X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/0b189373848583f848439516a1471f103af9bf0e..e488e4cf6780f651c986e6450fa9c1d80560e900:/app/controllers/sessions_controller.rb?ds=sidebyside diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index fdf2df6a7..a3e6f42f0 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -11,18 +11,20 @@ class SessionsController < ApplicationController authorize_resource :class => false - def new - override_content_security_policy_directives(:form_action => []) if Settings.csp_enforce || Settings.key?(:csp_report_url) + allow_all_form_action :only => :new - session[:referer] = safe_referer(params[:referer]) if params[:referer] + def new + referer = safe_referer(params[:referer]) if params[:referer] - parse_oauth_referer session[:referer] + parse_oauth_referer referer end def create session[:remember_me] ||= params[:remember_me] - session[:referer] = safe_referer(params[:referer]) if params[:referer] - password_authentication(params[:username].strip, params[:password]) + + referer = safe_referer(params[:referer]) if params[:referer] + + password_authentication(params[:username].strip, params[:password], referer) end def destroy @@ -43,15 +45,15 @@ class SessionsController < ApplicationController ## # handle password authentication - def password_authentication(username, password) + def password_authentication(username, password, referer = nil) if (user = User.authenticate(:username => username, :password => password)) - successful_login(user) + successful_login(user, referer) elsif (user = User.authenticate(:username => username, :password => password, :pending => true)) - unconfirmed_login(user) + unconfirmed_login(user, referer) elsif User.authenticate(:username => username, :password => password, :suspended => true) - failed_login({ :partial => "sessions/suspended_flash" }, username) + failed_login({ :partial => "sessions/suspended_flash" }, username, referer) else - failed_login t("sessions.new.auth failure"), username + failed_login(t("sessions.new.auth failure"), username, referer) end end end