options.empty? Chris@0: render :action => 'register' Chris@0: end Chris@0: Chris@0: def invalid_credentials Chris@0: logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}" Chris@0: flash.now[:error] = l(:notice_account_invalid_creditentials) Chris@0: end Chris@0: Chris@0: # Register a user for email activation. Chris@0: # Chris@0: # Pass a block for behavior when a user fails to save Chris@0: def register_by_email_activation(user, &block) Chris@0: token = Token.new(:user => user, :action => "register") Chris@0: if user.save and token.save Chris@0: Mailer.deliver_register(token) Chris@0: flash[:notice] = l(:notice_account_register_done) Chris@0: redirect_to :action => 'login' Chris@0: else Chris@0: yield if block_given? Chris@0: end Chris@0: end Chris@0: Chris@0: # Automatically register a user Chris@0: # Chris@0: # Pass a block for behavior when a user fails to save Chris@0: def register_automatically(user, &block) Chris@0: # Automatic activation Chris@14: user.activate Chris@0: user.last_login_on = Time.now Chris@0: if user.save Chris@0: self.logged_user = user Chris@0: flash[:notice] = l(:notice_account_activated) Chris@0: redirect_to :controller => 'my', :action => 'account' Chris@0: else Chris@0: yield if block_given? Chris@0: end Chris@0: end Chris@0: Chris@0: # Manual activation by the administrator Chris@0: # Chris@0: # Pass a block for behavior when a user fails to save Chris@0: def register_manually_by_administrator(user, &block) Chris@0: if user.save Chris@0: # Sends an email to the administrators Chris@0: Mailer.deliver_account_activation_request(user) Chris@0: account_pending Chris@0: else Chris@0: yield if block_given? Chris@0: end Chris@0: end Chris@0: Chris@0: def account_pending Chris@0: flash[:notice] = l(:notice_account_pending) Chris@0: redirect_to :action => 'login' Chris@0: end Chris@0: end