Description:
prevent multiple place login using uuid cookie
Commit status:
[Not Reviewed]
References:
Diff options:
Comments:
0 Commit comments
0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Author
-
r883:327f656f4545 - - 1 file changed: 6 inserted, 3 deleted
| @@ -1,236 +1,239 | |||||
|
|
1 | require 'ipaddr' |
|
1 | require 'ipaddr' |
|
|
2 | require "securerandom" |
|
2 | require "securerandom" |
|
|
3 |
|
3 | ||
|
|
4 | class ApplicationController < ActionController::Base |
|
4 | class ApplicationController < ActionController::Base |
|
|
5 | protect_from_forgery |
|
5 | protect_from_forgery |
|
|
6 |
|
6 | ||
|
|
7 | before_action :current_user |
|
7 | before_action :current_user |
|
|
8 | before_action :nav_announcement |
|
8 | before_action :nav_announcement |
|
|
9 | before_action :unique_visitor_id |
|
9 | before_action :unique_visitor_id |
|
|
10 |
|
10 | ||
|
|
11 | SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode' |
|
11 | SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode' |
|
|
12 | MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login' |
|
12 | MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login' |
|
|
13 | WHITELIST_IGNORE_CONF_KEY = 'right.whitelist_ignore' |
|
13 | WHITELIST_IGNORE_CONF_KEY = 'right.whitelist_ignore' |
|
|
14 | WHITELIST_IP_CONF_KEY = 'right.whitelist_ip' |
|
14 | WHITELIST_IP_CONF_KEY = 'right.whitelist_ip' |
|
|
15 |
|
15 | ||
|
|
16 | #report and redirect for unauthorized activities |
|
16 | #report and redirect for unauthorized activities |
|
|
17 | def unauthorized_redirect(notice = 'You are not authorized to view the page you requested') |
|
17 | def unauthorized_redirect(notice = 'You are not authorized to view the page you requested') |
|
|
18 | flash[:notice] = notice |
|
18 | flash[:notice] = notice |
|
|
19 | redirect_to login_main_path |
|
19 | redirect_to login_main_path |
|
|
20 | end |
|
20 | end |
|
|
21 |
|
21 | ||
|
|
22 | # Returns the current logged-in user (if any). |
|
22 | # Returns the current logged-in user (if any). |
|
|
23 | def current_user |
|
23 | def current_user |
|
|
24 | return nil unless session[:user_id] |
|
24 | return nil unless session[:user_id] |
|
|
25 | @current_user ||= User.find(session[:user_id]) |
|
25 | @current_user ||= User.find(session[:user_id]) |
|
|
26 | end |
|
26 | end |
|
|
27 |
|
27 | ||
|
|
28 | def nav_announcement |
|
28 | def nav_announcement |
|
|
29 | @nav_announcement = Announcement.where(on_nav_bar: true) |
|
29 | @nav_announcement = Announcement.where(on_nav_bar: true) |
|
|
30 | end |
|
30 | end |
|
|
31 |
|
31 | ||
|
|
32 | def admin_authorization |
|
32 | def admin_authorization |
|
|
33 | return false unless check_valid_login |
|
33 | return false unless check_valid_login |
|
|
34 | user = User.includes(:roles).find(session[:user_id]) |
|
34 | user = User.includes(:roles).find(session[:user_id]) |
|
|
35 | unless user.admin? |
|
35 | unless user.admin? |
|
|
36 | unauthorized_redirect |
|
36 | unauthorized_redirect |
|
|
37 | return false |
|
37 | return false |
|
|
38 | end |
|
38 | end |
|
|
39 | return true |
|
39 | return true |
|
|
40 | end |
|
40 | end |
|
|
41 |
|
41 | ||
|
|
42 | #admin always count as every roles |
|
42 | #admin always count as every roles |
|
|
43 | def role_authorization(roles) |
|
43 | def role_authorization(roles) |
|
|
44 | return false unless check_valid_login |
|
44 | return false unless check_valid_login |
|
|
45 | user = User.find(session[:user_id]) |
|
45 | user = User.find(session[:user_id]) |
|
|
46 | return true if user.admin? |
|
46 | return true if user.admin? |
|
|
47 | roles.each do |r| |
|
47 | roles.each do |r| |
|
|
48 | return true if user.has_role?(r) |
|
48 | return true if user.has_role?(r) |
|
|
49 | end |
|
49 | end |
|
|
50 | unauthorized_redirect |
|
50 | unauthorized_redirect |
|
|
51 | end |
|
51 | end |
|
|
52 |
|
52 | ||
|
|
53 | def authorization_by_roles(allowed_roles) |
|
53 | def authorization_by_roles(allowed_roles) |
|
|
54 | return false unless check_valid_login |
|
54 | return false unless check_valid_login |
|
|
55 | unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) } |
|
55 | unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) } |
|
|
56 | unauthorized_redirect |
|
56 | unauthorized_redirect |
|
|
57 | return false |
|
57 | return false |
|
|
58 | end |
|
58 | end |
|
|
59 | end |
|
59 | end |
|
|
60 |
|
60 | ||
|
|
61 | def testcase_authorization |
|
61 | def testcase_authorization |
|
|
62 | #admin always has privileged |
|
62 | #admin always has privileged |
|
|
63 | if @current_user.admin? |
|
63 | if @current_user.admin? |
|
|
64 | return true |
|
64 | return true |
|
|
65 | end |
|
65 | end |
|
|
66 |
|
66 | ||
|
|
67 | unauthorized_redirect unless GraderConfiguration["right.view_testcase"] |
|
67 | unauthorized_redirect unless GraderConfiguration["right.view_testcase"] |
|
|
68 | end |
|
68 | end |
|
|
69 |
|
69 | ||
|
|
70 | def unique_visitor_id |
|
70 | def unique_visitor_id |
|
|
71 | unless cookies.encrypted[:uuid] |
|
71 | unless cookies.encrypted[:uuid] |
|
|
72 | value = SecureRandom.uuid |
|
72 | value = SecureRandom.uuid |
|
|
73 | cookies.encrypted[:uuid] = { value: value, expires: 20.year } |
|
73 | cookies.encrypted[:uuid] = { value: value, expires: 20.year } |
|
|
|
74 | + return value | ||
|
|
|
75 | + else | ||
|
|
|
76 | + return cookies.encrypted[:uuid] | ||
|
|
74 | end |
|
77 | end |
|
|
75 | end |
|
78 | end |
|
|
76 |
|
79 | ||
|
|
77 | protected |
|
80 | protected |
|
|
78 |
|
81 | ||
|
|
79 | #redirect to root (and also force logout) |
|
82 | #redirect to root (and also force logout) |
|
|
80 | #if the user is not logged_in or the system is in "ADMIN ONLY" mode |
|
83 | #if the user is not logged_in or the system is in "ADMIN ONLY" mode |
|
|
81 | def check_valid_login |
|
84 | def check_valid_login |
|
|
82 | #check if logged in |
|
85 | #check if logged in |
|
|
83 | unless session[:user_id] |
|
86 | unless session[:user_id] |
|
|
84 | if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY] |
|
87 | if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY] |
|
|
85 | unauthorized_redirect('You need to login but you cannot log in at this time') |
|
88 | unauthorized_redirect('You need to login but you cannot log in at this time') |
|
|
86 | else |
|
89 | else |
|
|
87 | unauthorized_redirect('You need to login') |
|
90 | unauthorized_redirect('You need to login') |
|
|
88 | end |
|
91 | end |
|
|
89 | return false |
|
92 | return false |
|
|
90 | end |
|
93 | end |
|
|
91 |
|
94 | ||
|
|
92 | # check if run in single user mode |
|
95 | # check if run in single user mode |
|
|
93 | if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY] |
|
96 | if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY] |
|
|
94 | if @current_user==nil || (!@current_user.admin?) |
|
97 | if @current_user==nil || (!@current_user.admin?) |
|
|
95 | unauthorized_redirect('You cannot log in at this time') |
|
98 | unauthorized_redirect('You cannot log in at this time') |
|
|
96 | return false |
|
99 | return false |
|
|
97 | end |
|
100 | end |
|
|
98 | end |
|
101 | end |
|
|
99 |
|
102 | ||
|
|
100 | # check if the user is enabled |
|
103 | # check if the user is enabled |
|
|
101 | unless @current_user.enabled? || @current_user.admin? |
|
104 | unless @current_user.enabled? || @current_user.admin? |
|
|
102 | unauthorized_redirect 'Your account is disabled' |
|
105 | unauthorized_redirect 'Your account is disabled' |
|
|
103 | return false |
|
106 | return false |
|
|
104 | end |
|
107 | end |
|
|
105 |
|
108 | ||
|
|
106 | # check if user ip is allowed |
|
109 | # check if user ip is allowed |
|
|
107 | unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY] |
|
110 | unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY] |
|
|
108 | unless is_request_ip_allowed? |
|
111 | unless is_request_ip_allowed? |
|
|
109 | unauthorized_redirect 'Your IP is not allowed to login at this time.' |
|
112 | unauthorized_redirect 'Your IP is not allowed to login at this time.' |
|
|
110 | return false |
|
113 | return false |
|
|
111 | end |
|
114 | end |
|
|
112 | end |
|
115 | end |
|
|
113 |
|
116 | ||
|
|
114 | if GraderConfiguration.multicontests? |
|
117 | if GraderConfiguration.multicontests? |
|
|
115 | return true if @current_user.admin? |
|
118 | return true if @current_user.admin? |
|
|
116 | begin |
|
119 | begin |
|
|
117 | if @current_user.contest_stat(true).forced_logout |
|
120 | if @current_user.contest_stat(true).forced_logout |
|
|
118 | flash[:notice] = 'You have been automatically logged out.' |
|
121 | flash[:notice] = 'You have been automatically logged out.' |
|
|
119 | redirect_to :controller => 'main', :action => 'index' |
|
122 | redirect_to :controller => 'main', :action => 'index' |
|
|
120 | end |
|
123 | end |
|
|
121 | rescue |
|
124 | rescue |
|
|
122 | end |
|
125 | end |
|
|
123 | end |
|
126 | end |
|
|
124 | return true |
|
127 | return true |
|
|
125 | end |
|
128 | end |
|
|
126 |
|
129 | ||
|
|
127 | #redirect to root (and also force logout) |
|
130 | #redirect to root (and also force logout) |
|
|
128 | #if the user use different ip from the previous connection |
|
131 | #if the user use different ip from the previous connection |
|
|
129 | # only applicable when MULTIPLE_IP_LOGIN options is false only |
|
132 | # only applicable when MULTIPLE_IP_LOGIN options is false only |
|
|
130 | def authenticate_by_ip_address |
|
133 | def authenticate_by_ip_address |
|
|
131 | #this assume that we have already authenticate normally |
|
134 | #this assume that we have already authenticate normally |
|
|
132 | unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY] |
|
135 | unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY] |
|
|
133 | user = User.find(session[:user_id]) |
|
136 | user = User.find(session[:user_id]) |
|
|
134 |
- if (!user.admin? && user.last_ip && user.last_ip != |
|
137 | + if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id) |
|
|
135 |
- flash[:notice] = "You cannot use the system from |
|
138 | + flash[:notice] = "You cannot use the system from two different places" |
|
|
136 | redirect_to :controller => 'main', :action => 'login' |
|
139 | redirect_to :controller => 'main', :action => 'login' |
|
|
137 | return false |
|
140 | return false |
|
|
138 | end |
|
141 | end |
|
|
139 | unless user.last_ip |
|
142 | unless user.last_ip |
|
|
140 |
- user.last_ip = |
|
143 | + user.last_ip = unique_visitor_id |
|
|
141 | user.save |
|
144 | user.save |
|
|
142 | end |
|
145 | end |
|
|
143 | end |
|
146 | end |
|
|
144 | return true |
|
147 | return true |
|
|
145 | end |
|
148 | end |
|
|
146 |
|
149 | ||
|
|
147 | def authorization |
|
150 | def authorization |
|
|
148 | return false unless check_valid_login |
|
151 | return false unless check_valid_login |
|
|
149 | user = User.find(session[:user_id]) |
|
152 | user = User.find(session[:user_id]) |
|
|
150 | unless user.roles.detect { |role| |
|
153 | unless user.roles.detect { |role| |
|
|
151 | role.rights.detect{ |right| |
|
154 | role.rights.detect{ |right| |
|
|
152 | right.controller == self.class.controller_name and |
|
155 | right.controller == self.class.controller_name and |
|
|
153 | (right.action == 'all' || right.action == action_name) |
|
156 | (right.action == 'all' || right.action == action_name) |
|
|
154 | } |
|
157 | } |
|
|
155 | } |
|
158 | } |
|
|
156 | flash[:notice] = 'You are not authorized to view the page you requested' |
|
159 | flash[:notice] = 'You are not authorized to view the page you requested' |
|
|
157 | #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login') |
|
160 | #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login') |
|
|
158 | redirect_to :controller => 'main', :action => 'login' |
|
161 | redirect_to :controller => 'main', :action => 'login' |
|
|
159 | return false |
|
162 | return false |
|
|
160 | end |
|
163 | end |
|
|
161 | end |
|
164 | end |
|
|
162 |
|
165 | ||
|
|
163 | def verify_time_limit |
|
166 | def verify_time_limit |
|
|
164 | return true if session[:user_id]==nil |
|
167 | return true if session[:user_id]==nil |
|
|
165 | user = User.find(session[:user_id], :include => :site) |
|
168 | user = User.find(session[:user_id], :include => :site) |
|
|
166 | return true if user==nil || user.site == nil |
|
169 | return true if user==nil || user.site == nil |
|
|
167 | if user.contest_finished? |
|
170 | if user.contest_finished? |
|
|
168 | flash[:notice] = 'Error: the contest you are participating is over.' |
|
171 | flash[:notice] = 'Error: the contest you are participating is over.' |
|
|
169 | redirect_to :back |
|
172 | redirect_to :back |
|
|
170 | return false |
|
173 | return false |
|
|
171 | end |
|
174 | end |
|
|
172 | return true |
|
175 | return true |
|
|
173 | end |
|
176 | end |
|
|
174 |
|
177 | ||
|
|
175 | def is_request_ip_allowed? |
|
178 | def is_request_ip_allowed? |
|
|
176 | unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY] |
|
179 | unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY] |
|
|
177 | user_ip = IPAddr.new(request.remote_ip) |
|
180 | user_ip = IPAddr.new(request.remote_ip) |
|
|
178 | allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || '' |
|
181 | allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || '' |
|
|
179 |
|
182 | ||
|
|
180 | allowed.delete(' ').split(',').each do |ips| |
|
183 | allowed.delete(' ').split(',').each do |ips| |
|
|
181 | allow_ips = IPAddr.new(ips) |
|
184 | allow_ips = IPAddr.new(ips) |
|
|
182 | if allow_ips.include?(user_ip) |
|
185 | if allow_ips.include?(user_ip) |
|
|
183 | return true |
|
186 | return true |
|
|
184 | end |
|
187 | end |
|
|
185 | end |
|
188 | end |
|
|
186 | return false |
|
189 | return false |
|
|
187 | end |
|
190 | end |
|
|
188 | return true |
|
191 | return true |
|
|
189 | end |
|
192 | end |
|
|
190 |
|
193 | ||
|
|
191 | #function for datatable ajax query |
|
194 | #function for datatable ajax query |
|
|
192 | #return record,total_count,filter_count |
|
195 | #return record,total_count,filter_count |
|
|
193 | def process_query_record(record, |
|
196 | def process_query_record(record, |
|
|
194 | total_count: nil, |
|
197 | total_count: nil, |
|
|
195 | select: '', |
|
198 | select: '', |
|
|
196 | global_search: [], |
|
199 | global_search: [], |
|
|
197 | no_search: false, |
|
200 | no_search: false, |
|
|
198 | force_order: '', |
|
201 | force_order: '', |
|
|
199 | date_filter: '', date_param_since: 'date_since',date_param_until: 'date_until', |
|
202 | date_filter: '', date_param_since: 'date_since',date_param_until: 'date_until', |
|
|
200 | hard_limit: nil) |
|
203 | hard_limit: nil) |
|
|
201 | arel_table = record.model.arel_table |
|
204 | arel_table = record.model.arel_table |
|
|
202 |
|
205 | ||
|
|
203 | if !no_search && params['search'] |
|
206 | if !no_search && params['search'] |
|
|
204 | global_value = record.model.sanitize_sql(params['search']['value'].strip.downcase) |
|
207 | global_value = record.model.sanitize_sql(params['search']['value'].strip.downcase) |
|
|
205 | if !global_value.blank? |
|
208 | if !global_value.blank? |
|
|
206 | global_value.split.each do |value| |
|
209 | global_value.split.each do |value| |
|
|
207 | global_where = global_search.map{|f| "LOWER(#{f}) like '%#{value}%'"}.join(' OR ') |
|
210 | global_where = global_search.map{|f| "LOWER(#{f}) like '%#{value}%'"}.join(' OR ') |
|
|
208 | record = record.where(global_where) |
|
211 | record = record.where(global_where) |
|
|
209 | end |
|
212 | end |
|
|
210 | end |
|
213 | end |
|
|
211 |
|
214 | ||
|
|
212 | params['columns'].each do |i, col| |
|
215 | params['columns'].each do |i, col| |
|
|
213 | if !col['search']['value'].blank? |
|
216 | if !col['search']['value'].blank? |
|
|
214 | record = record.where(arel_table[col['name']].lower.matches("%#{col['search']['value'].strip.downcase}%")) |
|
217 | record = record.where(arel_table[col['name']].lower.matches("%#{col['search']['value'].strip.downcase}%")) |
|
|
215 | end |
|
218 | end |
|
|
216 | end |
|
219 | end |
|
|
217 | end |
|
220 | end |
|
|
218 |
|
221 | ||
|
|
219 | if !date_filter.blank? |
|
222 | if !date_filter.blank? |
|
|
220 | param_since = params[date_param_since] |
|
223 | param_since = params[date_param_since] |
|
|
221 | param_until = params[date_param_until] |
|
224 | param_until = params[date_param_until] |
|
|
222 | date_since = Time.zone.parse( param_since ) || Time.new(1,1,1) rescue Time.new(1,1,1) |
|
225 | date_since = Time.zone.parse( param_since ) || Time.new(1,1,1) rescue Time.new(1,1,1) |
|
|
223 | date_until = Time.zone.parse( param_until ) || Time.zone.now() rescue Time.zone.now() |
|
226 | date_until = Time.zone.parse( param_until ) || Time.zone.now() rescue Time.zone.now() |
|
|
224 | date_range = date_since..(date_until.end_of_day) |
|
227 | date_range = date_since..(date_until.end_of_day) |
|
|
225 | record = record.where(date_filter.to_sym => date_range) |
|
228 | record = record.where(date_filter.to_sym => date_range) |
|
|
226 | end |
|
229 | end |
|
|
227 |
|
230 | ||
|
|
228 | if force_order.blank? |
|
231 | if force_order.blank? |
|
|
229 | if params['order'] |
|
232 | if params['order'] |
|
|
230 | params['order'].each do |i, o| |
|
233 | params['order'].each do |i, o| |
|
|
231 | colName = params['columns'][o['column']]['name'] |
|
234 | colName = params['columns'][o['column']]['name'] |
|
|
232 | colName = "#{record.model.table_name}.#{colName}" if colName.upcase == 'ID' |
|
235 | colName = "#{record.model.table_name}.#{colName}" if colName.upcase == 'ID' |
|
|
233 | record = record.order("#{colName} #{o['dir'].casecmp('desc') != 0 ? 'ASC' : 'DESC'}") unless colName.blank? |
|
236 | record = record.order("#{colName} #{o['dir'].casecmp('desc') != 0 ? 'ASC' : 'DESC'}") unless colName.blank? |
|
|
234 | end |
|
237 | end |
|
|
235 | end |
|
238 | end |
|
|
236 | else |
|
239 | else |
You need to be logged in to leave comments.
Login now