Chris@909: # Redmine - project management software Chris@909: # Copyright (C) 2006-2011 Jean-Philippe Lang Chris@909: # Chris@909: # This program is free software; you can redistribute it and/or Chris@909: # modify it under the terms of the GNU General Public License Chris@909: # as published by the Free Software Foundation; either version 2 Chris@909: # of the License, or (at your option) any later version. Chris@909: # Chris@909: # This program is distributed in the hope that it will be useful, Chris@909: # but WITHOUT ANY WARRANTY; without even the implied warranty of Chris@909: # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the Chris@909: # GNU General Public License for more details. Chris@909: # Chris@909: # You should have received a copy of the GNU General Public License Chris@909: # along with this program; if not, write to the Free Software Chris@909: # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. Chris@909: Chris@909: class AccountController < ApplicationController Chris@909: helper :custom_fields Chris@909: include CustomFieldsHelper Chris@909: Chris@909: # prevents login action to be filtered by check_if_login_required application scope filter Chris@909: skip_before_filter :check_if_login_required Chris@909: Chris@909: # Login request and validation Chris@909: def login Chris@909: if request.get? Chris@909: logout_user Chris@909: else Chris@909: authenticate_user Chris@909: end Chris@909: end Chris@909: Chris@909: # Log out current user and redirect to welcome page Chris@909: def logout Chris@909: logout_user Chris@909: redirect_to home_url Chris@909: end Chris@909: Chris@909: # Enable user to choose a new password Chris@909: def lost_password Chris@909: redirect_to(home_url) && return unless Setting.lost_password? Chris@909: if params[:token] Chris@909: @token = Token.find_by_action_and_value("recovery", params[:token]) Chris@909: redirect_to(home_url) && return unless @token and !@token.expired? Chris@909: @user = @token.user Chris@909: if request.post? Chris@909: @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation] Chris@909: if @user.save Chris@909: @token.destroy Chris@909: flash[:notice] = l(:notice_account_password_updated) Chris@909: redirect_to :action => 'login' Chris@909: return Chris@909: end Chris@909: end Chris@909: render :template => "account/password_recovery" Chris@909: return Chris@909: else Chris@909: if request.post? Chris@909: user = User.find_by_mail(params[:mail]) Chris@909: # user not found in db Chris@909: (flash.now[:error] = l(:notice_account_unknown_email); return) unless user Chris@909: # user uses an external authentification Chris@909: (flash.now[:error] = l(:notice_can_t_change_password); return) if user.auth_source_id Chris@909: # create a new token for password recovery Chris@909: token = Token.new(:user => user, :action => "recovery") Chris@909: if token.save Chris@909: Mailer.deliver_lost_password(token) Chris@909: flash[:notice] = l(:notice_account_lost_email_sent) Chris@909: redirect_to :action => 'login' Chris@909: return Chris@909: end Chris@909: end Chris@909: end Chris@909: end Chris@909: Chris@909: # User self-registration Chris@909: def register Chris@909: redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration] Chris@909: if request.get? Chris@909: session[:auth_source_registration] = nil Chris@909: @user = User.new(:language => Setting.default_language) Chris@909: else Chris@909: @user = User.new(params[:user]) Chris@909: @user.admin = false Chris@909: @user.register Chris@909: if session[:auth_source_registration] Chris@909: @user.activate Chris@909: @user.login = session[:auth_source_registration][:login] Chris@909: @user.auth_source_id = session[:auth_source_registration][:auth_source_id] Chris@909: if @user.save Chris@909: session[:auth_source_registration] = nil Chris@909: self.logged_user = @user Chris@909: flash[:notice] = l(:notice_account_activated) Chris@909: redirect_to :controller => 'my', :action => 'account' Chris@909: end Chris@909: else Chris@909: @user.login = params[:user][:login] Chris@909: @user.password, @user.password_confirmation = params[:password], params[:password_confirmation] Chris@909: Chris@909: case Setting.self_registration Chris@909: when '1' Chris@909: register_by_email_activation(@user) Chris@909: when '3' Chris@909: register_automatically(@user) Chris@909: else Chris@909: register_manually_by_administrator(@user) Chris@909: end Chris@909: end Chris@909: end Chris@909: end Chris@909: Chris@909: # Token based account activation Chris@909: def activate Chris@909: redirect_to(home_url) && return unless Setting.self_registration? && params[:token] Chris@909: token = Token.find_by_action_and_value('register', params[:token]) Chris@909: redirect_to(home_url) && return unless token and !token.expired? Chris@909: user = token.user Chris@909: redirect_to(home_url) && return unless user.registered? Chris@909: user.activate Chris@909: if user.save Chris@909: token.destroy Chris@909: flash[:notice] = l(:notice_account_activated) Chris@909: end Chris@909: redirect_to :action => 'login' Chris@909: end Chris@909: Chris@909: private Chris@909: Chris@909: def logout_user Chris@909: if User.current.logged? Chris@909: cookies.delete :autologin Chris@909: Token.delete_all(["user_id = ? AND action = ?", User.current.id, 'autologin']) Chris@909: self.logged_user = nil Chris@909: end Chris@909: end Chris@909: Chris@909: def authenticate_user Chris@909: if Setting.openid? && using_open_id? Chris@909: open_id_authenticate(params[:openid_url]) Chris@909: else Chris@909: password_authentication Chris@909: end Chris@909: end Chris@909: Chris@909: def password_authentication Chris@909: user = User.try_to_login(params[:username], params[:password]) Chris@909: Chris@909: if user.nil? Chris@909: invalid_credentials Chris@909: elsif user.new_record? Chris@909: onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id }) Chris@909: else Chris@909: # Valid user Chris@909: successful_authentication(user) Chris@909: end Chris@909: end Chris@909: Chris@909: def open_id_authenticate(openid_url) Chris@909: authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url) do |result, identity_url, registration| Chris@909: if result.successful? Chris@909: user = User.find_or_initialize_by_identity_url(identity_url) Chris@909: if user.new_record? Chris@909: # Self-registration off Chris@909: redirect_to(home_url) && return unless Setting.self_registration? Chris@909: Chris@909: # Create on the fly Chris@909: user.login = registration['nickname'] unless registration['nickname'].nil? Chris@909: user.mail = registration['email'] unless registration['email'].nil? Chris@909: user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil? Chris@909: user.random_password Chris@909: user.register Chris@909: Chris@909: case Setting.self_registration Chris@909: when '1' Chris@909: register_by_email_activation(user) do Chris@909: onthefly_creation_failed(user) Chris@909: end Chris@909: when '3' Chris@909: register_automatically(user) do Chris@909: onthefly_creation_failed(user) Chris@909: end Chris@909: else Chris@909: register_manually_by_administrator(user) do Chris@909: onthefly_creation_failed(user) Chris@909: end Chris@909: end Chris@909: else Chris@909: # Existing record Chris@909: if user.active? Chris@909: successful_authentication(user) Chris@909: else Chris@909: account_pending Chris@909: end Chris@909: end Chris@909: end Chris@909: end Chris@909: end Chris@909: Chris@909: def successful_authentication(user) Chris@909: # Valid user Chris@909: self.logged_user = user Chris@909: # generate a key and set cookie if autologin Chris@909: if params[:autologin] && Setting.autologin? Chris@909: set_autologin_cookie(user) Chris@909: end Chris@909: call_hook(:controller_account_success_authentication_after, {:user => user }) Chris@909: redirect_back_or_default :controller => 'my', :action => 'page' Chris@909: end Chris@909: Chris@909: def set_autologin_cookie(user) Chris@909: token = Token.create(:user => user, :action => 'autologin') Chris@909: cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin' Chris@909: cookie_options = { Chris@909: :value => token.value, Chris@909: :expires => 1.year.from_now, Chris@909: :path => (Redmine::Configuration['autologin_cookie_path'] || '/'), Chris@909: :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false), Chris@909: :httponly => true Chris@909: } Chris@909: cookies[cookie_name] = cookie_options Chris@909: end Chris@909: Chris@909: # Onthefly creation failed, display the registration form to fill/fix attributes Chris@909: def onthefly_creation_failed(user, auth_source_options = { }) Chris@909: @user = user Chris@909: session[:auth_source_registration] = auth_source_options unless auth_source_options.empty? Chris@909: render :action => 'register' Chris@909: end Chris@909: Chris@909: def invalid_credentials Chris@909: logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}" Chris@909: flash.now[:error] = l(:notice_account_invalid_creditentials) Chris@909: end Chris@909: Chris@909: # Register a user for email activation. Chris@909: # Chris@909: # Pass a block for behavior when a user fails to save Chris@909: def register_by_email_activation(user, &block) Chris@909: token = Token.new(:user => user, :action => "register") Chris@909: if user.save and token.save Chris@909: Mailer.deliver_register(token) Chris@909: flash[:notice] = l(:notice_account_register_done) Chris@909: redirect_to :action => 'login' Chris@909: else Chris@909: yield if block_given? Chris@909: end Chris@909: end Chris@909: Chris@909: # Automatically register a user Chris@909: # Chris@909: # Pass a block for behavior when a user fails to save Chris@909: def register_automatically(user, &block) Chris@909: # Automatic activation Chris@909: user.activate Chris@909: user.last_login_on = Time.now Chris@909: if user.save Chris@909: self.logged_user = user Chris@909: flash[:notice] = l(:notice_account_activated) Chris@909: redirect_to :controller => 'my', :action => 'account' Chris@909: else Chris@909: yield if block_given? Chris@909: end Chris@909: end Chris@909: Chris@909: # Manual activation by the administrator Chris@909: # Chris@909: # Pass a block for behavior when a user fails to save Chris@909: def register_manually_by_administrator(user, &block) Chris@909: if user.save Chris@909: # Sends an email to the administrators Chris@909: Mailer.deliver_account_activation_request(user) Chris@909: account_pending Chris@909: else Chris@909: yield if block_given? Chris@909: end Chris@909: end Chris@909: Chris@909: def account_pending Chris@909: flash[:notice] = l(:notice_account_pending) Chris@909: redirect_to :action => 'login' Chris@909: end Chris@909: end