1  
   2  class AccountController < ApplicationController
   3    @@acls = [
   4          {:action => 'login',    :group => 1},
   5          {:action => 'register', :group => 1},
   6          {:action => 'confirm',  :group => 1},
   7          {:action => 'index',    :group => 2},
   8          {:action => 'logout',   :group => 2},
   9          {:action => 'resetpw',  :group => 1},
  10          {:action => 'changepw',  :group => 2}
  11    ]
  12  
  13    def login
  14      if request.get?
  15          @user = User.new
  16      else
  17        @authuser = User.authenticate(params[:user][:username], params[:user][:password])
  18        if @authuser
  19          if params[:save_login]
  20                  @authuser.remember_me
  21                  cookies[:auth_token] = { :value => @authuser.remember_token, :expires => 2.weeks.from_now }
  22          end
  23          session[:user] = @authuser
  24          flash[:notice] = 'You have been logged in successfully'
  25          redirect_to '/account/'
  26        else
  27          flash[:notice] = 'Login failed. Please check your details'
  28        end
  29      end
  30    end
  31  
  32    def register
  33      if AppConfig.find_by_key('Account.OpenRegistration').value == '1'
  34        if !request.get?
  35          @user = User.new(params[:user])
  36          if @user.save
  37            ActiveRecord::Base.connection.insert("INSERT INTO users_groups (user_id, group_id) VALUES (#{@user.id}, 1)")
  38            ActiveRecord::Base.connection.insert("INSERT INTO users_groups (user_id, group_id) VALUES (#{@user.id}, 2)")
  39  
  40            MailGenie::deliver_confirmation_email(@user, confirmation_hash(@user.username))
  41            flash[:notice] = "Thank you for registering! We have sent a confirmation email to #{@user.email}"
  42            redirect_to('/')
  43          end
  44        end
  45      else
  46          render :template => 'account/regclosed'
  47      end
  48    end
  49  
  50    def confirm
  51      @users = User.find :all
  52      for user in @users
  53        if confirmation_hash(user.username) == params[:hash] and !user.confirmed
  54          user.update_attribute(:confirmed, true)
  55              session[:user] = user
  56              flash[:notice] = "Thank you for validating your email"
  57              break
  58        end
  59      end
  60      redirect_to(:action => 'index')
  61    end
  62  
  63    def logout
  64      session[:user].forget_me if session[:user]
  65      session[:user] = nil
  66      cookies.delete :auth_token
  67      flash[:notice] = "You have been logged out"
  68      redirect_to('/')
  69    end
  70  
  71    def index
  72      @user = session[:user]
  73    end
  74  
  75    def resetpw
  76          if !request.get?
  77                  @user = User.find_by_email(params[:user][:email])
  78                  password = @user.reset_password
  79                  MailGenie::deliver_reset_email(@user, password)
  80                  flash[:notice] = "Your password has been reset, check your mail for your new password."
  81                  redirect_to('/')
  82          end
  83    end
  84  
  85    private
  86  
  87    def confirmation_hash(string)
  88      Digest::SHA1.hexdigest(string + "GFIGITFU^&(*^&I^&*(O^M&YNI^FVNYIOYOM()P{*)OGUIL*Y)O(G&*)LUPLHU")
  89    end
  90  end

   1  
   2  require 'digest/sha1'
   3  
   4  # this model expects a certain database layout and its based on the name/login pattern.
   5  class User < ActiveRecord::Base
   6          has_and_belongs_to_many :groups,
   7                  :class_name => 'Group',
   8                  :join_table => 'users_groups'
   9  
  10          def self.authenticate(username, password)
  11                  @user = find(:first, :conditions => ["username = ? AND password = ? and confirmed = ?", username, sha1(password), true])
  12          end
  13  
  14          def remember_me
  15                  self.remember_token_expires = 2.weeks.from_now
  16                  self.remember_token = Digest::SHA1.hexdigest("GFDHDFUHFJI&&%ET%&*%^£FESER^&J&IJR%TXEYFGU(*I$R^%E&DU&-#{self.email}#{self.remember_token_expires}")
  17                  self.save_with_validation(false)
  18          end
  19  
  20          def forget_me
  21                  self.remember_token_expires = nil
  22                  self.remember_token = nil
  23                  self.save_with_validation(false)
  24          end
  25  
  26          def reset_password
  27                  tmppwd = self.generate_password
  28                  write_attribute("password", self.class.sha1(tmppwd))
  29                  self.save_with_validation(false)
  30                  tmppwd
  31          end
  32  
  33          protected
  34  
  35          def generate_password
  36                  chars = ("a".."z").to_a + ("1".."9").to_a
  37                  Array.new(6, '').collect{chars[rand(chars.size)]}.join
  38          end
  39  
  40          def self.sha1(pass)
  41                  Digest::SHA1.hexdigest(pass + "FSDT%^Y&JTFHY^&*IFY^H&&*(T&&RG%U&*I^HFGCDUI*TUF^HYU&*Y&T^F&*^&FUH")
  42          end
  43  
  44          before_create :crypt_password
  45  
  46          def crypt_password
  47                  write_attribute("password", self.class.sha1(password))
  48          end
  49  
  50          validates_length_of :username, :within => 4..24
  51          validates_length_of :password, :within => 6..32
  52          validates_presence_of :username, :password, :password_confirmation
  53          validates_uniqueness_of :username, :on => :create
  54          validates_confirmation_of :password, :on => :create
  55  
  56          validates_format_of :email, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i
  57          validates_format_of :username, :with => /^(\w*)$/i
  58          validates_format_of :name, :with => /^([\w ]*)$/i
  59  
  60          validates_presence_of :email, :name
  61          validates_length_of :name, :within => 6..32
  62          validates_uniqueness_of :email, :on => :create
  63  end