2014-08-18 08:55:30 +08:00
|
|
|
require_dependency 'rate_limiter'
|
|
|
|
|
2013-02-06 03:16:51 +08:00
|
|
|
class SessionController < ApplicationController
|
2013-07-29 13:13:13 +08:00
|
|
|
|
2013-06-05 06:32:36 +08:00
|
|
|
skip_before_filter :redirect_to_login_if_required
|
2014-10-08 00:25:25 +08:00
|
|
|
skip_before_filter :check_xhr, only: ['sso', 'sso_login', 'become']
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2013-07-29 13:13:13 +08:00
|
|
|
def csrf
|
|
|
|
render json: {csrf: form_authenticity_token }
|
|
|
|
end
|
|
|
|
|
2014-02-25 11:30:49 +08:00
|
|
|
def sso
|
|
|
|
if SiteSetting.enable_sso
|
2014-02-26 06:58:30 +08:00
|
|
|
redirect_to DiscourseSingleSignOn.generate_url(params[:return_path] || '/')
|
2014-02-25 11:30:49 +08:00
|
|
|
else
|
|
|
|
render nothing: true, status: 404
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2014-10-08 00:25:25 +08:00
|
|
|
# For use in development mode only when login options could be limited or disabled.
|
|
|
|
# NEVER allow this to work in production.
|
|
|
|
def become
|
|
|
|
raise Discourse::InvalidAccess.new unless Rails.env.development?
|
|
|
|
user = User.find_by_username(params[:session_id])
|
|
|
|
raise "User #{params[:session_id]} not found" if user.blank?
|
|
|
|
|
|
|
|
log_on_user(user)
|
|
|
|
redirect_to "/"
|
|
|
|
end
|
|
|
|
|
2014-02-25 11:30:49 +08:00
|
|
|
def sso_login
|
|
|
|
unless SiteSetting.enable_sso
|
|
|
|
render nothing: true, status: 404
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
|
|
|
sso = DiscourseSingleSignOn.parse(request.query_string)
|
|
|
|
if !sso.nonce_valid?
|
|
|
|
render text: "Timeout expired, please try logging in again.", status: 500
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-02-26 06:58:30 +08:00
|
|
|
return_path = sso.return_path
|
2014-02-25 11:30:49 +08:00
|
|
|
sso.expire_nonce!
|
|
|
|
|
|
|
|
if user = sso.lookup_or_create_user
|
2014-02-26 07:27:39 +08:00
|
|
|
if SiteSetting.must_approve_users? && !user.approved?
|
|
|
|
# TODO: need an awaiting approval message here
|
|
|
|
else
|
|
|
|
log_on_user user
|
|
|
|
end
|
2015-01-23 01:20:17 +08:00
|
|
|
|
|
|
|
# If it's not a relative URL check the host
|
|
|
|
if return_path !~ /^\/[^\/]/
|
|
|
|
begin
|
|
|
|
uri = URI(return_path)
|
|
|
|
return_path = "/" unless uri.host == Discourse.current_hostname
|
|
|
|
rescue
|
|
|
|
return_path = "/"
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2014-02-26 06:58:30 +08:00
|
|
|
redirect_to return_path
|
2014-02-25 11:30:49 +08:00
|
|
|
else
|
|
|
|
render text: "unable to log on user", status: 500
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2013-02-06 03:16:51 +08:00
|
|
|
def create
|
2014-02-25 11:30:49 +08:00
|
|
|
|
2014-03-26 12:39:44 +08:00
|
|
|
unless allow_local_auth?
|
2014-02-25 11:30:49 +08:00
|
|
|
render nothing: true, status: 500
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-09-25 08:06:44 +08:00
|
|
|
RateLimiter.new(nil, "login-hr-#{request.remote_ip}", 30, 1.hour).performed!
|
|
|
|
RateLimiter.new(nil, "login-min-#{request.remote_ip}", 6, 1.minute).performed!
|
|
|
|
|
2013-06-06 15:14:32 +08:00
|
|
|
params.require(:login)
|
|
|
|
params.require(:password)
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2014-09-12 03:22:11 +08:00
|
|
|
return invalid_credentials if params[:password].length > User.max_password_length
|
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
login = params[:login].strip
|
|
|
|
login = login[1..-1] if login[0] == "@"
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
if user = User.find_by_username_or_email(login)
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
# If their password is correct
|
|
|
|
unless user.confirm_password?(params[:password])
|
|
|
|
invalid_credentials
|
|
|
|
return
|
|
|
|
end
|
2013-02-06 03:16:51 +08:00
|
|
|
|
|
|
|
# If the site requires user approval and the user is not approved yet
|
2013-11-15 23:27:43 +08:00
|
|
|
if login_not_approved_for?(user)
|
|
|
|
login_not_approved
|
2013-02-06 03:16:51 +08:00
|
|
|
return
|
|
|
|
end
|
2013-11-28 09:39:59 +08:00
|
|
|
|
2014-01-22 05:53:46 +08:00
|
|
|
# User signed on with username and password, so let's prevent the invite link
|
|
|
|
# from being used to log in (if one exists).
|
|
|
|
Invite.invalidate_for_email(user.email)
|
2013-11-28 09:39:59 +08:00
|
|
|
else
|
|
|
|
invalid_credentials
|
|
|
|
return
|
2013-11-15 23:27:43 +08:00
|
|
|
end
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
if user.suspended?
|
|
|
|
failed_to_login(user)
|
|
|
|
return
|
2013-02-06 03:16:51 +08:00
|
|
|
end
|
|
|
|
|
2014-09-05 06:50:27 +08:00
|
|
|
if ScreenedIpAddress.block_login?(user, request.remote_ip)
|
|
|
|
not_allowed_from_ip_address(user)
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-04-29 01:46:28 +08:00
|
|
|
(user.active && user.email_confirmed?) ? login(user) : not_activated(user)
|
2013-02-06 03:16:51 +08:00
|
|
|
end
|
|
|
|
|
|
|
|
def forgot_password
|
2013-06-06 15:14:32 +08:00
|
|
|
params.require(:login)
|
2013-02-06 03:16:51 +08:00
|
|
|
|
2014-03-26 12:39:44 +08:00
|
|
|
unless allow_local_auth?
|
2014-02-25 11:30:49 +08:00
|
|
|
render nothing: true, status: 500
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2014-08-18 08:55:30 +08:00
|
|
|
RateLimiter.new(nil, "forgot-password-hr-#{request.remote_ip}", 6, 1.hour).performed!
|
|
|
|
RateLimiter.new(nil, "forgot-password-min-#{request.remote_ip}", 3, 1.minute).performed!
|
|
|
|
|
2013-10-24 15:59:58 +08:00
|
|
|
user = User.find_by_username_or_email(params[:login])
|
2013-02-06 03:16:51 +08:00
|
|
|
if user.present?
|
|
|
|
email_token = user.email_tokens.create(email: user.email)
|
|
|
|
Jobs.enqueue(:user_email, type: :forgot_password, user_id: user.id, email_token: email_token.token)
|
|
|
|
end
|
2014-09-11 10:04:44 +08:00
|
|
|
|
|
|
|
json = { result: "ok" }
|
2014-09-11 13:53:29 +08:00
|
|
|
unless SiteSetting.forgot_password_strict
|
2014-09-11 10:04:44 +08:00
|
|
|
json[:user_found] = user.present?
|
|
|
|
end
|
|
|
|
|
|
|
|
render json: json
|
2014-08-18 08:55:30 +08:00
|
|
|
|
|
|
|
rescue RateLimiter::LimitExceeded
|
|
|
|
render_json_error(I18n.t("rate_limiter.slow_down"))
|
2013-02-06 03:16:51 +08:00
|
|
|
end
|
|
|
|
|
2014-02-06 02:46:24 +08:00
|
|
|
def current
|
|
|
|
if current_user.present?
|
|
|
|
render_serialized(current_user, CurrentUserSerializer)
|
|
|
|
else
|
|
|
|
render nothing: true, status: 404
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2013-02-06 03:16:51 +08:00
|
|
|
def destroy
|
2013-08-27 13:56:12 +08:00
|
|
|
reset_session
|
2013-10-09 12:10:37 +08:00
|
|
|
log_off_user
|
2013-02-06 03:16:51 +08:00
|
|
|
render nothing: true
|
|
|
|
end
|
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
private
|
|
|
|
|
2014-03-26 12:39:44 +08:00
|
|
|
def allow_local_auth?
|
|
|
|
!SiteSetting.enable_sso && SiteSetting.enable_local_logins
|
|
|
|
end
|
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
def login_not_approved_for?(user)
|
|
|
|
SiteSetting.must_approve_users? && !user.approved? && !user.admin?
|
|
|
|
end
|
|
|
|
|
|
|
|
def invalid_credentials
|
|
|
|
render json: {error: I18n.t("login.incorrect_username_email_or_password")}
|
|
|
|
end
|
|
|
|
|
|
|
|
def login_not_approved
|
|
|
|
render json: {error: I18n.t("login.not_approved")}
|
|
|
|
end
|
|
|
|
|
|
|
|
def not_activated(user)
|
|
|
|
render json: {
|
|
|
|
error: I18n.t("login.not_activated"),
|
|
|
|
reason: 'not_activated',
|
|
|
|
sent_to_email: user.find_email || user.email,
|
|
|
|
current_email: user.email
|
|
|
|
}
|
|
|
|
end
|
|
|
|
|
2014-09-05 06:50:27 +08:00
|
|
|
def not_allowed_from_ip_address(user)
|
|
|
|
render json: {error: I18n.t("login.not_allowed_from_ip_address", username: user.username)}
|
|
|
|
end
|
|
|
|
|
2013-11-15 23:27:43 +08:00
|
|
|
def failed_to_login(user)
|
|
|
|
message = user.suspend_reason ? "login.suspended_with_reason" : "login.suspended"
|
|
|
|
|
|
|
|
render json: { error: I18n.t(message, { date: I18n.l(user.suspended_till, format: :date_only),
|
|
|
|
reason: user.suspend_reason}) }
|
|
|
|
end
|
|
|
|
|
|
|
|
def login(user)
|
|
|
|
log_on_user(user)
|
|
|
|
render_serialized(user, UserSerializer)
|
|
|
|
end
|
|
|
|
|
2013-02-06 03:16:51 +08:00
|
|
|
end
|