X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/9174049d6b4e50c32ba1a11b1c628bcfe32c06bf..8e648e7b26202a1f5fcad2d296a2c5e772634465:/app/controllers/users_controller.rb diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index fc9a6afc0..c55a177b4 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,6 +1,8 @@ class UsersController < ApplicationController + include EmailMethods include SessionMethods include UserMethods + include PaginationMethods layout "site" @@ -28,16 +30,14 @@ class UsersController < ApplicationController redirect_to url_for(:status => params[:status], :ip => params[:ip], :page => params[:page]) else - @params = params.permit(:status, :ip) + @params = params.permit(:status, :ip, :before, :after) - conditions = {} - conditions[:status] = @params[:status] if @params[:status] - conditions[:creation_ip] = @params[:ip] if @params[:ip] + users = User.all + users = users.where(:status => @params[:status]) if @params[:status] + users = users.where(:creation_ip => @params[:ip]) if @params[:ip] - @user_pages, @users = paginate(:users, - :conditions => conditions, - :order => :id, - :per_page => 50) + @users_count = users.count + @users, @newer_users_id, @older_users_id = get_page_items(users, :limit => 50) end end @@ -103,11 +103,11 @@ class UsersController < ApplicationController render :action => "new" elsif current_user.auth_provider.present? # Verify external authenticator before moving on - session[:new_user] = current_user + session[:new_user] = current_user.slice("email", "display_name", "pass_crypt", "pass_crypt_confirmation") redirect_to auth_url(current_user.auth_provider, current_user.auth_uid), :status => :temporary_redirect else # Save the user record - session[:new_user] = current_user + session[:new_user] = current_user.slice("email", "display_name", "pass_crypt", "pass_crypt_confirmation") redirect_to :action => :terms end end @@ -169,7 +169,10 @@ class UsersController < ApplicationController redirect_to referer || edit_account_path else - self.current_user = session.delete(:new_user) + new_user = session.delete(:new_user) + verified_email = new_user.delete("verified_email") + + self.current_user = User.new(new_user) if check_signup_allowed(current_user.email) current_user.data_public = true @@ -183,31 +186,24 @@ class UsersController < ApplicationController if current_user.auth_uid.blank? current_user.auth_provider = nil current_user.auth_uid = nil + elsif current_user.email == verified_email + current_user.activate end if current_user.save + SIGNUP_IP_LIMITER&.update(request.remote_ip) + SIGNUP_EMAIL_LIMITER&.update(canonical_email(current_user.email)) + flash[:matomo_goal] = Settings.matomo["goals"]["signup"] if defined?(Settings.matomo) - referer = welcome_path - - begin - uri = URI(session[:referer]) - %r{map=(.*)/(.*)/(.*)}.match(uri.fragment) do |m| - editor = Rack::Utils.parse_query(uri.query).slice("editor") - referer = welcome_path({ "zoom" => m[1], - "lat" => m[2], - "lon" => m[3] }.merge(editor)) - end - rescue StandardError - # Use default - end + referer = welcome_path(welcome_options) if current_user.status == "active" session[:referer] = referer successful_login(current_user) else - session[:token] = current_user.tokens.create.token - UserMailer.signup_confirm(current_user, current_user.tokens.create(:referer => referer)).deliver_later + session[:pending_user] = current_user.id + UserMailer.signup_confirm(current_user, current_user.generate_token_for(:new_user), referer).deliver_later redirect_to :controller => :confirmations, :action => :confirm, :display_name => current_user.display_name end else @@ -250,7 +246,7 @@ class UsersController < ApplicationController when "openid" uid.match(%r{https://www.google.com/accounts/o8/id?(.*)}) || uid.match(%r{https://me.yahoo.com/(.*)}) - when "google", "facebook" + when "google", "facebook", "microsoft", "github", "wikipedia" true else false @@ -268,10 +264,9 @@ class UsersController < ApplicationController redirect_to edit_account_path elsif session[:new_user] - session[:new_user].auth_provider = provider - session[:new_user].auth_uid = uid - - session[:new_user].activate if email_verified && email == session[:new_user].email + session[:new_user]["auth_provider"] = provider + session[:new_user]["auth_uid"] = uid + session[:new_user]["verified_email"] = email if email_verified redirect_to :action => "terms" else @@ -313,6 +308,21 @@ class UsersController < ApplicationController private + def welcome_options + uri = URI(session[:referer]) if session[:referer].present? + + return { "oauth_return_url" => uri&.to_s } if uri&.path == oauth_authorization_path + + begin + %r{map=(.*)/(.*)/(.*)}.match(uri.fragment) do |m| + editor = Rack::Utils.parse_query(uri.query).slice("editor") + return { "zoom" => m[1], "lat" => m[2], "lon" => m[3] }.merge(editor) + end + rescue StandardError + # Use default + end + end + ## # ensure that there is a "user" instance variable def lookup_user_by_name @@ -344,7 +354,15 @@ class UsersController < ApplicationController domain_mx_servers(domain) end - if blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + return true if Acl.allow_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + + blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + + blocked ||= SIGNUP_IP_LIMITER && !SIGNUP_IP_LIMITER.allow?(request.remote_ip) + + blocked ||= email && SIGNUP_EMAIL_LIMITER && !SIGNUP_EMAIL_LIMITER.allow?(canonical_email(email)) + + if blocked logger.info "Blocked signup from #{request.remote_ip} for #{email}" render :action => "blocked" @@ -352,12 +370,4 @@ class UsersController < ApplicationController !blocked end - - ## - # get list of MX servers for a domains - def domain_mx_servers(domain) - Resolv::DNS.open do |dns| - dns.getresources(domain, Resolv::DNS::Resource::IN::MX).collect { |mx| mx.exchange.to_s } - end - end end