cafe-grader-web

Commit r883:327f656f4545 public

parent | child
Description:
prevent multiple place login using uuid cookie
Commit status:
[Not Reviewed]
References:
algo
Diff options:
Raw Diff | Patch Diff | Download Diff | Ignore whitespace | Increase context
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Side by Side Unified
Expand All Files Collapse All Files Wide Mode Diff
Add another comment
Browse Files

r883:327f656f4545 - - 1 file changed: 6 inserted, 3 deleted

Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -62,24 +62,27
62 62 #admin always has privileged
63 63 if @current_user.admin?
64 64 return true
65 65 end
66 66
67 67 unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
68 68 end
69 69
70 70 def unique_visitor_id
71 71 unless cookies.encrypted[:uuid]
72 72 value = SecureRandom.uuid
73 73 cookies.encrypted[:uuid] = { value: value, expires: 20.year }
74 + return value
75 + else
76 + return cookies.encrypted[:uuid]
74 77 end
75 78 end
76 79
77 80 protected
78 81
79 82 #redirect to root (and also force logout)
80 83 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
81 84 def check_valid_login
82 85 #check if logged in
83 86 unless session[:user_id]
84 87 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
85 88 unauthorized_redirect('You need to login but you cannot log in at this time')
@@ -122,31 +125,31
122 125 end
123 126 end
124 127 return true
125 128 end
126 129
127 130 #redirect to root (and also force logout)
128 131 #if the user use different ip from the previous connection
129 132 # only applicable when MULTIPLE_IP_LOGIN options is false only
130 133 def authenticate_by_ip_address
131 134 #this assume that we have already authenticate normally
132 135 unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
133 136 user = User.find(session[:user_id])
134 - if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
135 - flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
137 + if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id)
138 + flash[:notice] = "You cannot use the system from two different places"
136 139 redirect_to :controller => 'main', :action => 'login'
137 140 return false
138 141 end
139 142 unless user.last_ip
140 - user.last_ip = request.remote_ip
143 + user.last_ip = unique_visitor_id
141 144 user.save
142 145 end
143 146 end
144 147 return true
145 148 end
146 149
147 150 def authorization
148 151 return false unless check_valid_login
149 152 user = User.find(session[:user_id])
150 153 unless user.roles.detect { |role|
151 154 role.rights.detect{ |right|
152 155 right.controller == self.class.controller_name and
You need to be logged in to leave comments. Login now