Fix some XSS issues

[rails.git] / app / controllers / user_controller.rb

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index 4128b61d4a0982cf43ba1b79e7bfe45db3c97d05..9c5ac0d09edf8bf400c196cb14b3ec3d54096082 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -17,7 +17,7 @@ class UserController < ApplicationController
 
   filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
 
 
   filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
 

-  cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete], :unless => STATUS == :database_offline
+  cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete]

 
   def terms
     @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE
 
   def terms
     @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE


@@ -67,7 +67,7 @@ class UserController < ApplicationController
         elsif @user.terms_agreed?
           # Already agreed to terms, so just show settings
           redirect_to :action => :account, :display_name => @user.display_name
         elsif @user.terms_agreed?
           # Already agreed to terms, so just show settings
           redirect_to :action => :account, :display_name => @user.display_name

-        elsif params[:user] and params[:user][:openid_url]
+        elsif params[:user] and params[:user][:openid_url] and not params[:user][:openid_url].empty?

           # Verify OpenID before moving on
           session[:new_user] = @user
           openid_verify(params[:user][:openid_url], @user)
           # Verify OpenID before moving on
           session[:new_user] = @user
           openid_verify(params[:user][:openid_url], @user)


@@ -125,8 +125,10 @@ class UserController < ApplicationController
       @user.languages = request.user_preferred_languages
       @user.terms_agreed = Time.now.getutc
       @user.terms_seen = true
       @user.languages = request.user_preferred_languages
       @user.terms_agreed = Time.now.getutc
       @user.terms_seen = true

+      @user.openid_url = nil if @user.openid_url and @user.openid_url.empty?

       
       if @user.save
       
       if @user.save

+        flash[:piwik_goal] = PIWIK_SIGNUP_GOAL if defined?(PIWIK_SIGNUP_GOAL)

         flash[:notice] = t 'user.new.flash create success message', :email => @user.email
         Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer)))
         session[:token] = @user.tokens.create.token
         flash[:notice] = t 'user.new.flash create success message', :email => @user.email
         Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer)))
         session[:token] = @user.tokens.create.token


@@ -286,9 +288,9 @@ class UserController < ApplicationController
         if token
           token.destroy
         end
         if token
           token.destroy
         end

-        session[:token] = nil
+        session.delete(:token)

       end
       end

-      session[:user] = nil
+      session.delete(:user)

       session_expires_automatically
       if params[:referer]
         redirect_to params[:referer]
       session_expires_automatically
       if params[:referer]
         redirect_to params[:referer]


@@ -538,6 +540,10 @@ private
               failed_login t('user.login.auth failure')
           end
         else
               failed_login t('user.login.auth failure')
           end
         else

+          # Guard against not getting any extension data
+          sreg = Hash.new if sreg.nil?
+          ax = Hash.new if ax.nil?
+

           # We don't have a user registered to this OpenID, so redirect
           # to the create account page with username and email filled
           # in if they have been given by the OpenID provider through
           # We don't have a user registered to this OpenID, so redirect
           # to the create account page with username and email filled
           # in if they have been given by the OpenID provider through