app/controllers/sessions_controller.rb

   1 class SessionsController < ApplicationController
   2   include SessionMethods
   3
   4   layout "site"
   5
   6   before_action :disable_terms_redirect, :only => [:destroy]
   7   before_action :require_cookies, :only => [:new]
   8
   9   authorize_resource :class => false
  10
  11   def new
  12     append_content_security_policy_directives(
  13       :form_action => %w[*]
  14     )
  15
  16     session[:referer] = safe_referer(params[:referer]) if params[:referer]
  17   end
  18
  19   def create
  20     session[:remember_me] ||= params[:remember_me]
  21     session[:referer] = safe_referer(params[:referer]) if params[:referer]
  22     password_authentication(params[:username], params[:password])
  23   end
  24
  25   def destroy
  26     @title = t "sessions.destroy.title"
  27
  28     if request.post?
  29       if session[:token]
  30         token = UserToken.find_by(:token => session[:token])
  31         token&.destroy
  32         session.delete(:token)
  33       end
  34       session.delete(:user)
  35       session_expires_automatically
  36       if params[:referer]
  37         redirect_to safe_referer(params[:referer])
  38       else
  39         redirect_to :controller => "site", :action => "index"
  40       end
  41     end
  42   end
  43
  44   private
  45
  46   ##
  47   # handle password authentication
  48   def password_authentication(username, password)
  49     if (user = User.authenticate(:username => username, :password => password))
  50       successful_login(user)
  51     elsif (user = User.authenticate(:username => username, :password => password, :pending => true))
  52       unconfirmed_login(user)
  53     elsif User.authenticate(:username => username, :password => password, :suspended => true)
  54       failed_login t("sessions.new.account is suspended", :webmaster => "mailto:#{Settings.support_email}").html_safe, username
  55     else
  56       failed_login t("sessions.new.auth failure"), username
  57     end
  58   end
  59 end