X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/155ed85bf5b90fc0419289354904a3f9945dda3f..f70feedc6517b824c4201584d6298fd5790d85ba:/app/controllers/user_controller.rb diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index 0144f69b6..17f52fd40 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -16,57 +16,95 @@ class UserController < ApplicationController filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation - cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete] + cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete], :unless => STATUS == :database_offline - def save - @title = t 'user.new.title' + def terms + @legale = params[:legale] || OSM.IPToCountry(request.remote_ip) || DEFAULT_LEGALE + @text = OSM.legal_text_for_country(@legale) - if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"}) - render :action => 'new' - else - if params[:open_id_complete] - # The redirect from the OpenID provider reenters here - # again and we need to pass the parameters through to - # the open_id_authentication function - @user = session.delete(:new_user) - openid_verify(nil, @user) do |user| - create_user(user) - end + if request.xhr? + render :update do |page| + page.replace_html "contributorTerms", :partial => "terms", :locals => { :has_decline => params[:has_decline] } + end + elsif using_open_id? + # The redirect from the OpenID provider reenters here + # again and we need to pass the parameters through to + # the open_id_authentication function + @user = session.delete(:new_user) + + openid_verify(nil, @user) do |user| + end + + if @user.openid_url.nil? or @user.invalid? + render :action => 'new' else - session[:referer] = params[:referer] + render :action => 'terms' + end + else + session[:referer] = params[:referer] - @user = User.new(params[:user]) + @title = t 'user.terms.title' + @user = User.new(params[:user]) if params[:user] - @user.status = "pending" - @user.data_public = true - @user.description = "" if @user.description.nil? - @user.creation_ip = request.remote_ip - @user.languages = request.user_preferred_languages + if params[:user][:openid_url] and @user.pass_crypt.empty? + # We are creating an account with OpenID and no password + # was specified so create a random one + @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) + @user.pass_crypt_confirmation = @user.pass_crypt + end - if params[:user][:openid_url] and @user.pass_crypt.empty? - # We are creating an account with OpenID and no password - # was specified so create a random one - @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) - @user.pass_crypt_confirmation = @user.pass_crypt + if @user + if @user.invalid? + # Something is wrong, so rerender the form + render :action => :new + elsif @user.terms_agreed? + # Already agreed to terms, so just show settings + redirect_to :action => :account, :display_name => @user.display_name + elsif params[:user][:openid_url] + # Verify OpenID before moving on + session[:new_user] = @user + openid_verify(params[:user][:openid_url], @user) end + else + # Not logged in, so redirect to the login page + redirect_to :action => :login, :referer => request.request_uri + end + end + end - if @user.valid? - if params[:user][:openid_url].nil? or - params[:user][:openid_url].empty? - # No OpenID so just save - create_user(@user) - else - # Verify OpenID before saving - session[:new_user] = @user - openid_verify(params[:user][:openid_url], @user) - end + def save + @title = t 'user.new.title' + + if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"}) + render :action => 'new' + elsif params[:decline] + redirect_to t('user.terms.declined') + elsif @user + if !@user.terms_agreed? + @user.consider_pd = params[:user][:consider_pd] + @user.terms_agreed = Time.now.getutc + if @user.save + flash[:notice] = t 'user.new.terms accepted' end end - # Render the signup page unless we have already been - # redirected or have managed to save the user - if response.location.nil? and @user.new_record? - render :action => "new" + redirect_to :action => :account, :display_name => @user.display_name + else + @user = User.new(params[:user]) + + @user.status = "pending" + @user.data_public = true + @user.description = "" if @user.description.nil? + @user.creation_ip = request.remote_ip + @user.languages = request.user_preferred_languages + @user.terms_agreed = Time.now.getutc + + if @user.save + flash[:notice] = t 'user.new.flash create success message' + Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer))) + redirect_to :action => 'login' + else + render :action => 'new' end end end @@ -75,15 +113,7 @@ class UserController < ApplicationController @title = t 'user.account.title' @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null' - if params[:open_id_complete] - # The redirect from the OpenID provider reenters here - # again and we need to pass the parameters through to - # the open_id_authentication function - @user = session.delete(:new_user) - openid_verify(nil, @user) do |user| - update_user(user) - end - elsif params[:user] and params[:user][:display_name] and params[:user][:description] + if params[:user] and params[:user][:display_name] and params[:user][:description] @user.display_name = params[:user][:display_name] @user.new_email = params[:user][:new_email] @@ -115,6 +145,14 @@ class UserController < ApplicationController else update_user(@user) end + elsif using_open_id? + # The redirect from the OpenID provider reenters here + # again and we need to pass the parameters through to + # the open_id_authentication function + @user = session.delete(:new_user) + openid_verify(nil, @user) do |user| + update_user(user) + end end end @@ -184,17 +222,17 @@ class UserController < ApplicationController end def login - if request.post? + if params[:username] or using_open_id? session[:remember_me] ||= params[:remember_me] session[:referer] ||= params[:referer] - if using_open_id?(params[:openid_url]) + if using_open_id? openid_authentication(params[:openid_url]) else password_authentication(params[:username], params[:password]) end - else - @title = t 'user.login.title' + elsif flash[:notice].nil? + flash.now[:notice] = t 'user.login.notice' end end @@ -376,7 +414,8 @@ private elsif User.authenticate(:username => username, :password => password, :pending => true) failed_login t('user.login.account not active') elsif User.authenticate(:username => username, :password => password, :suspended => true) - failed_login t('user.login.account suspended') + webmaster = link_to t('user.login.webmaster'), "mailto:webmaster@openstreetmap.org" + failed_login t('user.login.account suspended', :webmaster => webmaster) else failed_login t('user.login.auth failure') end @@ -394,7 +433,7 @@ private end # Start the authentication - authenticate_with_open_id(openid_url, :optional => optional) do |result, identity_url, registration| + authenticate_with_open_id(openid_expand_url(openid_url), :optional => optional) do |result, identity_url, registration| if result.successful? # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. @@ -404,10 +443,15 @@ private # provider do we know the unique address for the user. if user = User.find_by_openid_url(identity_url) case user.status - when "pending" then failed_login t('user.login.account not active') - when "active", "confirmed" then successful_login(user) - when "suspended" then failed_login t('user.login.account suspended') - else failed_login t('user.login.auth failure') + when "pending" then + failed_login t('user.login.account not active') + when "active", "confirmed" then + successful_login(user) + when "suspended" then + webmaster = link_to t('user.login.webmaster'), "mailto:webmaster@openstreetmap.org" + failed_login t('user.login.account suspended', :webmaster => webmaster) + else + failed_login t('user.login.auth failure') end else # We don't have a user registered to this OpenID, so redirect @@ -417,12 +461,7 @@ private redirect_to :controller => 'user', :action => 'new', :nickname => registration['nickname'], :email => registration['email'], :openid => identity_url end elsif result.missing? - # Try and apply some heuristics to make common cases more user friendly - if openid_url = openid_alternate_url(openid_url) - openid_authentication(openid_url) - else - failed_login t('user.login.openid missing provider') - end + failed_login t('user.login.openid missing provider') elsif result.invalid? failed_login t('user.login.openid invalid') else @@ -436,7 +475,7 @@ private def openid_verify(openid_url, user) user.openid_url = openid_url - authenticate_with_open_id(openid_url) do |result, identity_url| + authenticate_with_open_id(openid_expand_url(openid_url)) do |result, identity_url| if result.successful? # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. @@ -447,12 +486,7 @@ private user.openid_url = identity_url yield user elsif result.missing? - # Try and apply some heuristics to make common cases more user friendly - if openid_url = openid_alternate_url(openid_url) - openid_verify(openid_url, user) - else - flash.now[:error] = t 'user.login.openid missing provider' - end + flash.now[:error] = t 'user.login.openid missing provider' elsif result.invalid? flash.now[:error] = t 'user.login.openid invalid' else @@ -462,17 +496,19 @@ private end ## - # special case some common OpenID providers by applying heuristics - # to try and come up with an alternate URL if the supplied one fails - def openid_alternate_url(openid_url) - # Special case gmail.com as it is potentially a popular OpenID - # provider and, unlike yahoo.com, where it works automatically, Google - # have hidden their OpenID endpoint somewhere obscure this making it - # somewhat less user friendly. - if openid_url.match(/(.*)gmail.com(\/?)$/) or openid_url.match(/(.*)googlemail.com(\/?)$/) + # special case some common OpenID providers by applying heuristics to + # try and come up with the correct URL based on what the user entered + def openid_expand_url(openid_url) + if openid_url.nil? + return nil + elsif openid_url.match(/(.*)gmail.com(\/?)$/) or openid_url.match(/(.*)googlemail.com(\/?)$/) + # Special case gmail.com as it is potentially a popular OpenID + # provider and, unlike yahoo.com, where it works automatically, Google + # have hidden their OpenID endpoint somewhere obscure this making it + # somewhat less user friendly. return 'https://www.google.com/accounts/o8/id' else - return nil + return openid_url end end @@ -506,18 +542,6 @@ private session.delete(:referer) end - ## - # save a new user - def create_user(user) - if user.save - flash[:notice] = t 'user.new.flash create success message' - - Notifier.deliver_signup_confirm(user, user.tokens.create(:referer => session.delete(:referer))) - - redirect_to :action => 'login' - end - end - ## # update a user's details def update_user(user)