cafe-grader-web

Commit r883:327f656f4545 public

parent | child
Description:
prevent multiple place login using uuid cookie
Commit status:
[Not Reviewed]
References:
algo
Diff options:
Raw Diff | Patch Diff | Download Diff | Show whitespace | Increase context
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Side by Side Unified
Expand All Files Collapse All Files Wide Mode Diff
Add another comment
Browse Files

r883:327f656f4545 - - 1 file changed: 6 inserted, 3 deleted

Show file before | Show file after | Raw diff | Download diff | Show whitespace Increase context Show commentsHide comments
@@ -26,163 +26,166
26 end
26 end
27
27
28 def nav_announcement
28 def nav_announcement
29 @nav_announcement = Announcement.where(on_nav_bar: true)
29 @nav_announcement = Announcement.where(on_nav_bar: true)
30 end
30 end
31
31
32 def admin_authorization
32 def admin_authorization
33 return false unless check_valid_login
33 return false unless check_valid_login
34 user = User.includes(:roles).find(session[:user_id])
34 user = User.includes(:roles).find(session[:user_id])
35 unless user.admin?
35 unless user.admin?
36 unauthorized_redirect
36 unauthorized_redirect
37 return false
37 return false
38 end
38 end
39 return true
39 return true
40 end
40 end
41
41
42 #admin always count as every roles
42 #admin always count as every roles
43 def role_authorization(roles)
43 def role_authorization(roles)
44 return false unless check_valid_login
44 return false unless check_valid_login
45 user = User.find(session[:user_id])
45 user = User.find(session[:user_id])
46 return true if user.admin?
46 return true if user.admin?
47 roles.each do |r|
47 roles.each do |r|
48 return true if user.has_role?(r)
48 return true if user.has_role?(r)
49 end
49 end
50 unauthorized_redirect
50 unauthorized_redirect
51 end
51 end
52
52
53 def authorization_by_roles(allowed_roles)
53 def authorization_by_roles(allowed_roles)
54 return false unless check_valid_login
54 return false unless check_valid_login
55 unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
55 unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
56 unauthorized_redirect
56 unauthorized_redirect
57 return false
57 return false
58 end
58 end
59 end
59 end
60
60
61 def testcase_authorization
61 def testcase_authorization
62 #admin always has privileged
62 #admin always has privileged
63 if @current_user.admin?
63 if @current_user.admin?
64 return true
64 return true
65 end
65 end
66
66
67 unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
67 unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
68 end
68 end
69
69
70 def unique_visitor_id
70 def unique_visitor_id
71 unless cookies.encrypted[:uuid]
71 unless cookies.encrypted[:uuid]
72 value = SecureRandom.uuid
72 value = SecureRandom.uuid
73 cookies.encrypted[:uuid] = { value: value, expires: 20.year }
73 cookies.encrypted[:uuid] = { value: value, expires: 20.year }
74 + return value
75 + else
76 + return cookies.encrypted[:uuid]
74 end
77 end
75 end
78 end
76
79
77 protected
80 protected
78
81
79 #redirect to root (and also force logout)
82 #redirect to root (and also force logout)
80 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
83 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
81 def check_valid_login
84 def check_valid_login
82 #check if logged in
85 #check if logged in
83 unless session[:user_id]
86 unless session[:user_id]
84 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
87 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
85 unauthorized_redirect('You need to login but you cannot log in at this time')
88 unauthorized_redirect('You need to login but you cannot log in at this time')
86 else
89 else
87 unauthorized_redirect('You need to login')
90 unauthorized_redirect('You need to login')
88 end
91 end
89 return false
92 return false
90 end
93 end
91
94
92 # check if run in single user mode
95 # check if run in single user mode
93 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
96 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
94 if @current_user==nil || (!@current_user.admin?)
97 if @current_user==nil || (!@current_user.admin?)
95 unauthorized_redirect('You cannot log in at this time')
98 unauthorized_redirect('You cannot log in at this time')
96 return false
99 return false
97 end
100 end
98 end
101 end
99
102
100 # check if the user is enabled
103 # check if the user is enabled
101 unless @current_user.enabled? || @current_user.admin?
104 unless @current_user.enabled? || @current_user.admin?
102 unauthorized_redirect 'Your account is disabled'
105 unauthorized_redirect 'Your account is disabled'
103 return false
106 return false
104 end
107 end
105
108
106 # check if user ip is allowed
109 # check if user ip is allowed
107 unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
110 unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
108 unless is_request_ip_allowed?
111 unless is_request_ip_allowed?
109 unauthorized_redirect 'Your IP is not allowed to login at this time.'
112 unauthorized_redirect 'Your IP is not allowed to login at this time.'
110 return false
113 return false
111 end
114 end
112 end
115 end
113
116
114 if GraderConfiguration.multicontests?
117 if GraderConfiguration.multicontests?
115 return true if @current_user.admin?
118 return true if @current_user.admin?
116 begin
119 begin
117 if @current_user.contest_stat(true).forced_logout
120 if @current_user.contest_stat(true).forced_logout
118 flash[:notice] = 'You have been automatically logged out.'
121 flash[:notice] = 'You have been automatically logged out.'
119 redirect_to :controller => 'main', :action => 'index'
122 redirect_to :controller => 'main', :action => 'index'
120 end
123 end
121 rescue
124 rescue
122 end
125 end
123 end
126 end
124 return true
127 return true
125 end
128 end
126
129
127 #redirect to root (and also force logout)
130 #redirect to root (and also force logout)
128 #if the user use different ip from the previous connection
131 #if the user use different ip from the previous connection
129 # only applicable when MULTIPLE_IP_LOGIN options is false only
132 # only applicable when MULTIPLE_IP_LOGIN options is false only
130 def authenticate_by_ip_address
133 def authenticate_by_ip_address
131 #this assume that we have already authenticate normally
134 #this assume that we have already authenticate normally
132 unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
135 unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
133 user = User.find(session[:user_id])
136 user = User.find(session[:user_id])
134 - if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
137 + if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id)
135 - flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
138 + flash[:notice] = "You cannot use the system from two different places"
136 redirect_to :controller => 'main', :action => 'login'
139 redirect_to :controller => 'main', :action => 'login'
137 return false
140 return false
138 end
141 end
139 unless user.last_ip
142 unless user.last_ip
140 - user.last_ip = request.remote_ip
143 + user.last_ip = unique_visitor_id
141 user.save
144 user.save
142 end
145 end
143 end
146 end
144 return true
147 return true
145 end
148 end
146
149
147 def authorization
150 def authorization
148 return false unless check_valid_login
151 return false unless check_valid_login
149 user = User.find(session[:user_id])
152 user = User.find(session[:user_id])
150 unless user.roles.detect { |role|
153 unless user.roles.detect { |role|
151 role.rights.detect{ |right|
154 role.rights.detect{ |right|
152 right.controller == self.class.controller_name and
155 right.controller == self.class.controller_name and
153 (right.action == 'all' || right.action == action_name)
156 (right.action == 'all' || right.action == action_name)
154 }
157 }
155 }
158 }
156 flash[:notice] = 'You are not authorized to view the page you requested'
159 flash[:notice] = 'You are not authorized to view the page you requested'
157 #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
160 #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
158 redirect_to :controller => 'main', :action => 'login'
161 redirect_to :controller => 'main', :action => 'login'
159 return false
162 return false
160 end
163 end
161 end
164 end
162
165
163 def verify_time_limit
166 def verify_time_limit
164 return true if session[:user_id]==nil
167 return true if session[:user_id]==nil
165 user = User.find(session[:user_id], :include => :site)
168 user = User.find(session[:user_id], :include => :site)
166 return true if user==nil || user.site == nil
169 return true if user==nil || user.site == nil
167 if user.contest_finished?
170 if user.contest_finished?
168 flash[:notice] = 'Error: the contest you are participating is over.'
171 flash[:notice] = 'Error: the contest you are participating is over.'
169 redirect_to :back
172 redirect_to :back
170 return false
173 return false
171 end
174 end
172 return true
175 return true
173 end
176 end
174
177
175 def is_request_ip_allowed?
178 def is_request_ip_allowed?
176 unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
179 unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
177 user_ip = IPAddr.new(request.remote_ip)
180 user_ip = IPAddr.new(request.remote_ip)
178 allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || ''
181 allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || ''
179
182
180 allowed.delete(' ').split(',').each do |ips|
183 allowed.delete(' ').split(',').each do |ips|
181 allow_ips = IPAddr.new(ips)
184 allow_ips = IPAddr.new(ips)
182 if allow_ips.include?(user_ip)
185 if allow_ips.include?(user_ip)
183 return true
186 return true
184 end
187 end
185 end
188 end
186 return false
189 return false
187 end
190 end
188 return true
191 return true
You need to be logged in to leave comments. Login now