cafe-grader-web

Commit r883:327f656f4545 public

parent | child
Description:
prevent multiple place login using uuid cookie
Commit status:
[Not Reviewed]
References:
algo
Diff options:
Raw Diff | Patch Diff | Download Diff | Show whitespace | Increase context
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Side by Side Unified
Expand All Files Collapse All Files Wide Mode Diff
Add another comment
Browse Files

r883:327f656f4545 - - 1 file changed: 6 inserted, 3 deleted

Show file before | Show file after | Raw diff | Download diff | Show whitespace Increase context Show commentsHide comments
@@ -50,48 +50,51
50 50 unauthorized_redirect
51 51 end
52 52
53 53 def authorization_by_roles(allowed_roles)
54 54 return false unless check_valid_login
55 55 unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
56 56 unauthorized_redirect
57 57 return false
58 58 end
59 59 end
60 60
61 61 def testcase_authorization
62 62 #admin always has privileged
63 63 if @current_user.admin?
64 64 return true
65 65 end
66 66
67 67 unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
68 68 end
69 69
70 70 def unique_visitor_id
71 71 unless cookies.encrypted[:uuid]
72 72 value = SecureRandom.uuid
73 73 cookies.encrypted[:uuid] = { value: value, expires: 20.year }
74 + return value
75 + else
76 + return cookies.encrypted[:uuid]
74 77 end
75 78 end
76 79
77 80 protected
78 81
79 82 #redirect to root (and also force logout)
80 83 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
81 84 def check_valid_login
82 85 #check if logged in
83 86 unless session[:user_id]
84 87 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
85 88 unauthorized_redirect('You need to login but you cannot log in at this time')
86 89 else
87 90 unauthorized_redirect('You need to login')
88 91 end
89 92 return false
90 93 end
91 94
92 95 # check if run in single user mode
93 96 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
94 97 if @current_user==nil || (!@current_user.admin?)
95 98 unauthorized_redirect('You cannot log in at this time')
96 99 return false
97 100 end
@@ -110,55 +113,55
110 113 return false
111 114 end
112 115 end
113 116
114 117 if GraderConfiguration.multicontests?
115 118 return true if @current_user.admin?
116 119 begin
117 120 if @current_user.contest_stat(true).forced_logout
118 121 flash[:notice] = 'You have been automatically logged out.'
119 122 redirect_to :controller => 'main', :action => 'index'
120 123 end
121 124 rescue
122 125 end
123 126 end
124 127 return true
125 128 end
126 129
127 130 #redirect to root (and also force logout)
128 131 #if the user use different ip from the previous connection
129 132 # only applicable when MULTIPLE_IP_LOGIN options is false only
130 133 def authenticate_by_ip_address
131 134 #this assume that we have already authenticate normally
132 135 unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
133 136 user = User.find(session[:user_id])
134 - if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
135 - flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
137 + if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id)
138 + flash[:notice] = "You cannot use the system from two different places"
136 139 redirect_to :controller => 'main', :action => 'login'
137 140 return false
138 141 end
139 142 unless user.last_ip
140 - user.last_ip = request.remote_ip
143 + user.last_ip = unique_visitor_id
141 144 user.save
142 145 end
143 146 end
144 147 return true
145 148 end
146 149
147 150 def authorization
148 151 return false unless check_valid_login
149 152 user = User.find(session[:user_id])
150 153 unless user.roles.detect { |role|
151 154 role.rights.detect{ |right|
152 155 right.controller == self.class.controller_name and
153 156 (right.action == 'all' || right.action == action_name)
154 157 }
155 158 }
156 159 flash[:notice] = 'You are not authorized to view the page you requested'
157 160 #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
158 161 redirect_to :controller => 'main', :action => 'login'
159 162 return false
160 163 end
161 164 end
162 165
163 166 def verify_time_limit
164 167 return true if session[:user_id]==nil
You need to be logged in to leave comments. Login now