X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/7c98b41cc89068d049a18f8738276f19cd47095e..030bb31ec1a4f3b20f82ed7e4395189ecb8f5345:/app/controllers/user_controller.rb?ds=sidebyside diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index b337dc04c..321b61918 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -1,46 +1,49 @@ class UserController < ApplicationController layout :choose_layout + skip_before_filter :verify_authenticity_token, :only => [:api_read, :api_details, :api_gpx_files] before_filter :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details] before_filter :authorize, :only => [:api_details, :api_gpx_files] - before_filter :authorize_web, :except => [:api_details, :api_gpx_files] - before_filter :set_locale, :except => [:api_details, :api_gpx_files] + before_filter :authorize_web, :except => [:api_read, :api_details, :api_gpx_files] + before_filter :set_locale, :except => [:api_read, :api_details, :api_gpx_files] before_filter :require_user, :only => [:account, :go_public, :make_friend, :remove_friend] - before_filter :check_database_readable, :except => [:api_details, :api_gpx_files] - before_filter :check_database_writable, :only => [:login, :new, :account, :go_public, :make_friend, :remove_friend] - before_filter :check_api_readable, :only => [:api_details, :api_gpx_files] + before_filter :check_database_readable, :except => [:login, :api_read, :api_details, :api_gpx_files] + before_filter :check_database_writable, :only => [:new, :account, :confirm, :confirm_email, :lost_password, :reset_password, :go_public, :make_friend, :remove_friend] + before_filter :check_api_readable, :only => [:api_read, :api_details, :api_gpx_files] before_filter :require_allow_read_prefs, :only => [:api_details] before_filter :require_allow_read_gpx, :only => [:api_gpx_files] before_filter :require_cookies, :only => [:login, :confirm] before_filter :require_administrator, :only => [:set_status, :delete, :list] - before_filter :lookup_this_user, :only => [:set_status, :delete] + around_filter :api_call_handle_error, :only => [:api_read, :api_details, :api_gpx_files] + before_filter :lookup_user_by_id, :only => [:api_read] + before_filter :lookup_user_by_name, :only => [:set_status, :delete] - filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation - - cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete], :unless => STATUS == :database_offline + cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete] def terms @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE @text = OSM.legal_text_for_country(@legale) if request.xhr? - render :update do |page| - page.replace_html "contributorTerms", :partial => "terms" - end + render :partial => "terms" elsif using_open_id? # The redirect from the OpenID provider reenters here # again and we need to pass the parameters through to # the open_id_authentication function @user = session.delete(:new_user) - openid_verify(nil, @user) do |user| + openid_verify(nil, @user) do |user,verified_email| + user.status = "active" if user.email == verified_email end if @user.openid_url.nil? or @user.invalid? render :action => 'new' else + session[:new_user] = @user render :action => 'terms' end + elsif params[:user] and Acl.no_account_creation(request.remote_ip, params[:user][:email].split("@").last) + render :action => 'blocked' else session[:referer] = params[:referer] @@ -50,11 +53,13 @@ class UserController < ApplicationController if params[:user] and params[:user][:openid_url] and @user.pass_crypt.empty? # We are creating an account with OpenID and no password # was specified so create a random one - @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) - @user.pass_crypt_confirmation = @user.pass_crypt + @user.pass_crypt = SecureRandom.base64(16) + @user.pass_crypt_confirmation = @user.pass_crypt end if @user + @user.status = "pending" + if @user.invalid? if @user.new_record? # Something is wrong with a new user, so rerender the form @@ -71,10 +76,13 @@ class UserController < ApplicationController # Verify OpenID before moving on session[:new_user] = @user openid_verify(params[:user][:openid_url], @user) + elsif @user.new_record? + # Save the user record + session[:new_user] = @user end else # Not logged in, so redirect to the login page - redirect_to :action => :login, :referer => request.request_uri + redirect_to :action => :login, :referer => request.fullpath end end end @@ -82,9 +90,7 @@ class UserController < ApplicationController def save @title = t 'user.new.title' - if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"}) - render :action => 'new' - elsif params[:decline] + if params[:decline] if @user @user.terms_seen = true @@ -116,84 +122,66 @@ class UserController < ApplicationController redirect_to :action => :account, :display_name => @user.display_name end else - @user = User.new(params[:user]) - - @user.status = "pending" - @user.data_public = true - @user.description = "" if @user.description.nil? - @user.creation_ip = request.remote_ip - @user.languages = request.user_preferred_languages - @user.terms_agreed = Time.now.getutc - @user.terms_seen = true - @user.openid_url = nil if @user.openid_url and @user.openid_url.empty? - - if @user.save - flash[:notice] = t 'user.new.flash create success message', :email => @user.email - Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer))) - session[:token] = @user.tokens.create.token - redirect_to :action => 'login', :referer => params[:referer] - else - render :action => 'new', :referer => params[:referer] - end - end - end + @user = session.delete(:new_user) - def account - @title = t 'user.account.title' - @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null' + if Acl.no_account_creation(request.remote_ip, @user.email.split("@").last) + render :action => 'blocked' + else + @user.data_public = true + @user.description = "" if @user.description.nil? + @user.creation_ip = request.remote_ip + @user.languages = request.user_preferred_languages + @user.terms_agreed = Time.now.getutc + @user.terms_seen = true + @user.openid_url = nil if @user.openid_url and @user.openid_url.empty? - if params[:user] and params[:user][:display_name] and params[:user][:description] - @user.display_name = params[:user][:display_name] - @user.new_email = params[:user][:new_email] + if @user.save + flash[:piwik_goal] = PIWIK_SIGNUP_GOAL if defined?(PIWIK_SIGNUP_GOAL) - if params[:user][:pass_crypt].length > 0 or params[:user][:pass_crypt_confirmation].length > 0 - @user.pass_crypt = params[:user][:pass_crypt] - @user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation] - end + if @user.status == "active" + flash[:notice] = t 'user.new.flash welcome', :email => @user.email - @user.description = params[:user][:description] - @user.languages = params[:user][:languages].split(",") + Notifier.signup_confirm(@user, nil).deliver - case params[:image_action] - when "new" then @user.image = params[:user][:image] - when "delete" then @user.image = nil - end + successful_login(@user) + else + flash[:notice] = t 'user.new.flash create success message', :email => @user.email + session[:token] = @user.tokens.create.token - @user.home_lat = params[:user][:home_lat] - @user.home_lon = params[:user][:home_lon] + Notifier.signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer))).deliver - if params[:user][:preferred_editor] == "default" - @user.preferred_editor = nil - else - @user.preferred_editor = params[:user][:preferred_editor] + redirect_to :action => 'login', :referer => params[:referer] + end + else + render :action => 'new', :referer => params[:referer] + end end + end + end - @user.openid_url = nil if params[:user][:openid_url].empty? + def account + @title = t 'user.account.title' + @tokens = @user.oauth_tokens.authorized - if params[:user][:openid_url].length > 0 and + if params[:user] and params[:user][:display_name] and params[:user][:description] + if params[:user][:openid_url] and + params[:user][:openid_url].length > 0 and params[:user][:openid_url] != @user.openid_url # If the OpenID has changed, we want to check that it is a # valid OpenID and one the user has control over before saving # it as a password equivalent for the user. - session[:new_user] = @user + session[:new_user_settings] = params openid_verify(params[:user][:openid_url], @user) else - update_user(@user) + update_user(@user, params) end elsif using_open_id? # The redirect from the OpenID provider reenters here # again and we need to pass the parameters through to # the open_id_authentication function - @user = session.delete(:new_user) + settings = session.delete(:new_user_settings) openid_verify(nil, @user) do |user| - update_user(user) - end - else - if flash[:errors] - flash[:errors].each do |attr,msg| - attr = "new_email" if attr == "email" and !@user.new_email.nil? - @user.errors.add(attr,msg) - end + update_user(user, settings) end end end @@ -209,11 +197,19 @@ class UserController < ApplicationController @title = t 'user.lost_password.title' if params[:user] and params[:user][:email] - user = User.find_by_email(params[:user][:email], :conditions => {:status => ["pending", "active", "confirmed"]}) + user = User.visible.find_by_email(params[:user][:email]) + + if user.nil? + users = User.visible.where("LOWER(email) = LOWER(?)", params[:user][:email]) + + if users.count == 1 + user = users.first + end + end if user token = user.tokens.create - Notifier.deliver_lost_password(user, token) + Notifier.lost_password(user, token).deliver flash[:notice] = t 'user.lost_password.notice email on way' redirect_to :action => 'login' else @@ -254,12 +250,23 @@ class UserController < ApplicationController @title = t 'user.new.title' @referer = params[:referer] || session[:referer] - if session[:user] + if @user # The user is logged in already, so don't show them the signup # page, instead send them to the home page - redirect_to :controller => 'site', :action => 'index' - elsif not params['openid'].nil? + if @referer + redirect_to @referer + else + redirect_to :controller => 'site', :action => 'index' + end + elsif params.key?(:openid) + @user = User.new(:email => params[:email], + :email_confirmation => params[:email], + :display_name => params[:nickname], + :openid_url => params[:openid]) + flash.now[:notice] = t 'user.new.openid association' + elsif Acl.no_account_creation(request.remote_ip) + render :action => 'blocked' end end @@ -273,8 +280,6 @@ class UserController < ApplicationController else password_authentication(params[:username], params[:password]) end - elsif flash[:notice].nil? - flash.now[:notice] = t 'user.login.notice' end end @@ -313,7 +318,7 @@ class UserController < ApplicationController referer = token.referer token.destroy - if session[:token] + if session[:token] token = UserToken.find_by_token(session[:token]) session.delete(:token) else @@ -327,6 +332,7 @@ class UserController < ApplicationController token.destroy session[:user] = user.id + cookies.permanent["_osm_username"] = user.display_name if referer.nil? flash[:notice] = t('user.confirm.success') + "

" + t('user.confirm.before you start') @@ -355,7 +361,7 @@ class UserController < ApplicationController def confirm_resend if user = User.find_by_display_name(params[:display_name]) - Notifier.deliver_signup_confirm(user, user.tokens.create) + Notifier.signup_confirm(user, user.tokens.create).deliver flash[:notice] = t 'user.confirm_resend.success', :email => user.email else flash[:notice] = t 'user.confirm_resend.failure', :name => params[:display_name] @@ -379,6 +385,7 @@ class UserController < ApplicationController end token.destroy session[:user] = @user.id + cookies.permanent["_osm_username"] = @user.display_name redirect_to :action => 'account', :display_name => @user.display_name else flash[:error] = t 'user.confirm_email.failure' @@ -387,6 +394,15 @@ class UserController < ApplicationController end end + def api_read + render :nothing => true, :status => :gone unless @this_user.visible? + end + + def api_details + @this_user = @user + render :action => :api_read + end + def api_gpx_files doc = OSM::API.new.get_xml_doc @user.traces.each do |trace| @@ -402,61 +418,68 @@ class UserController < ApplicationController (@this_user.visible? or (@user and @user.administrator?)) @title = @this_user.display_name else - @title = t 'user.no_such_user.title' - @not_found_user = params[:display_name] - render :action => 'no_such_user', :status => :not_found + render_unknown_user params[:display_name] end end def make_friend - if params[:display_name] - name = params[:display_name] - new_friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]}) - friend = Friend.new - friend.user_id = @user.id - friend.friend_user_id = new_friend.id - unless @user.is_friends_with?(new_friend) - if friend.save - flash[:notice] = t 'user.make_friend.success', :name => name - Notifier.deliver_friend_notification(friend) + @new_friend = User.find_by_display_name(params[:display_name]) + + if @new_friend + if request.post? + friend = Friend.new + friend.user_id = @user.id + friend.friend_user_id = @new_friend.id + unless @user.is_friends_with?(@new_friend) + if friend.save + flash[:notice] = t 'user.make_friend.success', :name => @new_friend.display_name + Notifier.friend_notification(friend).deliver + else + friend.add_error(t('user.make_friend.failed', :name => @new_friend.display_name)) + end else - friend.add_error(t('user.make_friend.failed', :name => name)) + flash[:warning] = t 'user.make_friend.already_a_friend', :name => @new_friend.display_name end - else - flash[:warning] = t 'user.make_friend.already_a_friend', :name => name - end - if params[:referer] - redirect_to params[:referer] - else - redirect_to :controller => 'user', :action => 'view' + if params[:referer] + redirect_to params[:referer] + else + redirect_to :controller => 'user', :action => 'view' + end end + else + render_unknown_user params[:display_name] end end def remove_friend - if params[:display_name] - name = params[:display_name] - friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]}) - if @user.is_friends_with?(friend) - Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}" - flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name - else - flash[:error] = t 'user.remove_friend.not_a_friend', :name => friend.display_name - end + @friend = User.find_by_display_name(params[:display_name]) - if params[:referer] - redirect_to params[:referer] - else - redirect_to :controller => 'user', :action => 'view' + if @friend + if request.post? + if @user.is_friends_with?(@friend) + Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{@friend.id}" + flash[:notice] = t 'user.remove_friend.success', :name => @friend.display_name + else + flash[:error] = t 'user.remove_friend.not_a_friend', :name => @friend.display_name + end + + if params[:referer] + redirect_to params[:referer] + else + redirect_to :controller => 'user', :action => 'view' + end end + else + render_unknown_user params[:display_name] end end ## # sets a user's status def set_status - @this_user.update_attributes(:status => params[:status]) + @this_user.status = params[:status] + @this_user.save redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] end @@ -499,8 +522,7 @@ private elsif user = User.authenticate(:username => username, :password => password, :pending => true) failed_login t('user.login.account not active', :reconfirm => url_for(:action => 'confirm_resend', :display_name => user.display_name)) elsif User.authenticate(:username => username, :password => password, :suspended => true) - webmaster = link_to t('user.login.webmaster'), "mailto:webmaster@openstreetmap.org" - failed_login t('user.login.account suspended', :webmaster => webmaster) + failed_login t('user.login.account is suspended', :webmaster => "mailto:webmaster@openstreetmap.org") else failed_login t('user.login.auth failure') end @@ -518,7 +540,7 @@ private end # Start the authentication - authenticate_with_open_id(openid_expand_url(openid_url), :required => required) do |result, identity_url, sreg, ax| + authenticate_with_open_id(openid_expand_url(openid_url), :method => :get, :required => required) do |result, identity_url, sreg, ax| if result.successful? # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. @@ -529,12 +551,11 @@ private if user = User.find_by_openid_url(identity_url) case user.status when "pending" then - failed_login t('user.login.account not active') + failed_login t('user.login.account not active', :reconfirm => url_for(:action => 'confirm_resend', :display_name => user.display_name)) when "active", "confirmed" then successful_login(user) when "suspended" then - webmaster = link_to t('user.login.webmaster'), "mailto:webmaster@openstreetmap.org" - failed_login t('user.login.account suspended', :webmaster => webmaster) + failed_login t('user.login.account is suspended', :webmaster => "mailto:webmaster@openstreetmap.org") else failed_login t('user.login.auth failure') end @@ -547,8 +568,9 @@ private # to the create account page with username and email filled # in if they have been given by the OpenID provider through # the simple registration protocol. - nickname = sreg["nickname"] || ax["http://axschema.org/namePerson/friendly"] - email = sreg["email"] || ax["http://axschema.org/contact/email"] + nickname = sreg["nickname"] || ax["http://axschema.org/namePerson/friendly"].first + email = sreg["email"] || ax["http://axschema.org/contact/email"].first + redirect_to :controller => 'user', :action => 'new', :nickname => nickname, :email => email, :openid => identity_url end elsif result.missing? @@ -566,8 +588,18 @@ private def openid_verify(openid_url, user) user.openid_url = openid_url - authenticate_with_open_id(openid_expand_url(openid_url)) do |result, identity_url| + authenticate_with_open_id(openid_expand_url(openid_url), :method => :get, :required => [:email, "http://axschema.org/contact/email"]) do |result, identity_url, sreg, ax| if result.successful? + # Do we trust the emails this provider returns? + if openid_email_verified(identity_url) + # Guard against not getting any extension data + sreg = Hash.new if sreg.nil? + ax = Hash.new if ax.nil? + + # Get the verified email + verified_email = sreg["email"] || ax["http://axschema.org/contact/email"].first + end + # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. # @@ -575,7 +607,7 @@ private # than a user specific url. Only once it comes back from the provider # provider do we know the unique address for the user. user.openid_url = identity_url - yield user + yield user, verified_email elsif result.missing? flash.now[:error] = t 'user.login.openid missing provider' elsif result.invalid? @@ -601,13 +633,23 @@ private else return openid_url end - end + end + + ## + # check if we trust an OpenID provider to return a verified + # email, so that we can skpi verifying it ourselves + def openid_email_verified(openid_url) + openid_url.match(/https:\/\/www.google.com\/accounts\/o8\/id?(.*)/) or + openid_url.match(/https:\/\/me.yahoo.com\/(.*)/) + end ## # process a successful login def successful_login(user) + cookies.permanent["_osm_username"] = user.display_name + session[:user] = user.id - session_expires_after 1.month if session[:remember_me] + session_expires_after 28.days if session[:remember_me] target = session[:referer] || url_for(:controller => :site, :action => :index) @@ -642,20 +684,69 @@ private ## # update a user's details - def update_user(user) + def update_user(user, params) + user.display_name = params[:user][:display_name] + user.new_email = params[:user][:new_email] + + if params[:user][:pass_crypt].length > 0 or params[:user][:pass_crypt_confirmation].length > 0 + user.pass_crypt = params[:user][:pass_crypt] + user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation] + end + + if params[:user][:description] != user.description + user.description = params[:user][:description] + user.description_format = "markdown" + end + + user.languages = params[:user][:languages].split(",") + + case params[:image_action] + when "new" then + user.image = params[:user][:image] + user.image_use_gravatar = false + when "delete" then + user.image = nil + user.image_use_gravatar = false + when "gravatar" then + user.image = nil + user.image_use_gravatar = true + end + + user.home_lat = params[:user][:home_lat] + user.home_lon = params[:user][:home_lon] + + if params[:user][:preferred_editor] == "default" + user.preferred_editor = nil + else + user.preferred_editor = params[:user][:preferred_editor] + end + + user.openid_url = nil if params[:user][:openid_url].blank? + if user.save set_locale - if user.new_email.nil? or user.new_email.empty? + cookies.permanent["_osm_username"] = user.display_name + + if user.new_email.blank? flash.now[:notice] = t 'user.account.flash update success' else - flash.now[:notice] = t 'user.account.flash update success confirm needed' + user.email = user.new_email + + if user.valid? + flash.now[:notice] = t 'user.account.flash update success confirm needed' - begin - Notifier.deliver_email_confirm(user, user.tokens.create) - rescue - # Ignore errors sending email + begin + Notifier.email_confirm(user, user.tokens.create).deliver + rescue + # Ignore errors sending email + end + else + @user.errors.set(:new_email, @user.errors.get(:email)) + @user.errors.set(:email, []) end + + user.reset_email! end end end @@ -670,16 +761,22 @@ private if params[:display_name] redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] else - redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri + redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath end elsif not @user - redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri + redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath end end ## # ensure that there is a "this_user" instance variable - def lookup_this_user + def lookup_user_by_id + @this_user = User.find(params[:id]) + end + + ## + # ensure that there is a "this_user" instance variable + def lookup_user_by_name @this_user = User.find_by_display_name(params[:display_name]) rescue ActiveRecord::RecordNotFound redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] unless @this_user @@ -689,7 +786,7 @@ private # Choose the layout to use. See # https://rails.lighthouseapp.com/projects/8994/tickets/5371-layout-with-onlyexcept-options-makes-other-actions-render-without-layouts def choose_layout - oauth_url = url_for(:controller => :oauth, :action => :oauthorize, :only_path => true) + oauth_url = url_for(:controller => :oauth, :action => :authorize, :only_path => true) if [ 'api_details' ].include? action_name nil @@ -703,7 +800,7 @@ private ## # def disable_terms_redirect - # this is necessary otherwise going to the user terms page, when + # this is necessary otherwise going to the user terms page, when # having not agreed already would cause an infinite redirect loop. # it's .now so that this doesn't propagate to other pages. flash.now[:skip_terms] = true