Rework the signup page

[rails.git] / app / controllers / user_controller.rb

diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb
index 428a8b90c8e998e5b175568244a051ea3f04b5a3..b558311d21c4df4019e5dde63679089c0ffa9567 100644 (file)
--- a/app/controllers/user_controller.rb
+++ b/app/controllers/user_controller.rb
@@ -11,12 +11,12 @@ class UserController < ApplicationController
   before_filter :require_allow_read_prefs, :only => [:api_details]
   before_filter :require_allow_read_gpx, :only => [:api_gpx_files]
   before_filter :require_cookies, :only => [:login, :confirm]
   before_filter :require_allow_read_prefs, :only => [:api_details]
   before_filter :require_allow_read_gpx, :only => [:api_gpx_files]
   before_filter :require_cookies, :only => [:login, :confirm]

-  before_filter :require_administrator, :only => [:activate, :deactivate, :hide, :unhide, :delete]
-  before_filter :lookup_this_user, :only => [:activate, :deactivate, :hide, :unhide, :delete]
+  before_filter :require_administrator, :only => [:set_status, :delete, :list]
+  before_filter :lookup_this_user, :only => [:set_status, :delete]

 
   filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
 
 
   filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation
 

-  cache_sweeper :user_sweeper, :only => [:account, :hide, :unhide, :delete]
+  cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete]

 
   def save
     @title = t 'user.new.title'
 
   def save
     @title = t 'user.new.title'


@@ -24,7 +24,7 @@ class UserController < ApplicationController
     if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"})
       render :action => 'new'
     else
     if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"})
       render :action => 'new'
     else

-         #The redirect from the OpenID provider reenters here again 
+      #The redirect from the OpenID provider reenters here again 

       #and we need to pass the parameters through to the  
       #open_id_authentication function a second time 
       if params[:open_id_complete] 
       #and we need to pass the parameters through to the  
       #open_id_authentication function a second time 
       if params[:open_id_complete] 


@@ -36,59 +36,59 @@ class UserController < ApplicationController
           return 
         end   
       else
           return 
         end   
       else

-      @user = User.new(params[:user])
+        @user = User.new(params[:user])

 
 

-      @user.visible = true
-      @user.data_public = true
-      @user.description = "" if @user.description.nil?
-      @user.creation_ip = request.remote_ip
-      @user.languages = request.user_preferred_languages
+        @user.status = "pending"
+        @user.data_public = true
+        @user.description = "" if @user.description.nil?
+        @user.creation_ip = request.remote_ip
+        @user.languages = request.user_preferred_languages

         #Set the openid_url to nil as for one it is used 
         #to check if the openid could be validated and secondly 
         #to not get dupplicate conflicts for an empty openid  
         @user.openid_url = nil
 
         #Set the openid_url to nil as for one it is used 
         #to check if the openid could be validated and secondly 
         #to not get dupplicate conflicts for an empty openid  
         @user.openid_url = nil
 

-if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
-                 if @user.pass_crypt.length == 0 
+        if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
+          if (@user.pass_crypt.nil? or @user.pass_crypt.length == 0)

             #if the password is empty, but we have a openid 
             #then generate a random passowrd to disable 
             #loging in via password 
             @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) 
             @user.pass_crypt_confirmation = @user.pass_crypt 
           end
             #if the password is empty, but we have a openid 
             #then generate a random passowrd to disable 
             #loging in via password 
             @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) 
             @user.pass_crypt_confirmation = @user.pass_crypt 
           end

-                 #Validate all of the other fields before
-                 #redirecting to the openid provider
-                 if !@user.valid?
-                       render :action => 'new'
-                 else            
-                       #TODO: Is it a problem to store the user variable with respect to password safty in the session variables?
-                       #Store the user variable in the session for it to be accessible when redirecting back from the openid provider
-                       session[:new_usr] = @user
-                       begin
-                         @norm_openid_url = OpenIdAuthentication.normalize_identifier(params[:user][:openid_url])
-                       rescue
-                         flash.now[:error] = t 'user.login.openid invalid'
-                         render :action => 'new'
-                         return
-                       end
-                       #Verify that the openid provided is valid and that the user is the owner of the id
-                       openid_verify(@norm_openid_url, true)
-                       #openid_verify can return in two ways:
-                       #Either it returns with a redirect to the openid provider who then freshly
-                       #redirects back to this url if the openid is valid, or if the openid is not plausible
-                       #and no provider for it could be found it just returns
-                       #we want to just let the redirect through
-                       if response.headers["Location"].nil?
-                         render :action => 'new'
-                       end
-                 end
-                 #At this point there was either an error and the page has been rendered,
-                 #or there is a redirect to the openid provider and the rest of the method
-                 #gets executed whenn this method gets reentered after redirecting back
-                 #from the openid provider
-                 return
-               end
-         end
+          #Validate all of the other fields before
+          #redirecting to the openid provider
+          if !@user.valid?
+            render :action => 'new'
+          else        
+            #TODO: Is it a problem to store the user variable with respect to password safty in the session variables?
+            #Store the user variable in the session for it to be accessible when redirecting back from the openid provider
+            session[:new_usr] = @user
+            begin
+              @norm_openid_url = OpenIdAuthentication.normalize_identifier(params[:user][:openid_url])
+            rescue
+              flash.now[:error] = t 'user.login.openid invalid'
+              render :action => 'new'
+              return
+            end
+            #Verify that the openid provided is valid and that the user is the owner of the id
+            openid_verify(@norm_openid_url, true)
+            #openid_verify can return in two ways:
+            #Either it returns with a redirect to the openid provider who then freshly
+            #redirects back to this url if the openid is valid, or if the openid is not plausible
+            #and no provider for it could be found it just returns
+            #we want to just let the redirect through
+            if response.headers["Location"].nil?
+              render :action => 'new'
+            end
+          end
+          #At this point there was either an error and the page has been rendered,
+          #or there is a redirect to the openid provider and the rest of the method
+          #gets executed whenn this method gets reentered after redirecting back
+          #from the openid provider
+          return
+        end
+      end

 
       if @user.save
         flash[:notice] = t 'user.new.flash create success message'
 
       if @user.save
         flash[:notice] = t 'user.new.flash create success message'


@@ -104,12 +104,12 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
     @title = t 'user.account.title'
     @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null'
 
     @title = t 'user.account.title'
     @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null'
 

-       #The redirect from the OpenID provider reenters here again
+    #The redirect from the OpenID provider reenters here again

     #and we need to pass the parameters through to the 
     #open_id_authentication function
     if params[:open_id_complete]
       openid_verify('', false)
     #and we need to pass the parameters through to the 
     #open_id_authentication function
     if params[:open_id_complete]
       openid_verify('', false)

-         @user.save
+      @user.save

       return
     end
 
       return
     end
 


@@ -133,13 +133,15 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
       @user.home_lat = params[:user][:home_lat]
       @user.home_lon = params[:user][:home_lon]
 
       @user.home_lat = params[:user][:home_lat]
       @user.home_lon = params[:user][:home_lon]
 

+      @user.openid_url = nil if (params[:user][:openid_url].length == 0)
+

       if @user.save
         set_locale
 
         if @user.new_email.nil? or @user.new_email.empty?
       if @user.save
         set_locale
 
         if @user.new_email.nil? or @user.new_email.empty?

-          flash.now[:notice] = t 'user.account.flash update success'
+          flash[:notice] = t 'user.account.flash update success'

         else
         else

-          flash.now[:notice] = t 'user.account.flash update success confirm needed'
+          flash[:notice] = t 'user.account.flash update success confirm needed'

 
           begin
             Notifier.deliver_email_confirm(@user, @user.tokens.create)
 
           begin
             Notifier.deliver_email_confirm(@user, @user.tokens.create)


@@ -147,20 +149,22 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
             # Ignore errors sending email
           end
         end
             # Ignore errors sending email
           end
         end

+
+        redirect_to :action => "account", :display_name => @user.display_name

       end
 
       end
 

-         if (params[:user][:openid_url].length > 0)
-               begin
-                 @norm_openid_url = OpenIdAuthentication.normalize_identifier(params[:user][:openid_url])
-                 if (@norm_openid_url != @user.openid_url)
-                       #If the OpenID has changed, we want to check that it is a valid OpenID and one
-                       #the user has control over before saving the openID as a password equivalent for
-                       #the user.
-                       openid_verify(@norm_openid_url, false)
-                 end
-               rescue
-                 flash.now[:error] = t 'user.login.openid invalid'
-               end
+      if (params[:user][:openid_url].length > 0)
+        begin
+          @norm_openid_url = OpenIdAuthentication.normalize_identifier(params[:user][:openid_url])
+          if (@norm_openid_url != @user.openid_url)
+            #If the OpenID has changed, we want to check that it is a valid OpenID and one
+            #the user has control over before saving the openID as a password equivalent for
+            #the user.
+            openid_verify(@norm_openid_url, false)
+          end
+        rescue
+          flash.now[:error] = t 'user.login.openid invalid'
+        end

       end
 
     else
       end
 
     else


@@ -192,20 +196,20 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
         #e.g. one can simply enter yahoo.com in the login box, i.e. no user specific url
         #only once it comes back from the OpenID provider do we know the unique address for
         #the user.
         #e.g. one can simply enter yahoo.com in the login box, i.e. no user specific url
         #only once it comes back from the OpenID provider do we know the unique address for
         #the user.

-               @user = session[:new_usr] unless @user #this is used for account creation when the user is not yet in the database
+        @user = session[:new_usr] unless @user #this is used for account creation when the user is not yet in the database

         @user.openid_url = identity_url
         @user.openid_url = identity_url

-         elsif result.missing?
-               mapped_id = openid_specialcase_mapping(openid_url)
-               if mapped_id
-                 openid_verify(mapped_id, account_create)
-               else
-                 flash.now[:error] = t 'user.login.openid missing provider'
-               end
-         elsif result.invalid?
-               flash.now[:error] = t 'user.login.openid invalid'
-         else
-               flash.now[:error] = t 'user.login.auth failure'
-         end
+      elsif result.missing?
+        mapped_id = openid_specialcase_mapping(openid_url)
+        if mapped_id
+          openid_verify(mapped_id, account_create)
+        else
+          flash.now[:error] = t 'user.login.openid missing provider'
+        end
+      elsif result.invalid?
+        flash.now[:error] = t 'user.login.openid invalid'
+      else
+        flash.now[:error] = t 'user.login.auth failure'
+      end

     end
   end
 
     end
   end
 


@@ -215,6 +219,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
     #don't want to duplicate the do block
     #On the other hand it also doesn't matter too much if we ask every time, as the OpenID provider should
     #remember these results, and shouldn't repromt the user for these data each time.
     #don't want to duplicate the do block
     #On the other hand it also doesn't matter too much if we ask every time, as the OpenID provider should
     #remember these results, and shouldn't repromt the user for these data each time.

+    user = nil

     authenticate_with_open_id(openid_url, :return_to => request.protocol + request.host_with_port + '/login?referer=' + params[:referer], :optional => [:nickname, :email]) do |result, identity_url, registration|
       if result.successful?
         #We need to use the openid url passed back from the OpenID provider
     authenticate_with_open_id(openid_url, :return_to => request.protocol + request.host_with_port + '/login?referer=' + params[:referer], :optional => [:nickname, :email]) do |result, identity_url, registration|
       if result.successful?
         #We need to use the openid url passed back from the OpenID provider


@@ -226,7 +231,8 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
         if user
           if user.visible? and user.active?
             session[:user] = user.id
         if user
           if user.visible? and user.active?
             session[:user] = user.id

-                       session_expires_after 1.month if session[:remember]
+            session_expires_after 1.month if session[:remember]
+            return user

           else
             user = nil
             flash.now[:error] = t 'user.login.account not active'
           else
             user = nil
             flash.now[:error] = t 'user.login.account not active'


@@ -253,8 +259,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
            end
       end
     end
            end
       end
     end

-
-    user
+    return user

   end
 
   def go_public
   end
 
   def go_public


@@ -268,7 +273,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
     @title = t 'user.lost_password.title'
 
     if params[:user] and params[:user][:email]
     @title = t 'user.lost_password.title'
 
     if params[:user] and params[:user][:email]

-      user = User.find_by_email(params[:user][:email], :conditions => {:visible => true})
+      user = User.find_by_email(params[:user][:email], :conditions => {:status => ["pending", "active", "confirmed"]})

 
       if user
         token = user.tokens.create
 
       if user
         token = user.tokens.create


@@ -293,7 +298,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
         if params[:user]
           @user.pass_crypt = params[:user][:pass_crypt]
           @user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]
         if params[:user]
           @user.pass_crypt = params[:user][:pass_crypt]
           @user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation]

-          @user.active = true
+          @user.status = "active" if @user.status == "pending"

           @user.email_valid = true
 
           if @user.save
           @user.email_valid = true
 
           if @user.save


@@ -316,9 +321,13 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
     # page, instead send them to the home page
     redirect_to :controller => 'site', :action => 'index' if session[:user]
 
     # page, instead send them to the home page
     redirect_to :controller => 'site', :action => 'index' if session[:user]
 

-       @nickname = params['nickname']
+    @nickname = params['nickname']

     @email = params['email']
     @email = params['email']

-       @openID = params['openid']
+    @openID = params['openid']
+       
+    if !params['openid'].nil?
+      flash.now[:notice] = t 'user.new.openid association'
+    end

   end
 
   def login
   end
 
   def login


@@ -332,7 +341,10 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
     elsif params[:user]
       if !params[:user][:openid_url].nil? and !params[:user][:openid_url].empty?
         session[:remember] = params[:remember_me]
     elsif params[:user]
       if !params[:user][:openid_url].nil? and !params[:user][:openid_url].empty?
         session[:remember] = params[:remember_me]

-        user = open_id_authentication(params[:user][:openid_url])
+        #construct the openid request. This will redirect to the OpenID server to ask for validation
+        #The external OpenID server will then redirect back to the login method and reenters at the top
+        open_id_authentication(params[:user][:openid_url])
+        return

       else
         email_or_display_name = params[:user][:email]
         pass = params[:user][:password]
       else
         email_or_display_name = params[:user][:email]
         pass = params[:user][:password]


@@ -340,8 +352,10 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
         if user = User.authenticate(:username => email_or_display_name, :password => pass)
           session[:user] = user.id
           session_expires_after 1.month if params[:remember_me]
         if user = User.authenticate(:username => email_or_display_name, :password => pass)
           session[:user] = user.id
           session_expires_after 1.month if params[:remember_me]

-        elsif User.authenticate(:username => email_or_display_name, :password => pass, :inactive => true)
+        elsif User.authenticate(:username => email_or_display_name, :password => pass, :pending => true)

           flash.now[:error] = t 'user.login.account not active'
           flash.now[:error] = t 'user.login.account not active'

+        elsif User.authenticate(:username => email_or_display_name, :password => pass, :suspended => true)
+          flash.now[:error] = t 'user.login.account suspended'

         else
           flash.now[:error] = t 'user.login.auth failure'
         end
         else
           flash.now[:error] = t 'user.login.auth failure'
         end


@@ -388,7 +402,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
       token = UserToken.find_by_token(params[:confirm_string])
       if token and !token.user.active?
         @user = token.user
       token = UserToken.find_by_token(params[:confirm_string])
       if token and !token.user.active?
         @user = token.user

-        @user.active = true
+        @user.status = "active"

         @user.email_valid = true
         @user.save!
         referer = token.referer
         @user.email_valid = true
         @user.save!
         referer = token.referer


@@ -413,7 +427,6 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
         @user = token.user
         @user.email = @user.new_email
         @user.new_email = nil
         @user = token.user
         @user.email = @user.new_email
         @user.new_email = nil

-        @user.active = true

         @user.email_valid = true
         if @user.save
           flash[:notice] = t 'user.confirm_email.success'
         @user.email_valid = true
         if @user.save
           flash[:notice] = t 'user.confirm_email.success'


@@ -453,7 +466,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
   def make_friend
     if params[:display_name]
       name = params[:display_name]
   def make_friend
     if params[:display_name]
       name = params[:display_name]

-      new_friend = User.find_by_display_name(name, :conditions => {:visible => true})
+      new_friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]})

       friend = Friend.new
       friend.user_id = @user.id
       friend.friend_user_id = new_friend.id
       friend = Friend.new
       friend.user_id = @user.id
       friend.friend_user_id = new_friend.id


@@ -479,7 +492,7 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
   def remove_friend
     if params[:display_name]
       name = params[:display_name]
   def remove_friend
     if params[:display_name]
       name = params[:display_name]

-      friend = User.find_by_display_name(name, :conditions => {:visible => true})
+      friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]})

       if @user.is_friends_with?(friend)
         Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}"
         flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name
       if @user.is_friends_with?(friend)
         Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}"
         flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name


@@ -496,47 +509,57 @@ if (!params[:user][:openid_url].nil? and params[:user][:openid_url].length > 0)
   end
 
   ##
   end
 
   ##

-  # activate a user, allowing them to log in
-  def activate
-    @this_user.update_attributes(:active => true)
+  # sets a user's status
+  def set_status
+    @this_user.update_attributes(:status => params[:status])

     redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
   end
 
   ##
     redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
   end
 
   ##

-  # deactivate a user, preventing them from logging in
-  def deactivate
-    @this_user.update_attributes(:active => false)
+  # delete a user, marking them as deleted and removing personal data
+  def delete
+    @this_user.delete

     redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
   end
 
   ##
     redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
   end
 
   ##

-  # hide a user, marking them as logically deleted
-  def hide
-    @this_user.update_attributes(:visible => false)
-    redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
-  end
+  # display a list of users matching specified criteria
+  def list
+    if request.post?
+      ids = params[:user].keys.collect { |id| id.to_i }

 
 

-  ##
-  # unhide a user, clearing the logically deleted flag
-  def unhide
-    @this_user.update_attributes(:visible => true)
-    redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
-  end
+      User.update_all("status = 'confirmed'", :id => ids) if params[:confirm]
+      User.update_all("status = 'deleted'", :id => ids) if params[:hide]

 
 

-  ##
-  # delete a user, marking them as deleted and removing personal data
-  def delete
-    @this_user.delete
-    redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
+      redirect_to url_for(:status => params[:status], :ip => params[:ip], :page => params[:page])
+    else
+      conditions = Hash.new
+      conditions[:status] = params[:status] if params[:status]
+      conditions[:creation_ip] = params[:ip] if params[:ip]
+
+      @user_pages, @users = paginate(:users,
+                                     :conditions => conditions,
+                                     :order => :id,
+                                     :per_page => 50)
+    end

   end
   end

+

 private
 private

+

   ##
   # require that the user is a administrator, or fill out a helpful error message
   # and return them to the user page.
   def require_administrator
   ##
   # require that the user is a administrator, or fill out a helpful error message
   # and return them to the user page.
   def require_administrator

-    unless @user.administrator?
+    if @user and not @user.administrator?

       flash[:error] = t('user.filter.not_an_administrator')
       flash[:error] = t('user.filter.not_an_administrator')

-      redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
+
+      if params[:display_name]
+        redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name]
+      else
+        redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri
+      end
+    elsif not @user
+      redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri

     end
   end
 
     end
   end