app/controllers/sessions_controller.rb

   1 class SessionsController < ApplicationController
   2   include SessionMethods
   3
   4   layout "site"
   5
   6   before_action :authorize_web, :except => [:destroy]
   7   before_action -> { authorize_web(:skip_terms => true) }, :only => [:destroy]
   8   before_action :set_locale
   9   before_action :check_database_readable
  10   before_action :require_cookies, :only => [:new]
  11
  12   authorize_resource :class => false
  13
  14   allow_all_form_action :only => :new
  15
  16   def new
  17     referer = safe_referer(params[:referer]) if params[:referer]
  18
  19     @safe_referer = referer
  20     @safe_referer = nil if referer != params[:referer]
  21
  22     parse_oauth_referer referer
  23   end
  24
  25   def create
  26     session[:remember_me] = params[:remember_me] == "yes"
  27
  28     referer = safe_referer(params[:referer]) if params[:referer]
  29
  30     password_authentication(params[:username].strip, params[:password], referer)
  31   end
  32
  33   def destroy
  34     @title = t ".title"
  35
  36     if request.post?
  37       session.delete(:pending_user)
  38       session.delete(:user)
  39       session_expires_automatically
  40
  41       referer = safe_referer(params[:referer]) if params[:referer]
  42
  43       redirect_to referer || { :controller => "site", :action => "index" }
  44     end
  45   end
  46
  47   private
  48
  49   ##
  50   # handle password authentication
  51   def password_authentication(username, password, referer = nil)
  52     if (user = User.authenticate(:username => username, :password => password))
  53       successful_login(user, referer)
  54     elsif (user = User.authenticate(:username => username, :password => password, :pending => true))
  55       unconfirmed_login(user, referer)
  56     elsif User.authenticate(:username => username, :password => password, :suspended => true)
  57       failed_login({ :partial => "sessions/suspended_flash" }, username, referer)
  58     else
  59       failed_login(t("sessions.new.auth failure"), username, referer)
  60     end
  61   end
  62 end