X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/6c202448ade514cd5ecca7175555011c851735e9..b7432e943222d5499d135afb4f6431ed4c3c988d:/app/controllers/users_controller.rb diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 8c234006e..b3596b376 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -10,9 +10,9 @@ class UsersController < ApplicationController authorize_resource before_action :require_self, :only => [:account] - before_action :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public, :make_friend, :remove_friend] + before_action :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public] before_action :require_cookies, :only => [:new, :login, :confirm] - before_action :lookup_user_by_name, :only => [:set_status, :delete] + before_action :lookup_user_by_name, :only => [:set_status, :destroy] before_action :allow_thirdparty_images, :only => [:show, :account] def terms @@ -43,7 +43,7 @@ class UsersController < ApplicationController flash[:notice] = t("users.new.terms declined", :url => t("users.new.terms declined url")).html_safe if current_user.save if params[:referer] - redirect_to params[:referer] + redirect_to safe_referer(params[:referer]) else redirect_to :action => :account, :display_name => current_user.display_name end @@ -63,7 +63,7 @@ class UsersController < ApplicationController end if params[:referer] - redirect_to params[:referer] + redirect_to safe_referer(params[:referer]) else redirect_to :action => :account, :display_name => current_user.display_name end @@ -198,7 +198,11 @@ class UsersController < ApplicationController def new @title = t "users.new.title" - @referer = params[:referer] || session[:referer] + @referer = if params[:referer] + safe_referer(params[:referer]) + else + session[:referer] + end append_content_security_policy_directives( :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] @@ -231,7 +235,9 @@ class UsersController < ApplicationController self.current_user = User.new(user_params) if check_signup_allowed(current_user.email) - session[:referer] = params[:referer] + session[:referer] = safe_referer(params[:referer]) if params[:referer] + + Rails.logger.info "create: #{session[:referer]}" current_user.status = "pending" @@ -258,7 +264,7 @@ class UsersController < ApplicationController end def login - session[:referer] = params[:referer] if params[:referer] + session[:referer] = safe_referer(params[:referer]) if params[:referer] if params[:username].present? && params[:password].present? session[:remember_me] ||= params[:remember_me] @@ -269,7 +275,7 @@ class UsersController < ApplicationController def logout @title = t "users.logout.title" - if params[:session] == session.id + if request.post? if session[:token] token = UserToken.find_by(:token => session[:token]) token&.destroy @@ -278,7 +284,7 @@ class UsersController < ApplicationController session.delete(:user) session_expires_automatically if params[:referer] - redirect_to params[:referer] + redirect_to safe_referer(params[:referer]) else redirect_to :controller => "site", :action => "index" end @@ -300,7 +306,7 @@ class UsersController < ApplicationController user.email_valid = true flash[:notice] = gravatar_status_message(user) if gravatar_enable(user) user.save! - referer = token.referer + referer = safe_referer(token.referer) if token.referer token.destroy if session[:token] @@ -353,7 +359,7 @@ class UsersController < ApplicationController gravatar_enabled = gravatar_enable(current_user) if current_user.save flash[:notice] = if gravatar_enabled - t("users.confirm_email.success") + " " + gravatar_status_message(current_user) + "#{t('users.confirm_email.success')} #{gravatar_status_message(current_user)}" else t("users.confirm_email.success") end @@ -376,64 +382,13 @@ class UsersController < ApplicationController @user = User.find_by(:display_name => params[:display_name]) if @user && - (@user.visible? || (current_user&.administrator?)) + (@user.visible? || current_user&.administrator?) @title = @user.display_name else render_unknown_user params[:display_name] end end - def make_friend - @new_friend = User.find_by(:display_name => params[:display_name]) - - if @new_friend - if request.post? - friendship = Friendship.new - friendship.befriender = current_user - friendship.befriendee = @new_friend - if current_user.is_friends_with?(@new_friend) - flash[:warning] = t "users.make_friend.already_a_friend", :name => @new_friend.display_name - elsif friendship.save - flash[:notice] = t "users.make_friend.success", :name => @new_friend.display_name - Notifier.friend_notification(friendship).deliver_later - else - friendship.add_error(t("users.make_friend.failed", :name => @new_friend.display_name)) - end - - if params[:referer] - redirect_to params[:referer] - else - redirect_to :action => "show" - end - end - else - render_unknown_user params[:display_name] - end - end - - def remove_friend - @friend = User.find_by(:display_name => params[:display_name]) - - if @friend - if request.post? - if current_user.is_friends_with?(@friend) - Friendship.where(:befriender => current_user, :befriendee => @friend).delete_all - flash[:notice] = t "users.remove_friend.success", :name => @friend.display_name - else - flash[:error] = t "users.remove_friend.not_a_friend", :name => @friend.display_name - end - - if params[:referer] - redirect_to params[:referer] - else - redirect_to :action => "show" - end - end - else - render_unknown_user params[:display_name] - end - end - ## # sets a user's status def set_status @@ -444,7 +399,7 @@ class UsersController < ApplicationController ## # delete a user, marking them as deleted and removing personal data - def delete + def destroy @user.delete redirect_to user_path(:display_name => params[:display_name]) end @@ -520,11 +475,11 @@ class UsersController < ApplicationController if user case user.status - when "pending" then + when "pending" unconfirmed_login(user) - when "active", "confirmed" then + when "active", "confirmed" successful_login(user, request.env["omniauth.params"]["referer"]) - when "suspended" then + when "suspended" failed_login t("users.login.account is suspended", :webmaster => "mailto:#{Settings.support_email}").html_safe else failed_login t("users.login.auth failure") @@ -539,7 +494,7 @@ class UsersController < ApplicationController ## # omniauth failure callback def auth_failure - flash[:error] = t("users.auth_failure." + params[:message]) + flash[:error] = t("users.auth_failure.#{params[:message]}") redirect_to params[:origin] || login_url end @@ -569,7 +524,7 @@ class UsersController < ApplicationController if referer.nil? params[:origin] = request.path else - params[:origin] = request.path + "?referer=" + CGI.escape(referer) + params[:origin] = "#{request.path}?referer=#{CGI.escape(referer)}" params[:referer] = referer end @@ -661,14 +616,14 @@ class UsersController < ApplicationController user.languages = params[:user][:languages].split(",") case params[:avatar_action] - when "new" then + when "new" user.avatar.attach(params[:user][:avatar]) user.image_use_gravatar = false - when "delete" then - user.avatar.purge + when "delete" + user.avatar.purge_later user.image_use_gravatar = false - when "gravatar" then - user.avatar.purge + when "gravatar" + user.avatar.purge_later user.image_use_gravatar = true end @@ -779,7 +734,7 @@ class UsersController < ApplicationController # check if this user has a gravatar and set the user pref is true def gravatar_enable(user) # code from example https://en.gravatar.com/site/implement/images/ruby/ - return false if user.image.present? + return false if user.avatar.attached? hash = Digest::MD5.hexdigest(user.email.downcase) url = "https://www.gravatar.com/avatar/#{hash}?d=404" # without d=404 we will always get an image back