X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/067b0de4391a32124aef23c56d73e2bb492df8ca..9416317e6428e8b6a801edba8bbbc27ee27dc7cc:/app/controllers/sessions_controller.rb diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index ba2858ce4..a3e6f42f0 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -11,28 +11,27 @@ class SessionsController < ApplicationController authorize_resource :class => false + allow_all_form_action :only => :new + def new - override_content_security_policy_directives(:form_action => []) if Settings.csp_enforce || Settings.key?(:csp_report_url) + referer = safe_referer(params[:referer]) if params[:referer] - session[:referer] = safe_referer(params[:referer]) if params[:referer] + parse_oauth_referer referer end def create session[:remember_me] ||= params[:remember_me] - session[:referer] = safe_referer(params[:referer]) if params[:referer] - password_authentication(params[:username], params[:password]) + + referer = safe_referer(params[:referer]) if params[:referer] + + password_authentication(params[:username].strip, params[:password], referer) end def destroy @title = t ".title" if request.post? - if session[:token] - token = UserToken.find_by(:token => session[:token]) - token&.destroy - session.delete(:token) - end - + session.delete(:pending_user) session.delete(:user) session_expires_automatically @@ -46,15 +45,15 @@ class SessionsController < ApplicationController ## # handle password authentication - def password_authentication(username, password) + def password_authentication(username, password, referer = nil) if (user = User.authenticate(:username => username, :password => password)) - successful_login(user) + successful_login(user, referer) elsif (user = User.authenticate(:username => username, :password => password, :pending => true)) - unconfirmed_login(user) + unconfirmed_login(user, referer) elsif User.authenticate(:username => username, :password => password, :suspended => true) - failed_login({ :partial => "sessions/suspended_flash" }, username) + failed_login({ :partial => "sessions/suspended_flash" }, username, referer) else - failed_login t("sessions.new.auth failure"), username + failed_login(t("sessions.new.auth failure"), username, referer) end end end