X-Git-Url: https://git.openstreetmap.org/rails.git/blobdiff_plain/dc4cc8d21967d74b1fb229e37afb9ea4dcaf3e99..88bf67b0923b1376ae6320597c70ce65e5fb1073:/app/controllers/user_controller.rb diff --git a/app/controllers/user_controller.rb b/app/controllers/user_controller.rb index 9c5ac0d09..3622b037d 100644 --- a/app/controllers/user_controller.rb +++ b/app/controllers/user_controller.rb @@ -1,6 +1,7 @@ class UserController < ApplicationController layout :choose_layout + skip_before_filter :verify_authenticity_token, :only => [:api_details, :api_gpx_files] before_filter :disable_terms_redirect, :only => [:terms, :save, :logout, :api_details] before_filter :authorize, :only => [:api_details, :api_gpx_files] before_filter :authorize_web, :except => [:api_details, :api_gpx_files] @@ -15,8 +16,6 @@ class UserController < ApplicationController before_filter :require_administrator, :only => [:set_status, :delete, :list] before_filter :lookup_this_user, :only => [:set_status, :delete] - filter_parameter_logging :password, :pass_crypt, :pass_crypt_confirmation - cache_sweeper :user_sweeper, :only => [:account, :set_status, :delete] def terms @@ -50,7 +49,7 @@ class UserController < ApplicationController if params[:user] and params[:user][:openid_url] and @user.pass_crypt.empty? # We are creating an account with OpenID and no password # was specified so create a random one - @user.pass_crypt = ActiveSupport::SecureRandom.base64(16) + @user.pass_crypt = SecureRandom.base64(16) @user.pass_crypt_confirmation = @user.pass_crypt end @@ -74,7 +73,7 @@ class UserController < ApplicationController end else # Not logged in, so redirect to the login page - redirect_to :action => :login, :referer => request.request_uri + redirect_to :action => :login, :referer => request.fullpath end end end @@ -82,7 +81,7 @@ class UserController < ApplicationController def save @title = t 'user.new.title' - if Acl.find_by_address(request.remote_ip, :conditions => {:k => "no_account_creation"}) + if Acl.address(request.remote_ip).where(:k => "no_account_creation").exists? render :action => 'new' elsif params[:decline] if @user @@ -130,7 +129,7 @@ class UserController < ApplicationController if @user.save flash[:piwik_goal] = PIWIK_SIGNUP_GOAL if defined?(PIWIK_SIGNUP_GOAL) flash[:notice] = t 'user.new.flash create success message', :email => @user.email - Notifier.deliver_signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer))) + Notifier.signup_confirm(@user, @user.tokens.create(:referer => session.delete(:referer))).deliver session[:token] = @user.tokens.create.token redirect_to :action => 'login', :referer => params[:referer] else @@ -141,7 +140,7 @@ class UserController < ApplicationController def account @title = t 'user.account.title' - @tokens = @user.oauth_tokens.find :all, :conditions => 'oauth_tokens.invalidated_at is null and oauth_tokens.authorized_at is not null' + @tokens = @user.oauth_tokens.authorized if params[:user] and params[:user][:display_name] and params[:user][:description] @user.display_name = params[:user][:display_name] @@ -210,11 +209,11 @@ class UserController < ApplicationController @title = t 'user.lost_password.title' if params[:user] and params[:user][:email] - user = User.find_by_email(params[:user][:email], :conditions => {:status => ["pending", "active", "confirmed"]}) + user = User.visible.where(:email => params[:user][:email]).first if user token = user.tokens.create - Notifier.deliver_lost_password(user, token) + Notifier.lost_password(user, token).deliver flash[:notice] = t 'user.lost_password.notice email on way' redirect_to :action => 'login' else @@ -255,11 +254,20 @@ class UserController < ApplicationController @title = t 'user.new.title' @referer = params[:referer] || session[:referer] - if session[:user] + if @user # The user is logged in already, so don't show them the signup # page, instead send them to the home page - redirect_to :controller => 'site', :action => 'index' - elsif not params['openid'].nil? + if @referer + redirect_to @referer + else + redirect_to :controller => 'site', :action => 'index' + end + elsif params.key?(:openid) + @user = User.new(:email => params[:email], + :email_confirmation => params[:email], + :display_name => params[:nickname], + :openid_url => params[:openid]) + flash.now[:notice] = t 'user.new.openid association' end end @@ -356,7 +364,7 @@ class UserController < ApplicationController def confirm_resend if user = User.find_by_display_name(params[:display_name]) - Notifier.deliver_signup_confirm(user, user.tokens.create) + Notifier.signup_confirm(user, user.tokens.create).deliver flash[:notice] = t 'user.confirm_resend.success', :email => user.email else flash[:notice] = t 'user.confirm_resend.failure', :name => params[:display_name] @@ -412,14 +420,14 @@ class UserController < ApplicationController def make_friend if params[:display_name] name = params[:display_name] - new_friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]}) + new_friend = User.active.where(:display_name => name).first friend = Friend.new friend.user_id = @user.id friend.friend_user_id = new_friend.id unless @user.is_friends_with?(new_friend) if friend.save flash[:notice] = t 'user.make_friend.success', :name => name - Notifier.deliver_friend_notification(friend) + Notifier.friend_notification(friend).deliver else friend.add_error(t('user.make_friend.failed', :name => name)) end @@ -438,7 +446,7 @@ class UserController < ApplicationController def remove_friend if params[:display_name] name = params[:display_name] - friend = User.find_by_display_name(name, :conditions => {:status => ["active", "confirmed"]}) + friend = User.active.where(:display_name => name).first if @user.is_friends_with?(friend) Friend.delete_all "user_id = #{@user.id} AND friend_user_id = #{friend.id}" flash[:notice] = t 'user.remove_friend.success', :name => friend.display_name @@ -519,7 +527,7 @@ private end # Start the authentication - authenticate_with_open_id(openid_expand_url(openid_url), :required => required) do |result, identity_url, sreg, ax| + authenticate_with_open_id(openid_expand_url(openid_url), :method => :get, :required => required) do |result, identity_url, sreg, ax| if result.successful? # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. @@ -567,7 +575,7 @@ private def openid_verify(openid_url, user) user.openid_url = openid_url - authenticate_with_open_id(openid_expand_url(openid_url)) do |result, identity_url| + authenticate_with_open_id(openid_expand_url(openid_url), :method => :get) do |result, identity_url| if result.successful? # We need to use the openid url passed back from the OpenID provider # rather than the one supplied by the user, as these can be different. @@ -653,7 +661,7 @@ private flash.now[:notice] = t 'user.account.flash update success confirm needed' begin - Notifier.deliver_email_confirm(user, user.tokens.create) + Notifier.email_confirm(user, user.tokens.create).deliver rescue # Ignore errors sending email end @@ -671,10 +679,10 @@ private if params[:display_name] redirect_to :controller => 'user', :action => 'view', :display_name => params[:display_name] else - redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri + redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath end elsif not @user - redirect_to :controller => 'user', :action => 'login', :referer => request.request_uri + redirect_to :controller => 'user', :action => 'login', :referer => request.fullpath end end