Merge remote-tracking branch 'upstream/pull/2418'

[rails.git] / app / controllers / users_controller.rb

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 91742c7613aec51dc4d14ed6cf163b1ca82341c2..345bae2616607dde518f25de11b968ae8c08380e 100644 (file)
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -5,11 +5,11 @@ class UsersController < ApplicationController
   before_action :disable_terms_redirect, :only => [:terms, :save, :logout]
   before_action :authorize_web
   before_action :set_locale
+  before_action :check_database_readable
 
   authorize_resource
 
   before_action :require_self, :only => [:account]
-  before_action :check_database_readable, :except => [:login]
   before_action :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public, :make_friend, :remove_friend]
   before_action :require_cookies, :only => [:new, :login, :confirm]
   before_action :lookup_user_by_name, :only => [:set_status, :delete]
@@ -36,7 +36,7 @@ class UsersController < ApplicationController
   def save
     @title = t "users.new.title"
 
-    if params[:decline]
+    if params[:decline] || !(params[:read_tou] && params[:read_ct])
       if current_user
         current_user.terms_seen = true
 
@@ -47,12 +47,15 @@ class UsersController < ApplicationController
         else
           redirect_to :action => :account, :display_name => current_user.display_name
         end
-      else
+      elsif params[:decline]
         redirect_to t("users.terms.declined")
+      else
+        redirect_to :action => :terms
       end
     elsif current_user
       unless current_user.terms_agreed?
         current_user.consider_pd = params[:user][:consider_pd]
+        current_user.tou_agreed = Time.now.getutc
         current_user.terms_agreed = Time.now.getutc
         current_user.terms_seen = true
 
@@ -73,6 +76,7 @@ class UsersController < ApplicationController
         current_user.creation_ip = request.remote_ip
         current_user.languages = http_accept_language.user_preferred_languages
         current_user.terms_agreed = Time.now.getutc
+        current_user.tou_agreed = Time.now.getutc
         current_user.terms_seen = true
 
         if current_user.auth_uid.blank?
@@ -384,16 +388,16 @@ class UsersController < ApplicationController
 
     if @new_friend
       if request.post?
-        friend = Friend.new
-        friend.befriender = current_user
-        friend.befriendee = @new_friend
+        friendship = Friendship.new
+        friendship.befriender = current_user
+        friendship.befriendee = @new_friend
         if current_user.is_friends_with?(@new_friend)
           flash[:warning] = t "users.make_friend.already_a_friend", :name => @new_friend.display_name
-        elsif friend.save
+        elsif friendship.save
           flash[:notice] = t "users.make_friend.success", :name => @new_friend.display_name
-          Notifier.friend_notification(friend).deliver_later
+          Notifier.friend_notification(friendship).deliver_later
         else
-          friend.add_error(t("users.make_friend.failed", :name => @new_friend.display_name))
+          friendship.add_error(t("users.make_friend.failed", :name => @new_friend.display_name))
         end
 
         if params[:referer]
@@ -413,7 +417,7 @@ class UsersController < ApplicationController
     if @friend
       if request.post?
         if current_user.is_friends_with?(@friend)
-          Friend.where(:user_id => current_user.id, :friend_user_id => @friend.id).delete_all
+          Friendship.where(:befriender => current_user, :befriendee => @friend).delete_all
           flash[:notice] = t "users.remove_friend.success", :name => @friend.display_name
         else
           flash[:error] = t "users.remove_friend.not_a_friend", :name => @friend.display_name
@@ -516,11 +520,11 @@ class UsersController < ApplicationController
 
       if user
         case user.status
-        when "pending" then
+        when "pending"
           unconfirmed_login(user)
-        when "active", "confirmed" then
+        when "active", "confirmed"
           successful_login(user, request.env["omniauth.params"]["referer"])
-        when "suspended" then
+        when "suspended"
           failed_login t("users.login.account is suspended", :webmaster => "mailto:#{Settings.support_email}").html_safe
         else
           failed_login t("users.login.auth failure")
@@ -656,15 +660,15 @@ class UsersController < ApplicationController
 
     user.languages = params[:user][:languages].split(",")
 
-    case params[:image_action]
+    case params[:avatar_action]
     when "new" then
-      user.image = params[:user][:image]
+      user.avatar.attach(params[:user][:avatar])
       user.image_use_gravatar = false
     when "delete" then
-      user.image = nil
+      user.avatar.purge_later
       user.image_use_gravatar = false
     when "gravatar" then
-      user.image = nil
+      user.avatar.purge_later
       user.image_use_gravatar = true
     end
 
@@ -748,7 +752,13 @@ class UsersController < ApplicationController
                email.split("@").last
              end
 
-    if blocked = Acl.no_account_creation(request.remote_ip, domain)
+    mx_servers = if domain.nil?
+                   nil
+                 else
+                   domain_mx_servers(domain)
+                 end
+
+    if blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers)
       logger.info "Blocked signup from #{request.remote_ip} for #{email}"
 
       render :action => "blocked"
@@ -757,11 +767,19 @@ class UsersController < ApplicationController
     !blocked
   end
 
+  ##
+  # get list of MX servers for a domains
+  def domain_mx_servers(domain)
+    Resolv::DNS.open do |dns|
+      dns.getresources(domain, Resolv::DNS::Resource::IN::MX).collect(&:exchange).collect(&:to_s)
+    end
+  end
+
   ##
   # check if this user has a gravatar and set the user pref is true
   def gravatar_enable(user)
     # code from example https://en.gravatar.com/site/implement/images/ruby/
-    return false if user.image.present?
+    return false if user.avatar.attached?
 
     hash = Digest::MD5.hexdigest(user.email.downcase)
     url = "https://www.gravatar.com/avatar/#{hash}?d=404" # without d=404 we will always get an image back