X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/a8e8ba1a64d4f82c74003b5fc05c6fc89a10cc65..47027300607a0eb0127aa408fff508e56ad64021:/app/controllers/users_controller.rb?ds=sidebyside diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 4f05ece74..ab13f93be 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,4 +1,5 @@ class UsersController < ApplicationController + include EmailMethods include SessionMethods include UserMethods @@ -17,6 +18,109 @@ class UsersController < ApplicationController before_action :lookup_user_by_name, :only => [:set_status, :destroy] before_action :allow_thirdparty_images, :only => [:show] + ## + # display a list of users matching specified criteria + def index + if request.post? + ids = params[:user].keys.collect(&:to_i) + + User.where(:id => ids).update_all(:status => "confirmed") if params[:confirm] + User.where(:id => ids).update_all(:status => "deleted") if params[:hide] + + redirect_to url_for(:status => params[:status], :ip => params[:ip], :page => params[:page]) + else + @params = params.permit(:status, :ip) + + conditions = {} + conditions[:status] = @params[:status] if @params[:status] + conditions[:creation_ip] = @params[:ip] if @params[:ip] + + @user_pages, @users = paginate(:users, + :conditions => conditions, + :order => :id, + :per_page => 50) + end + end + + def show + @user = User.find_by(:display_name => params[:display_name]) + + if @user && + (@user.visible? || current_user&.administrator?) + @title = @user.display_name + else + render_unknown_user params[:display_name] + end + end + + def new + @title = t ".title" + @referer = if params[:referer] + safe_referer(params[:referer]) + else + session[:referer] + end + + append_content_security_policy_directives( + :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] + ) + + if current_user + # The user is logged in already, so don't show them the signup + # page, instead send them to the home page + redirect_to @referer || { :controller => "site", :action => "index" } + elsif params.key?(:auth_provider) && params.key?(:auth_uid) + self.current_user = User.new(:email => params[:email], + :email_confirmation => params[:email], + :display_name => params[:nickname], + :auth_provider => params[:auth_provider], + :auth_uid => params[:auth_uid]) + + flash.now[:notice] = render_to_string :partial => "auth_association" + else + check_signup_allowed + + self.current_user = User.new + end + end + + def create + self.current_user = User.new(user_params) + + if check_signup_allowed(current_user.email) + session[:referer] = safe_referer(params[:referer]) if params[:referer] + + Rails.logger.info "create: #{session[:referer]}" + + if current_user.auth_provider.present? && current_user.pass_crypt.empty? + # We are creating an account with external authentication and + # no password was specified so create a random one + current_user.pass_crypt = SecureRandom.base64(16) + current_user.pass_crypt_confirmation = current_user.pass_crypt + end + + if current_user.invalid? + # Something is wrong with a new user, so rerender the form + render :action => "new" + elsif current_user.auth_provider.present? + # Verify external authenticator before moving on + session[:new_user] = current_user.slice("email", "display_name", "pass_crypt", "pass_crypt_confirmation") + redirect_to auth_url(current_user.auth_provider, current_user.auth_uid), :status => :temporary_redirect + else + # Save the user record + session[:new_user] = current_user.slice("email", "display_name", "pass_crypt", "pass_crypt_confirmation") + redirect_to :action => :terms + end + end + end + + ## + # destroy a user, marking them as deleted and removing personal data + def destroy + @user.soft_destroy! + redirect_to user_path(:display_name => params[:display_name]) + end + def terms @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || Settings.default_legale @text = OSM.legal_text_for_country(@legale) @@ -24,7 +128,7 @@ class UsersController < ApplicationController if request.xhr? render :partial => "terms" else - @title = t "users.terms.title" + @title = t ".title" if current_user&.terms_agreed? # Already agreed to terms, so just show settings @@ -48,15 +152,15 @@ class UsersController < ApplicationController redirect_to referer || edit_account_path elsif params[:decline] - redirect_to t("users.terms.declined") + redirect_to t("users.terms.declined"), :allow_other_host => true else redirect_to :action => :terms end elsif current_user unless current_user.terms_agreed? current_user.consider_pd = params[:user][:consider_pd] - current_user.tou_agreed = Time.now.getutc - current_user.terms_agreed = Time.now.getutc + current_user.tou_agreed = Time.now.utc + current_user.terms_agreed = Time.now.utc current_user.terms_seen = true flash[:notice] = t "users.new.terms accepted" if current_user.save @@ -66,38 +170,34 @@ class UsersController < ApplicationController redirect_to referer || edit_account_path else - self.current_user = session.delete(:new_user) + new_user = session.delete(:new_user) + verified_email = new_user.delete("verified_email") + + self.current_user = User.new(new_user) if check_signup_allowed(current_user.email) current_user.data_public = true current_user.description = "" if current_user.description.nil? current_user.creation_ip = request.remote_ip current_user.languages = http_accept_language.user_preferred_languages - current_user.terms_agreed = Time.now.getutc - current_user.tou_agreed = Time.now.getutc + current_user.terms_agreed = Time.now.utc + current_user.tou_agreed = Time.now.utc current_user.terms_seen = true if current_user.auth_uid.blank? current_user.auth_provider = nil current_user.auth_uid = nil + elsif current_user.email == verified_email + current_user.activate end if current_user.save - flash[:piwik_goal] = PIWIK["goals"]["signup"] if defined?(PIWIK) - - referer = welcome_path - - begin - uri = URI(session[:referer]) - %r{map=(.*)/(.*)/(.*)}.match(uri.fragment) do |m| - editor = Rack::Utils.parse_query(uri.query).slice("editor") - referer = welcome_path({ "zoom" => m[1], - "lat" => m[2], - "lon" => m[3] }.merge(editor)) - end - rescue StandardError - # Use default - end + SIGNUP_IP_LIMITER&.update(request.remote_ip) + SIGNUP_EMAIL_LIMITER&.update(canonical_email(current_user.email)) + + flash[:matomo_goal] = Settings.matomo["goals"]["signup"] if defined?(Settings.matomo) + + referer = welcome_path(welcome_options) if current_user.status == "active" session[:referer] = referer @@ -117,127 +217,22 @@ class UsersController < ApplicationController def go_public current_user.data_public = true current_user.save - flash[:notice] = t "users.go_public.flash success" + flash[:notice] = t ".flash success" redirect_to edit_account_path end - def new - @title = t "users.new.title" - @referer = if params[:referer] - safe_referer(params[:referer]) - else - session[:referer] - end - - append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] - ) - - if current_user - # The user is logged in already, so don't show them the signup - # page, instead send them to the home page - if @referer - redirect_to @referer - else - redirect_to :controller => "site", :action => "index" - end - elsif params.key?(:auth_provider) && params.key?(:auth_uid) - self.current_user = User.new(:email => params[:email], - :email_confirmation => params[:email], - :display_name => params[:nickname], - :auth_provider => params[:auth_provider], - :auth_uid => params[:auth_uid]) - - flash.now[:notice] = render_to_string :partial => "auth_association" - else - check_signup_allowed - - self.current_user = User.new - end - end - - def create - self.current_user = User.new(user_params) - - if check_signup_allowed(current_user.email) - session[:referer] = safe_referer(params[:referer]) if params[:referer] - - Rails.logger.info "create: #{session[:referer]}" - - current_user.status = "pending" - - if current_user.auth_provider.present? && current_user.pass_crypt.empty? - # We are creating an account with external authentication and - # no password was specified so create a random one - current_user.pass_crypt = SecureRandom.base64(16) - current_user.pass_crypt_confirmation = current_user.pass_crypt - end - - if current_user.invalid? - # Something is wrong with a new user, so rerender the form - render :action => "new" - elsif current_user.auth_provider.present? - # Verify external authenticator before moving on - session[:new_user] = current_user - redirect_to auth_url(current_user.auth_provider, current_user.auth_uid), :status => :temporary_redirect - else - # Save the user record - session[:new_user] = current_user - redirect_to :action => :terms - end - end - end - - def show - @user = User.find_by(:display_name => params[:display_name]) - - if @user && - (@user.visible? || current_user&.administrator?) - @title = @user.display_name - else - render_unknown_user params[:display_name] - end - end - ## # sets a user's status def set_status - @user.status = params[:status] - @user.save + @user.activate! if params[:event] == "activate" + @user.confirm! if params[:event] == "confirm" + @user.unconfirm! if params[:event] == "unconfirm" + @user.hide! if params[:event] == "hide" + @user.unhide! if params[:event] == "unhide" + @user.unsuspend! if params[:event] == "unsuspend" redirect_to user_path(:display_name => params[:display_name]) end - ## - # delete a user, marking them as deleted and removing personal data - def destroy - @user.delete - redirect_to user_path(:display_name => params[:display_name]) - end - - ## - # display a list of users matching specified criteria - def index - if request.post? - ids = params[:user].keys.collect(&:to_i) - - User.where(:id => ids).update_all(:status => "confirmed") if params[:confirm] - User.where(:id => ids).update_all(:status => "deleted") if params[:hide] - - redirect_to url_for(:status => params[:status], :ip => params[:ip], :page => params[:page]) - else - @params = params.permit(:status, :ip) - - conditions = {} - conditions[:status] = @params[:status] if @params[:status] - conditions[:creation_ip] = @params[:ip] if @params[:ip] - - @user_pages, @users = paginate(:users, - :conditions => conditions, - :order => :id, - :per_page => 50) - end - end - ## # omniauth success callback def auth_success @@ -252,7 +247,7 @@ class UsersController < ApplicationController when "openid" uid.match(%r{https://www.google.com/accounts/o8/id?(.*)}) || uid.match(%r{https://me.yahoo.com/(.*)}) - when "google", "facebook" + when "google", "facebook", "microsoft" true else false @@ -270,10 +265,9 @@ class UsersController < ApplicationController redirect_to edit_account_path elsif session[:new_user] - session[:new_user].auth_provider = provider - session[:new_user].auth_uid = uid - - session[:new_user].status = "active" if email_verified && email == session[:new_user].email + session[:new_user]["auth_provider"] = provider + session[:new_user]["auth_uid"] = uid + session[:new_user]["verified_email"] = email if email_verified redirect_to :action => "terms" else @@ -292,7 +286,7 @@ class UsersController < ApplicationController when "active", "confirmed" successful_login(user, request.env["omniauth.params"]["referer"]) when "suspended" - failed_login t("sessions.new.account is suspended", :webmaster => "mailto:#{Settings.support_email}").html_safe + failed_login({ :partial => "sessions/suspended_flash" }) else failed_login t("sessions.new.auth failure") end @@ -306,7 +300,7 @@ class UsersController < ApplicationController ## # omniauth failure callback def auth_failure - flash[:error] = t(params[:message], :scope => "users.auth_failure", :default => t("users.auth_failure.unknown_error")) + flash[:error] = t(params[:message], :scope => "users.auth_failure", :default => t(".unknown_error")) origin = safe_referer(params[:origin]) if params[:origin] @@ -315,6 +309,21 @@ class UsersController < ApplicationController private + def welcome_options + uri = URI(session[:referer]) if session[:referer].present? + + return { "oauth_return_url" => uri&.to_s } if uri&.path == oauth_authorization_path + + begin + %r{map=(.*)/(.*)/(.*)}.match(uri.fragment) do |m| + editor = Rack::Utils.parse_query(uri.query).slice("editor") + return { "zoom" => m[1], "lat" => m[2], "lon" => m[3] }.merge(editor) + end + rescue StandardError + # Use default + end + end + ## # ensure that there is a "user" instance variable def lookup_user_by_name @@ -346,7 +355,15 @@ class UsersController < ApplicationController domain_mx_servers(domain) end - if blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + return true if Acl.allow_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + + blocked = Acl.no_account_creation(request.remote_ip, :domain => domain, :mx => mx_servers) + + blocked ||= SIGNUP_IP_LIMITER && !SIGNUP_IP_LIMITER.allow?(request.remote_ip) + + blocked ||= email && SIGNUP_EMAIL_LIMITER && !SIGNUP_EMAIL_LIMITER.allow?(canonical_email(email)) + + if blocked logger.info "Blocked signup from #{request.remote_ip} for #{email}" render :action => "blocked" @@ -354,12 +371,4 @@ class UsersController < ApplicationController !blocked end - - ## - # get list of MX servers for a domains - def domain_mx_servers(domain) - Resolv::DNS.open do |dns| - dns.getresources(domain, Resolv::DNS::Resource::IN::MX).collect(&:exchange).collect(&:to_s) - end - end end