cafe-grader-web Commit - r852:41c96ab8e589

cafe-grader-web

Commit `r852:41c96ab8e589` public

parent | child

Description:

use uuid cookie

Commit status:

[Not Reviewed]

References:

default

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r852:41c96ab8e589 - Thu, 03 Feb 2022 17:22:51 - 3 files changed: 20 inserted, 2 deleted

app/controllers/application_controller.rb ¶ +8

               require 'ipaddr'
+            + require "securerandom"
               class ApplicationController < ActionController::Base
                 protect_from_forgery
                 before_action :current_user
                 before_action :nav_announcement
+            +   before_action :unique_visitor_id
                 SINGLE_USER_MODE_CONF_KEY = 'system.single_user_mode'
                 MULTIPLE_IP_LOGIN_CONF_KEY = 'right.multiple_ip_login'
                 WHITELIST_IGNORE_CONF_KEY = 'right.whitelist_ignore'
                 WHITELIST_IP_CONF_KEY = 'right.whitelist_ip'
                 #report and redirect for unauthorized activities
                 def unauthorized_redirect(notice = 'You are not authorized to view the page you requested')
                   flash[:notice] = notice
                   redirect_to login_main_path
                 end
                 # Returns the current logged-in user (if any).
                 def current_user
                   return nil unless session[:user_id]
                   @current_user ||= User.find(session[:user_id])
                 end
                 def nav_announcement
                   @nav_announcement = Announcement.where(on_nav_bar: true)
                 end
                 def admin_authorization
                   return false unless check_valid_login
                   user = User.includes(:roles).find(session[:user_id])
                   unless user.admin?
                     unauthorized_redirect
                     return false
                   end
                   return true
                 end
                 def authorization_by_roles(allowed_roles)
                   return false unless check_valid_login
                   unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
                     unauthorized_redirect
                     return false
                   end
                 end
                 def testcase_authorization
                   #admin always has privileged
                   if @current_user.admin?
                     return true
                   end
                   unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
                 end
+            +   def unique_visitor_id
+            +     unless cookies[:uuid]
+            +       value = SecureRandom.uuid
+            +       cookies[:uuid] = { value: value, expires: 20.year }
+            +     end
+            +   end
                 protected
                 #redirect to root (and also force logout)
                 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
                 def check_valid_login
                   #check if logged in
                   unless session[:user_id]
                     if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                       unauthorized_redirect('You need to login but you cannot log in at this time')
                     else
                       unauthorized_redirect('You need to login')
                     end
                     return false
                   end
                   # check if run in single user mode
                   if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                     if @current_user==nil || (!@current_user.admin?)
                       unauthorized_redirect('You cannot log in at this time')
                       return false
                     end
                   end
                   # check if the user is enabled
                   unless @current_user.enabled? || @current_user.admin?
                     unauthorized_redirect 'Your account is disabled'
                     return false
                   end
                   # check if user ip is allowed
                   unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     unless is_request_ip_allowed?
                       unauthorized_redirect 'Your IP is not allowed to login at this time.'
                       return false
                     end
                   end
                   if GraderConfiguration.multicontests?
                     return true if @current_user.admin?
                     begin
                       if @current_user.contest_stat(true).forced_logout
                         flash[:notice] = 'You have been automatically logged out.'
                         redirect_to :controller => 'main', :action => 'index'
                       end
                     rescue
                     end
                   end
                   return true
                 end
                 #redirect to root (and also force logout)
                 #if the user use different ip from the previous connection
                 #  only applicable when MULTIPLE_IP_LOGIN options is false only
                 def authenticate_by_ip_address
                   #this assume that we have already authenticate normally
                   unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
                     user = User.find(session[:user_id])
                     if (!user.admin? && user.last_ip && user.last_ip != request.remote_ip)
                       flash[:notice] = "You cannot use the system from #{request.remote_ip}. Your last ip is #{user.last_ip}"
                       redirect_to :controller => 'main', :action => 'login'
                       return false
                     end
                     unless user.last_ip
                       user.last_ip = request.remote_ip
                       user.save
                     end
                   end
                   return true
                 end
                 def authorization
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role|
                       role.rights.detect{ |right|
                         right.controller == self.class.controller_name and
                           (right.action == 'all' || right.action == action_name)
                       }
                     }
                     flash[:notice] = 'You are not authorized to view the page you requested'
                     #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 def verify_time_limit
                   return true if session[:user_id]==nil
                   user = User.find(session[:user_id], :include => :site)
                   return true if user==nil || user.site == nil
                   if user.contest_finished?
                     flash[:notice] = 'Error: the contest you are participating is over.'
                     redirect_to :back
                     return false
                   end
                   return true
                 end
                 def is_request_ip_allowed?
                   unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     user_ip = IPAddr.new(request.remote_ip)
                     allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || ''
                     allowed.delete(' ').split(',').each do |ips|
                       allow_ips = IPAddr.new(ips)
                       if allow_ips.include?(user_ip)
                         return true
                       end
                     end
                     return false
                   end
                   return true
                 end
                 #function for datatable ajax query
                 #return record,total_count,filter_count
                 def process_query_record(record,
                                          total_count: nil,
                                          select: '',
                                          global_search: [],
                                          no_search: false,
                                          force_order: '',
                                          date_filter: '', date_param_since: 'date_since',date_param_until: 'date_until',
                                          hard_limit: nil)
                   arel_table = record.model.arel_table
                   if !no_search && params['search']
                     global_value = record.model.sanitize_sql(params['search']['value'].strip.downcase)
                     if !global_value.blank?
                       global_value.split.each do |value|
                         global_where = global_search.map{|f| "LOWER(#{f}) like '%#{value}%'"}.join(' OR ')
                         record = record.where(global_where)
                       end
                     end
                     params['columns'].each do |i, col|
                       if !col['search']['value'].blank?
                         record = record.where(arel_table[col['name']].lower.matches("%#{col['search']['value'].strip.downcase}%"))
                       end
                     end
                   end
                   if !date_filter.blank?
                     param_since = params[date_param_since]
                     param_until = params[date_param_until]
                     date_since = Time.zone.parse( param_since ) || Time.new(1,1,1) rescue Time.new(1,1,1)
                     date_until = Time.zone.parse( param_until ) || Time.zone.now() rescue Time.zone.now()
                     date_range = date_since..(date_until.end_of_day)
                     record = record.where(date_filter.to_sym => date_range)
                   end
                   if force_order.blank?
                     if params['order']
                       params['order'].each do |i, o|
                         colName = params['columns'][o['column']]['name']
                         colName = "#{record.model.table_name}.#{colName}" if colName.upcase == 'ID'
                         record = record.order("#{colName} #{o['dir'].casecmp('desc') != 0 ? 'ASC' : 'DESC'}") unless colName.blank?
                       end
                     end
                   else
                     record = record.order(force_order)
                   end
                   filterCount = record.count(record.model.primary_key)
                   # if .group() is used, filterCount might be like {id_1: count_1, id_2: count_2, ...}
                   # so we should count the result again..
                   if filterCount.is_a? Hash
                     filterCount = filterCount.count
                   end
                   record = record.offset(params['start'] || 0)
                   record = record.limit(hard_limit)
                   if (params['length'])
                     limit = params['length'].to_i
                     limit == hard_limit if (hard_limit && hard_limit < limit)
                     record = record.limit(limit)
                   end
                   if (!select.blank?)
                     record = record.select(select)
                   end
                   return record, total_count || record.model.count, filterCount
                 end
               end

app/controllers/login_controller.rb ¶ +11 -1

               class LoginController < ApplicationController
                 @@authenticators = []
                 def index
                   # show login screen
                   reset_session
                   redirect_to :controller => 'main', :action => 'login'
                 end
                 def login
                   user = get_authenticated_user(params[:login], params[:password])
                   unless user
                     flash[:notice] = 'Wrong password'
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
                   if (!GraderConfiguration['right.bypass_agreement']) and (!params[:accept_agree]) and !user.admin?
                     flash[:notice] = 'You must accept the agreement before logging in'
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
+            +     #store uuid when login
+            +     if user.last_ip.nil?
+            +       user.last_ip = cookies[:uuid]
+            +     else
+            +       if user.last_ip != cookies[:uuid]
+            +         user.last_ip =cookies[:uuid]
+            +         #log different login
+            +       end
+            +     end
+            +
                   #process logging in
                   session[:user_id] = user.id
                   session[:admin] = user.admin?
                   # clear forced logout flag for multicontests contest change
                   if GraderConfiguration.multicontests?
                     contest_stat = user.contest_stat
                     if contest_stat.respond_to? :forced_logout
                       if contest_stat.forced_logout
                         contest_stat.forced_logout = false
                         contest_stat.save
                       end
                     end
                   end
                   #save login information
-            -     Login.create(user_id: user.id, ip_address: request.remote_ip)
+            +     Login.create(user_id: user.id, ip_address: cookies[:uuid])
                   redirect_to :controller => 'main', :action => 'list'
                 end
                 def site_login
                   begin
                     site = Site.find(params[:login][:site_id])
                   rescue ActiveRecord::RecordNotFound
                     site = nil
                   end
                   if site==nil
                     flash[:notice] = 'Wrong site'
                     redirect_to :controller => 'main', :action => 'login'  and return
                   end
                   if (site.password) and (site.password == params[:login][:password])
                     session[:site_id] = site.id
                     redirect_to :controller => 'site', :action => 'index'
                   else
                     flash[:notice] = 'Wrong site password'
                     redirect_to :controller => 'site', :action => 'login'
                   end
                 end
                 def logout
                   redirect_to root_path
                 end
                 def self.add_authenticator(authenticator)
                   @@authenticators << authenticator
                 end
                 protected
                 def get_authenticated_user(login, password)
                   if @@authenticators.empty?
                     return User.authenticate(login, password)
                   else
                     user = User.authenticate(login, password)
                     @@authenticators.each do |authenticator|
                       if not user
                         user = authenticator.authenticate(login, password)
                       end
                     end
                     return user
                   end
                 end
               end

app/models/user.rb ¶ +1 -1

               require 'digest/sha1'
               require 'net/pop'
               require 'net/https'
               require 'net/http'
               require 'json'
               class User < ActiveRecord::Base
                 has_and_belongs_to_many :roles
                 #has_and_belongs_to_many :groups
                 has_many :groups_users, class_name: 'GroupUser'
                 has_many :groups, :through => :groups_users
                 has_many :test_requests, -> {order(submitted_at: :desc)}
                 has_many :messages, -> { order(created_at: :desc) },
                          :class_name => "Message",
                          :foreign_key => "sender_id"
                 has_many :replied_messages, -> { order(created_at: :desc) },
                          :class_name => "Message",
                          :foreign_key => "receiver_id"
                 has_many :logins
                 has_one :contest_stat, :class_name => "UserContestStat", :dependent => :destroy
                 belongs_to :site
                 belongs_to :country
                 has_and_belongs_to_many :contests, -> { order(:name)}
                 scope :activated_users, -> {where activated: true}
                 validates_presence_of :login
                 validates_uniqueness_of :login
                 validates_format_of :login, :with => /\A[\_A-Za-z0-9]+\z/
                 validates_length_of :login, :within => 3..30
                 validates_presence_of :full_name
                 validates_length_of :full_name, :minimum => 1
+            +
                 validates_presence_of :password, :if => :password_required?
                 validates_length_of :password, :within => 4..50, :if => :password_required?
                 validates_confirmation_of :password, :if => :password_required?
                 validates_format_of :email,
                                     :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i,
                                     :if => :email_validation?
                 validate :uniqueness_of_email_from_activated_users,
                          :if => :email_validation?
                 validate :enough_time_interval_between_same_email_registrations,
                          :if => :email_validation?
                 # these are for ytopc
                 # disable for now
                 #validates_presence_of :province
                 attr_accessor :password
                 before_save :encrypt_new_password
                 before_save :assign_default_site
                 before_save :assign_default_contest
                 # this is for will_paginate
                 cattr_reader :per_page
                 @@per_page = 50
                 def self.authenticate(login, password)
                   user = find_by_login(login)
                   if user
                     return user if user.authenticated?(password)
                   end
                 end
                 def authenticated?(password)
                   if self.activated
                     hashed_password == User.encrypt(password,self.salt)
                   else
                     false
                   end
                 end
                 def login_with_name
                   "[#{login}] #{full_name}"
                 end
                 def admin?
                   has_role?('admin')
                 end
                 def has_role?(role)
                   self.roles.where(name: role).count > 0
                 end
                 def email_for_editing
                   if self.email==nil
                     "(unknown)"
                   elsif self.email==''
                     "(blank)"
                   else
                     self.email
                   end
                 end
                 def email_for_editing=(e)
                   self.email=e
                 end
                 def alias_for_editing
                   if self.alias==nil
                     "(unknown)"
                   elsif self.alias==''
                     "(blank)"
                   else
                     self.alias
                   end
                 end
                 def alias_for_editing=(e)
                   self.alias=e
                 end
                 def activation_key
                   if self.hashed_password==nil
                     encrypt_new_password
                   end
                   Digest::SHA1.hexdigest(self.hashed_password)[0..7]
                 end
                 def verify_activation_key(key)
                   key == activation_key
                 end
                 def self.random_password(length=5)
                   chars = 'abcdefghjkmnopqrstuvwxyz'
                   password = ''
                   length.times { password << chars[rand(chars.length - 1)] }
                   password
                 end
                 # Contest information
                 def self.find_users_with_no_contest()
                   users = User.all
                   return users.find_all { |u| u.contests.length == 0 }
                 end
                 def contest_time_left
                   if GraderConfiguration.contest_mode?
                     return nil if site==nil
                     return site.time_left
                   elsif GraderConfiguration.indv_contest_mode?
                     time_limit = GraderConfiguration.contest_time_limit
                     if time_limit == nil
                       return nil
                     end
                     if contest_stat==nil or contest_stat.started_at==nil
                       return (Time.now.gmtime + time_limit) - Time.now.gmtime
                     else
                       finish_time = contest_stat.started_at + time_limit
                       current_time = Time.now.gmtime
                       if current_time > finish_time
                         return 0
                       else
                         return finish_time - current_time
                       end
                     end
                   else
                     return nil
                   end
                 end
                 def contest_finished?
                   if GraderConfiguration.contest_mode?
                     return false if site==nil
                     return site.finished?
                   elsif GraderConfiguration.indv_contest_mode?
                     return false if self.contest_stat==nil
                     return contest_time_left == 0
                   else
                     return false
                   end
                 end
                 def contest_started?
                   if GraderConfiguration.indv_contest_mode?
                     stat = self.contest_stat
                     return ((stat != nil) and (stat.started_at != nil))
                   elsif GraderConfiguration.contest_mode?
                     return true if site==nil
                     return site.started
                   else
                     return true
                   end
                 end
                 def update_start_time
                   stat = self.contest_stat
                   if stat.nil? or stat.started_at.nil?
                     stat ||= UserContestStat.new(:user => self)
                     stat.started_at = Time.now.gmtime
                     stat.save
                   end
                 end
                 def problem_in_user_contests?(problem)
                   problem_contests = problem.contests.all
                   if problem_contests.length == 0   # this is public contest
                     return true
                   end
                   contests.each do |contest|
                     if problem_contests.find {|c| c.id == contest.id }
                       return true
                     end
                   end
                   return false
                 end
                 def available_problems_group_by_contests
                   contest_problems = []
                   pin = {}
                   contests.enabled.each do |contest|
                     available_problems = contest.problems.available
                     contest_problems << {
                       :contest => contest,
                       :problems => available_problems
                     }
                     available_problems.each {|p| pin[p.id] = true}
                   end
                   other_avaiable_problems = Problem.available.find_all {|p| pin[p.id]==nil and p.contests.length==0}
                   contest_problems << {
                     :contest => nil,
                     :problems => other_avaiable_problems
                   }
                   return contest_problems
                 end
                 def solve_all_available_problems?
                   available_problems.each do |p|
                     u = self
                     sub = Submission.find_last_by_user_and_problem(u.id,p.id)
                     return false if !p or !sub or sub.points < p.full_score
                   end
                   return true
                 end
                 #get a list of available problem
                 def available_problems
                   # first, we check if this is normal mode
                   if not GraderConfiguration.multicontests?
                     #if this is a normal mode
                     #we show problem based on problem_group, if the config said so
                     if GraderConfiguration.use_problem_group?
                       return available_problems_in_group
                     else
                       return Problem.available_problems
                     end
                   else
                     #this is multi contest mode
                     contest_problems = []
                     pin = {}
                     contests.enabled.each do |contest|
                       contest.problems.available.each do |problem|
                         if not pin.has_key? problem.id
                           contest_problems << problem
                         end
                         pin[problem.id] = true
                       end
                     end
                     other_avaiable_problems = Problem.available.find_all {|p| pin[p.id]==nil and p.contests.length==0}
                     return contest_problems + other_avaiable_problems
                   end
                 end
                 # new feature, get list of available problem in all enabled group that the user belongs to
                 def available_problems_in_group
                   problem = []
                   self.groups.where(enabled: true).each do |group|
                     group.problems.where(available: true).each { |p| problem << p }
                   end
                   problem.uniq!
                   if problem
                     problem.sort! do |a,b|
                       case
                       when a.date_added < b.date_added
                       when a.date_added > b.date_added
                         -1
                       else
                         a.name <=> b.name
                       end
                     end
                     return problem
                   else
                     return []
                   end
                 end
                 #check if the user has the right to view that problem
                 #this also consider group based problem policy
                 def can_view_problem?(problem)
                   return true if admin?
                   return available_problems.include? problem
                 end
                 def self.clear_last_login
                   User.update_all(:last_ip => nil)
                 end
                 #create multiple user, one per lines of input
                 def self.create_from_list(lines)
                   error_logins = []
                   first_error = nil
                   created_users = []
                   lines.split("\n").each do |line|
                     #split with large limit, this will cause consecutive ',' to be result in a blank
                     items = line.chomp.split(',',1000)
                     if items.length>=2
                       login = items[0]
                       full_name = items[1]
                       remark =''
                       user_alias = ''
                       added_random_password = false
                       added_password = false
                       #given password?
                       if items.length >= 3
                         if items[2].chomp(" ").length > 0
                           password = items[2].chomp(" ")
                           added_password = true
                         end
                       else
                         password = random_password
                         added_random_password=true;
                       end
                       #given alias?
                       if items.length>= 4 and items[3].chomp(" ").length > 0;
                         user_alias = items[3].chomp(" ")
                       else
                         user_alias = login
                       end
                       #given remark?
                       has_remark = false
                       if items.length>=5
                         remark = items[4].strip;
                         has_remark = true
                       end
                       user = User.find_by_login(login)
                       if (user)
                         user.full_name = full_name
                         user.remark = remark if has_remark
                         user.password = password if added_password || added_random_password
                       else
                         #create a random password if none are given
                         password = random_password unless password
                         user = User.new({:login => login,
                                          :full_name => full_name,
                                          :password => password,
                                          :password_confirmation => password,
                                          :alias => user_alias,
                                          :remark => remark})
                       end
                       user.activated = true
                       if user.save
                         created_users << user
                       else
                         error_logins << "'#{login}'"
                         first_error = user.errors.full_messages.to_sentence unless first_error
                       end
                     end
                   end
                   return {error_logins: error_logins, first_error: first_error, created_users: created_users}
                 end
                 def self.find_non_admin_with_prefix(prefix='')
                   users = User.all
                   return users.find_all { |u| !(u.admin?) and u.login.index(prefix)==0 }
                 end
                 protected
                   def encrypt_new_password
                     return if password.blank?
                     self.salt = (10+rand(90)).to_s
                     self.hashed_password = User.encrypt(self.password,self.salt)
                   end
                   def assign_default_site
                     # have to catch error when migrating (because self.site is not available).
                     begin
                       if self.site==nil
                         self.site = Site.find_by_name('default')
                         if self.site==nil
                           self.site = Site.find(1)  # when 'default has be renamed'
                         end
                       end
                     rescue
                     end
                   end
                   def assign_default_contest
                     # have to catch error when migrating (because self.site is not available).
                     begin
                       if self.contests.length == 0
                         default_contest = Contest.find_by_name(GraderConfiguration['contest.default_contest_name'])
                         if default_contest
                           self.contests = [default_contest]
                         end
                       end
                     rescue
                     end
                   end
                   def password_required?
                     self.hashed_password.blank? || !self.password.blank?
                   end
                   def self.encrypt(string,salt)
                     Digest::SHA1.hexdigest(salt + string)
                   end
                   def uniqueness_of_email_from_activated_users
                     user = User.activated_users.find_by_email(self.email)
                     if user and (user.login != self.login)
                       self.errors.add(:base,"Email has already been taken")
                     end
                   end
                   def enough_time_interval_between_same_email_registrations
                     return if !self.new_record?
                     return if self.activated
                     open_user = User.find_by_email(self.email,
                                                    :order => 'created_at DESC')
                     if open_user and open_user.created_at and
                         (open_user.created_at > Time.now.gmtime - 5.minutes)
                       self.errors.add(:base,"There are already unactivated registrations with this e-mail address (please wait for 5 minutes)")
                     end
                   end
                   def email_validation?
                     begin
                       return VALIDATE_USER_EMAILS
                     rescue
                       return false
                     end
                   end
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r852:41c96ab8e589 - Thu, 03 Feb 2022 17:22:51 - 3 files changed: 20 inserted, 2 deleted

Sign in to your account

Commit r852:41c96ab8e589 public

Author

r852:41c96ab8e589 - Thu, 03 Feb 2022 17:22:51 - 3 files changed: 20 inserted, 2 deleted

Commit `r852:41c96ab8e589` public