Chris@1296: # Redmine - project management software Chris@1296: # Copyright (C) 2006-2012 Jean-Philippe Lang Chris@1296: # Chris@1296: # This program is free software; you can redistribute it and/or Chris@1296: # modify it under the terms of the GNU General Public License Chris@1296: # as published by the Free Software Foundation; either version 2 Chris@1296: # of the License, or (at your option) any later version. Chris@1296: # Chris@1296: # This program is distributed in the hope that it will be useful, Chris@1296: # but WITHOUT ANY WARRANTY; without even the implied warranty of Chris@1296: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the Chris@1296: # GNU General Public License for more details. Chris@1296: # Chris@1296: # You should have received a copy of the GNU General Public License Chris@1296: # along with this program; if not, write to the Free Software Chris@1296: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Chris@1296: Chris@1296: class AccountController < ApplicationController Chris@1296: helper :custom_fields Chris@1296: include CustomFieldsHelper Chris@1296: Chris@1296: # prevents login action to be filtered by check_if_login_required application scope filter Chris@1296: skip_before_filter :check_if_login_required Chris@1296: Chris@1296: # Login request and validation Chris@1296: def login Chris@1296: if request.get? Chris@1296: logout_user Chris@1296: else Chris@1296: authenticate_user Chris@1296: end Chris@1296: rescue AuthSourceException => e Chris@1296: logger.error "An error occured when authenticating #{params[:username]}: #{e.message}" Chris@1296: render_error :message => e.message Chris@1296: end Chris@1296: Chris@1296: # Log out current user and redirect to welcome page Chris@1296: def logout Chris@1296: logout_user Chris@1296: redirect_to home_url Chris@1296: end Chris@1296: Chris@1296: # Lets user choose a new password Chris@1296: def lost_password Chris@1296: redirect_to(home_url) && return unless Setting.lost_password? Chris@1296: if params[:token] Chris@1296: @token = Token.find_by_action_and_value("recovery", params[:token].to_s) Chris@1296: if @token.nil? || @token.expired? Chris@1296: redirect_to home_url Chris@1296: return Chris@1296: end Chris@1296: @user = @token.user Chris@1296: unless @user && @user.active? Chris@1296: redirect_to home_url Chris@1296: return Chris@1296: end Chris@1296: if request.post? Chris@1296: @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation] Chris@1296: if @user.save Chris@1296: @token.destroy Chris@1296: flash[:notice] = l(:notice_account_password_updated) Chris@1296: redirect_to signin_path Chris@1296: return Chris@1296: end Chris@1296: end Chris@1296: render :template => "account/password_recovery" Chris@1296: return Chris@1296: else Chris@1296: if request.post? Chris@1296: user = User.find_by_mail(params[:mail].to_s) Chris@1296: # user not found or not active Chris@1296: unless user && user.active? Chris@1296: flash.now[:error] = l(:notice_account_unknown_email) Chris@1296: return Chris@1296: end Chris@1296: # user cannot change its password Chris@1296: unless user.change_password_allowed? Chris@1296: flash.now[:error] = l(:notice_can_t_change_password) Chris@1296: return Chris@1296: end Chris@1296: # create a new token for password recovery Chris@1296: token = Token.new(:user => user, :action => "recovery") Chris@1296: if token.save Chris@1296: Mailer.lost_password(token).deliver Chris@1296: flash[:notice] = l(:notice_account_lost_email_sent) Chris@1296: redirect_to signin_path Chris@1296: return Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: # User self-registration Chris@1296: def register Chris@1296: redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration] Chris@1296: if request.get? Chris@1296: session[:auth_source_registration] = nil Chris@1296: @user = User.new(:language => Setting.default_language) Chris@1296: else Chris@1296: user_params = params[:user] || {} Chris@1296: @user = User.new Chris@1296: @user.safe_attributes = user_params Chris@1296: @user.admin = false Chris@1296: @user.register Chris@1296: if session[:auth_source_registration] Chris@1296: @user.activate Chris@1296: @user.login = session[:auth_source_registration][:login] Chris@1296: @user.auth_source_id = session[:auth_source_registration][:auth_source_id] Chris@1296: if @user.save Chris@1296: session[:auth_source_registration] = nil Chris@1296: self.logged_user = @user Chris@1296: flash[:notice] = l(:notice_account_activated) Chris@1296: redirect_to :controller => 'my', :action => 'account' Chris@1296: end Chris@1296: else Chris@1296: @user.login = params[:user][:login] Chris@1296: unless user_params[:identity_url].present? && user_params[:password].blank? && user_params[:password_confirmation].blank? Chris@1296: @user.password, @user.password_confirmation = user_params[:password], user_params[:password_confirmation] Chris@1296: end Chris@1296: Chris@1296: case Setting.self_registration Chris@1296: when '1' Chris@1296: register_by_email_activation(@user) Chris@1296: when '3' Chris@1296: register_automatically(@user) Chris@1296: else Chris@1296: register_manually_by_administrator(@user) Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: # Token based account activation Chris@1296: def activate Chris@1296: redirect_to(home_url) && return unless Setting.self_registration? && params[:token] Chris@1296: token = Token.find_by_action_and_value('register', params[:token]) Chris@1296: redirect_to(home_url) && return unless token and !token.expired? Chris@1296: user = token.user Chris@1296: redirect_to(home_url) && return unless user.registered? Chris@1296: user.activate Chris@1296: if user.save Chris@1296: token.destroy Chris@1296: flash[:notice] = l(:notice_account_activated) Chris@1296: end Chris@1296: redirect_to signin_path Chris@1296: end Chris@1296: Chris@1296: private Chris@1296: Chris@1296: def authenticate_user Chris@1296: if Setting.openid? && using_open_id? Chris@1296: open_id_authenticate(params[:openid_url]) Chris@1296: else Chris@1296: password_authentication Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: def password_authentication Chris@1296: user = User.try_to_login(params[:username], params[:password]) Chris@1296: Chris@1296: if user.nil? Chris@1296: invalid_credentials Chris@1296: elsif user.new_record? Chris@1296: onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id }) Chris@1296: else Chris@1296: # Valid user Chris@1296: successful_authentication(user) Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: def open_id_authenticate(openid_url) Chris@1296: authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url, :method => :post) do |result, identity_url, registration| Chris@1296: if result.successful? Chris@1296: user = User.find_or_initialize_by_identity_url(identity_url) Chris@1296: if user.new_record? Chris@1296: # Self-registration off Chris@1296: redirect_to(home_url) && return unless Setting.self_registration? Chris@1296: Chris@1296: # Create on the fly Chris@1296: user.login = registration['nickname'] unless registration['nickname'].nil? Chris@1296: user.mail = registration['email'] unless registration['email'].nil? Chris@1296: user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil? Chris@1296: user.random_password Chris@1296: user.register Chris@1296: Chris@1296: case Setting.self_registration Chris@1296: when '1' Chris@1296: register_by_email_activation(user) do Chris@1296: onthefly_creation_failed(user) Chris@1296: end Chris@1296: when '3' Chris@1296: register_automatically(user) do Chris@1296: onthefly_creation_failed(user) Chris@1296: end Chris@1296: else Chris@1296: register_manually_by_administrator(user) do Chris@1296: onthefly_creation_failed(user) Chris@1296: end Chris@1296: end Chris@1296: else Chris@1296: # Existing record Chris@1296: if user.active? Chris@1296: successful_authentication(user) Chris@1296: else Chris@1296: account_pending Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: def successful_authentication(user) Chris@1296: logger.info "Successful authentication for '#{user.login}' from #{request.remote_ip} at #{Time.now.utc}" Chris@1296: # Valid user Chris@1296: self.logged_user = user Chris@1296: # generate a key and set cookie if autologin Chris@1296: if params[:autologin] && Setting.autologin? Chris@1296: set_autologin_cookie(user) Chris@1296: end Chris@1296: call_hook(:controller_account_success_authentication_after, {:user => user }) Chris@1296: redirect_back_or_default :controller => 'my', :action => 'page' Chris@1296: end Chris@1296: Chris@1296: def set_autologin_cookie(user) Chris@1296: token = Token.create(:user => user, :action => 'autologin') Chris@1296: cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin' Chris@1296: cookie_options = { Chris@1296: :value => token.value, Chris@1296: :expires => 1.year.from_now, Chris@1296: :path => (Redmine::Configuration['autologin_cookie_path'] || '/'), Chris@1296: :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false), Chris@1296: :httponly => true Chris@1296: } Chris@1296: cookies[cookie_name] = cookie_options Chris@1296: end Chris@1296: Chris@1296: # Onthefly creation failed, display the registration form to fill/fix attributes Chris@1296: def onthefly_creation_failed(user, auth_source_options = { }) Chris@1296: @user = user Chris@1296: session[:auth_source_registration] = auth_source_options unless auth_source_options.empty? Chris@1296: render :action => 'register' Chris@1296: end Chris@1296: Chris@1296: def invalid_credentials Chris@1296: logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}" Chris@1296: flash.now[:error] = l(:notice_account_invalid_creditentials) Chris@1296: end Chris@1296: Chris@1296: # Register a user for email activation. Chris@1296: # Chris@1296: # Pass a block for behavior when a user fails to save Chris@1296: def register_by_email_activation(user, &block) Chris@1296: token = Token.new(:user => user, :action => "register") Chris@1296: if user.save and token.save Chris@1296: Mailer.register(token).deliver Chris@1296: flash[:notice] = l(:notice_account_register_done) Chris@1296: redirect_to signin_path Chris@1296: else Chris@1296: yield if block_given? Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: # Automatically register a user Chris@1296: # Chris@1296: # Pass a block for behavior when a user fails to save Chris@1296: def register_automatically(user, &block) Chris@1296: # Automatic activation Chris@1296: user.activate Chris@1296: user.last_login_on = Time.now Chris@1296: if user.save Chris@1296: self.logged_user = user Chris@1296: flash[:notice] = l(:notice_account_activated) Chris@1296: redirect_to :controller => 'my', :action => 'account' Chris@1296: else Chris@1296: yield if block_given? Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: # Manual activation by the administrator Chris@1296: # Chris@1296: # Pass a block for behavior when a user fails to save Chris@1296: def register_manually_by_administrator(user, &block) Chris@1296: if user.save Chris@1296: # Sends an email to the administrators Chris@1296: Mailer.account_activation_request(user).deliver Chris@1296: account_pending Chris@1296: else Chris@1296: yield if block_given? Chris@1296: end Chris@1296: end Chris@1296: Chris@1296: def account_pending Chris@1296: flash[:notice] = l(:notice_account_pending) Chris@1296: redirect_to signin_path Chris@1296: end Chris@1296: end