X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/ef092045e095d7d0745964b50466dc55499bf718..694d45cd31c65e06a342ae3d038af563c5dc7731:/app/controllers/users_controller.rb?ds=sidebyside diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb index 3101e5af2..3489b4eda 100644 --- a/app/controllers/users_controller.rb +++ b/app/controllers/users_controller.rb @@ -1,5 +1,6 @@ class UsersController < ApplicationController include SessionMethods + include UserMethods layout "site" @@ -11,11 +12,10 @@ class UsersController < ApplicationController authorize_resource - before_action :require_self, :only => [:account] - before_action :check_database_writable, :only => [:new, :account, :go_public] + before_action :check_database_writable, :only => [:new, :go_public] before_action :require_cookies, :only => [:new] before_action :lookup_user_by_name, :only => [:set_status, :destroy] - before_action :allow_thirdparty_images, :only => [:show, :account] + before_action :allow_thirdparty_images, :only => [:show] def terms @legale = params[:legale] || OSM.ip_to_country(request.remote_ip) || Settings.default_legale @@ -28,9 +28,9 @@ class UsersController < ApplicationController if current_user&.terms_agreed? # Already agreed to terms, so just show settings - redirect_to :action => :account, :display_name => current_user.display_name + redirect_to edit_account_path elsif current_user.nil? && session[:new_user].nil? - redirect_to :action => :login, :referer => request.fullpath + redirect_to login_path(:referer => request.fullpath) end end end @@ -44,11 +44,9 @@ class UsersController < ApplicationController flash[:notice] = { :partial => "users/terms_declined_flash" } if current_user.save - if params[:referer] - redirect_to safe_referer(params[:referer]) - else - redirect_to :action => :account, :display_name => current_user.display_name - end + referer = safe_referer(params[:referer]) if params[:referer] + + redirect_to referer || edit_account_path elsif params[:decline] redirect_to t("users.terms.declined") else @@ -57,18 +55,16 @@ class UsersController < ApplicationController elsif current_user unless current_user.terms_agreed? current_user.consider_pd = params[:user][:consider_pd] - current_user.tou_agreed = Time.now.getutc - current_user.terms_agreed = Time.now.getutc + current_user.tou_agreed = Time.now.utc + current_user.terms_agreed = Time.now.utc current_user.terms_seen = true flash[:notice] = t "users.new.terms accepted" if current_user.save end - if params[:referer] - redirect_to safe_referer(params[:referer]) - else - redirect_to :action => :account, :display_name => current_user.display_name - end + referer = safe_referer(params[:referer]) if params[:referer] + + redirect_to referer || edit_account_path else self.current_user = session.delete(:new_user) @@ -77,8 +73,8 @@ class UsersController < ApplicationController current_user.description = "" if current_user.description.nil? current_user.creation_ip = request.remote_ip current_user.languages = http_accept_language.user_preferred_languages - current_user.terms_agreed = Time.now.getutc - current_user.tou_agreed = Time.now.getutc + current_user.terms_agreed = Time.now.utc + current_user.tou_agreed = Time.now.utc current_user.terms_seen = true if current_user.auth_uid.blank? @@ -118,36 +114,11 @@ class UsersController < ApplicationController end end - def account - @tokens = current_user.oauth_tokens.authorized - - append_content_security_policy_directives( - :form_action => %w[accounts.google.com *.facebook.com login.live.com github.com meta.wikimedia.org] - ) - - if request.post? - if params[:user][:auth_provider].blank? || - (params[:user][:auth_provider] == current_user.auth_provider && - params[:user][:auth_uid] == current_user.auth_uid) - update_user(current_user, params) - redirect_to user_account_url(current_user) if current_user.errors.count.zero? - else - session[:new_user_settings] = params - redirect_to auth_url(params[:user][:auth_provider], params[:user][:auth_uid]), :status => :temporary_redirect - end - elsif errors = session.delete(:user_errors) - errors.each do |attribute, error| - current_user.errors.add(attribute, error) - end - end - @title = t "users.account.title" - end - def go_public current_user.data_public = true current_user.save flash[:notice] = t "users.go_public.flash success" - redirect_to :action => "account", :display_name => current_user.display_name + redirect_to edit_account_path end def new @@ -193,8 +164,6 @@ class UsersController < ApplicationController Rails.logger.info "create: #{session[:referer]}" - current_user.status = "pending" - if current_user.auth_provider.present? && current_user.pass_crypt.empty? # We are creating an account with external authentication and # no password was specified so create a random one @@ -231,15 +200,19 @@ class UsersController < ApplicationController ## # sets a user's status def set_status - @user.status = params[:status] - @user.save + @user.activate! if params[:event] == "activate" + @user.confirm! if params[:event] == "confirm" + @user.unconfirm! if params[:event] == "unconfirm" + @user.hide! if params[:event] == "hide" + @user.unhide! if params[:event] == "unhide" + @user.unsuspend! if params[:event] == "unsuspend" redirect_to user_path(:display_name => params[:display_name]) end ## - # delete a user, marking them as deleted and removing personal data + # destroy a user, marking them as deleted and removing personal data def destroy - @user.delete + @user.soft_destroy! redirect_to user_path(:display_name => params[:display_name]) end @@ -277,15 +250,15 @@ class UsersController < ApplicationController name = auth_info[:info][:name] email = auth_info[:info][:email] - case provider - when "openid" - email_verified = uid.match(%r{https://www.google.com/accounts/o8/id?(.*)}) || + email_verified = case provider + when "openid" + uid.match(%r{https://www.google.com/accounts/o8/id?(.*)}) || uid.match(%r{https://me.yahoo.com/(.*)}) - when "google", "facebook" - email_verified = true - else - email_verified = false - end + when "google", "facebook" + true + else + false + end if settings = session.delete(:new_user_settings) current_user.auth_provider = provider @@ -297,7 +270,7 @@ class UsersController < ApplicationController session[:user_errors] = current_user.errors.as_json - redirect_to :action => "account", :display_name => current_user.display_name + redirect_to edit_account_path elsif session[:new_user] session[:new_user].auth_provider = provider session[:new_user].auth_uid = uid @@ -335,100 +308,14 @@ class UsersController < ApplicationController ## # omniauth failure callback def auth_failure - flash[:error] = t("users.auth_failure.#{params[:message]}") - redirect_to params[:origin] || login_url - end - - private + flash[:error] = t(params[:message], :scope => "users.auth_failure", :default => t("users.auth_failure.unknown_error")) - ## - # - def unconfirmed_login(user) - session[:token] = user.tokens.create.token + origin = safe_referer(params[:origin]) if params[:origin] - redirect_to :action => "confirm", :display_name => user.display_name - - session.delete(:remember_me) - session.delete(:referer) + redirect_to origin || login_url end - ## - # update a user's details - def update_user(user, params) - user.display_name = params[:user][:display_name] - user.new_email = params[:user][:new_email] - - unless params[:user][:pass_crypt].empty? && params[:user][:pass_crypt_confirmation].empty? - user.pass_crypt = params[:user][:pass_crypt] - user.pass_crypt_confirmation = params[:user][:pass_crypt_confirmation] - end - - if params[:user][:description] != user.description - user.description = params[:user][:description] - user.description_format = "markdown" - end - - user.languages = params[:user][:languages].split(",") - - case params[:avatar_action] - when "new" - user.avatar.attach(params[:user][:avatar]) - user.image_use_gravatar = false - when "delete" - user.avatar.purge_later - user.image_use_gravatar = false - when "gravatar" - user.avatar.purge_later - user.image_use_gravatar = true - end - - user.home_lat = params[:user][:home_lat] - user.home_lon = params[:user][:home_lon] - - user.preferred_editor = if params[:user][:preferred_editor] == "default" - nil - else - params[:user][:preferred_editor] - end - - if params[:user][:auth_provider].nil? || params[:user][:auth_provider].blank? - user.auth_provider = nil - user.auth_uid = nil - end - - if user.save - session[:fingerprint] = user.fingerprint - - set_locale(:reset => true) - - if user.new_email.blank? || user.new_email == user.email - flash[:notice] = t "users.account.flash update success" - else - user.email = user.new_email - - if user.valid? - flash[:notice] = t "users.account.flash update success confirm needed" - - begin - UserMailer.email_confirm(user, user.tokens.create).deliver_later - rescue StandardError - # Ignore errors sending email - end - else - current_user.errors.add(:new_email, current_user.errors[:email]) - current_user.errors.add(:email, []) - end - - user.restore_email! - end - end - end - - ## - # require that the user in the URL is the logged in user - def require_self - head :forbidden if params[:display_name] != current_user.display_name - end + private ## # ensure that there is a "user" instance variable