app/controllers/sessions_controller.rb

   1 class SessionsController < ApplicationController
   2   include SessionMethods
   3
   4   layout "site"
   5
   6   before_action :disable_terms_redirect, :only => [:destroy]
   7   before_action :authorize_web
   8   before_action :set_locale
   9   before_action :check_database_readable
  10   before_action :require_cookies, :only => [:new]
  11
  12   authorize_resource :class => false
  13
  14   allow_all_form_action :only => :new
  15
  16   def new
  17     referer = safe_referer(params[:referer]) if params[:referer]
  18
  19     parse_oauth_referer referer
  20   end
  21
  22   def create
  23     session[:remember_me] = params[:remember_me] == "yes"
  24
  25     referer = safe_referer(params[:referer]) if params[:referer]
  26
  27     password_authentication(params[:username].strip, params[:password], referer)
  28   end
  29
  30   def destroy
  31     @title = t ".title"
  32
  33     if request.post?
  34       session.delete(:pending_user)
  35       session.delete(:user)
  36       session_expires_automatically
  37
  38       referer = safe_referer(params[:referer]) if params[:referer]
  39
  40       redirect_to referer || { :controller => "site", :action => "index" }
  41     end
  42   end
  43
  44   private
  45
  46   ##
  47   # handle password authentication
  48   def password_authentication(username, password, referer = nil)
  49     if (user = User.authenticate(:username => username, :password => password))
  50       successful_login(user, referer)
  51     elsif (user = User.authenticate(:username => username, :password => password, :pending => true))
  52       unconfirmed_login(user, referer)
  53     elsif User.authenticate(:username => username, :password => password, :suspended => true)
  54       failed_login({ :partial => "sessions/suspended_flash" }, username, referer)
  55     else
  56       failed_login(t("sessions.new.auth failure"), username, referer)
  57     end
  58   end
  59 end