app/controllers/sessions_controller.rb

   1 # frozen_string_literal: true
   2
   3 class SessionsController < ApplicationController
   4   include SessionMethods
   5
   6   layout :site_layout
   7
   8   before_action :authorize_web, :except => [:destroy]
   9   before_action -> { authorize_web(:skip_terms => true) }, :only => [:destroy]
  10   before_action :set_locale
  11   before_action :check_database_readable
  12   before_action :require_cookies, :only => [:new]
  13
  14   authorize_resource :class => false
  15
  16   allow_all_form_action :only => :new
  17
  18   def new
  19     referer = safe_referer(params[:referer]) if params[:referer]
  20
  21     @safe_referer = referer
  22     @safe_referer = nil if referer != params[:referer]
  23
  24     parse_oauth_referer referer
  25   end
  26
  27   def create
  28     session[:remember_me] = params[:remember_me] == "yes"
  29
  30     referer = safe_referer(params[:referer]) if params[:referer]
  31
  32     password_authentication(params[:username].strip, params[:password], referer)
  33   end
  34
  35   def destroy
  36     @title = t ".title"
  37
  38     if request.post?
  39       session.delete(:pending_user)
  40       session.delete(:user)
  41       session_expires_automatically
  42
  43       referer = safe_referer(params[:referer]) if params[:referer]
  44
  45       redirect_to referer || { :controller => "site", :action => "index" }
  46     end
  47   end
  48
  49   private
  50
  51   ##
  52   # handle password authentication
  53   def password_authentication(username, password, referer = nil)
  54     if (user = User.authenticate(:username => username, :password => password))
  55       successful_login(user, referer)
  56     elsif (user = User.authenticate(:username => username, :password => password, :pending => true))
  57       unconfirmed_login(user, referer)
  58     elsif User.authenticate(:username => username, :password => password, :suspended => true)
  59       failed_login({ :partial => "sessions/suspended_flash" }, username, referer)
  60     else
  61       failed_login(t("sessions.new.auth failure"), username, referer)
  62     end
  63   end
  64 end