discourse/app/controllers/finish_installation_controller.rb
Alan Guo Xiang Tan 17e1bfe069
SECURITY: Preload data only when rendering application layout
This commit drops the `before_action :preload_json` callback in `ApplicationController` as it adds unnecessary complexity to `ApplicationController` as well as other controllers which has to skip this callback. The source of the complexity comes mainly from the following two conditionals in the `preload_json` method:

```
    # We don't preload JSON on xhr or JSON request
    return if request.xhr? || request.format.json?

    # if we are posting in makes no sense to preload
    return if request.method != "GET"
```

Basically, the conditionals solely exists for optimization purposes to ensure that we don't run the preloading code when the request is not a GET request and the response is not expected to be HTML. The key problem here is that the conditionals are trying to expect what the content type of the response will be and this has proven to be hard to get right. Instead, we can simplify this problem by running the preloading code in a more deterministic way which is to preload only when the `application` layout is being rendered and this is main change that this commit introduces.
2025-02-04 13:32:30 -03:00

77 lines
1.9 KiB
Ruby

# frozen_string_literal: true
class FinishInstallationController < ApplicationController
skip_before_action :check_xhr,
:preload_json,
:redirect_to_login_if_required,
:redirect_to_profile_if_required
layout "finish_installation"
before_action :ensure_no_admins, except: %w[confirm_email resend_email]
def index
end
def register
@allowed_emails = find_allowed_emails
@user = User.new
if request.post?
email = params[:email].strip
raise Discourse::InvalidParameters.new if @allowed_emails.exclude?(email)
if existing_user = User.find_by_email(email)
@user = existing_user
send_signup_email
return redirect_confirm(email)
end
@user.email = email
@user.username = params[:username]
@user.password = params[:password]
@user.password_required!
if @user.save
@user.change_trust_level!(1) if @user.trust_level < 1
send_signup_email
redirect_confirm(@user.email)
end
end
end
def confirm_email
@email = session[:registered_email]
end
def resend_email
@email = session[:registered_email]
@user = User.find_by_email(@email)
send_signup_email if @user.present?
end
protected
def send_signup_email
return if @user.active && @user.email_confirmed?
email_token = @user.email_tokens.create!(email: @user.email, scope: EmailToken.scopes[:signup])
EmailToken.enqueue_signup_email(email_token)
end
def redirect_confirm(email)
session[:registered_email] = email
redirect_to(finish_installation_confirm_email_path)
end
def find_allowed_emails
unless GlobalSetting.respond_to?(:developer_emails) && GlobalSetting.developer_emails.present?
return []
end
GlobalSetting.developer_emails.split(",").map(&:strip)
end
def ensure_no_admins
raise Discourse::InvalidAccess.new unless SiteSetting.has_login_hint?
end
end