cafe-grader-web Commit - r884:490fbe2ccf0b

cafe-grader-web

Commit `r884:490fbe2ccf0b` public

parent | child

Description:

force log out when password change

Commit status:

[Not Reviewed]

References:

Diff options:

| | | |

Comments:

0 Commit comments 0 Inline Comments

Unresolved TODOs:

There are no unresolved TODOs

Add another comment

r884:490fbe2ccf0b - Fri, 28 Oct 2022 03:35:24 - 2 files changed: 6 inserted, 0 deleted

app/controllers/application_controller.rb ¶ +5

                 # Returns the current logged-in user (if any).
                 def current_user
                   return nil unless session[:user_id]
                   @current_user ||= User.find(session[:user_id])
                 end
                 def nav_announcement
                   @nav_announcement = Announcement.where(on_nav_bar: true)
                 end
                 def admin_authorization
                   return false unless check_valid_login
                   user = User.includes(:roles).find(session[:user_id])
                   unless user.admin?
                     unauthorized_redirect
                     return false
                   end
                   return true
                 end
                 #admin always count as every roles
                 def role_authorization(roles)
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   return true if user.admin?
                   roles.each do |r|
                     return true if user.has_role?(r)
                   end
                   unauthorized_redirect
                 end
                 def authorization_by_roles(allowed_roles)
                   return false unless check_valid_login
                   unless @current_user.roles.detect { |role| allowed_roles.member?(role.name) }
                     unauthorized_redirect
                     return false
                   end
                 end
                 def testcase_authorization
                   #admin always has privileged
                   if @current_user.admin?
                     return true
                   end
                   unauthorized_redirect unless GraderConfiguration["right.view_testcase"]
                 end
                 def unique_visitor_id
                   unless cookies.encrypted[:uuid]
                     value = SecureRandom.uuid
                     cookies.encrypted[:uuid] = { value: value, expires: 20.year }
                     return value
                   else
                     return cookies.encrypted[:uuid]
                   end
                 end
                 protected
                 #redirect to root (and also force logout)
                 #if the user is not logged_in or the system is in "ADMIN ONLY" mode
                 def check_valid_login
                   #check if logged in
                   unless session[:user_id]
                     if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                       unauthorized_redirect('You need to login but you cannot log in at this time')
                     else
                       unauthorized_redirect('You need to login')
                     end
                     return false
                   end
                   # check if run in single user mode
                   if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
                     if @current_user==nil || (!@current_user.admin?)
                       unauthorized_redirect('You cannot log in at this time')
                       return false
                     end
                   end
                   # check if the user is enabled
                   unless @current_user.enabled? || @current_user.admin?
                     unauthorized_redirect 'Your account is disabled'
                     return false
                   end
                   # check if user ip is allowed
                   unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     unless is_request_ip_allowed?
                       unauthorized_redirect 'Your IP is not allowed to login at this time.'
                       return false
                     end
                   end
+            +     # check if password is changed
+            +     if session[:last_password_hash] != @current_user.hashed_password
+            +       unauthorized_redirect 'You are forced to log out.'
+            +     end
+            +
                   if GraderConfiguration.multicontests?
                     return true if @current_user.admin?
                     begin
                       if @current_user.contest_stat(true).forced_logout
                         flash[:notice] = 'You have been automatically logged out.'
                         redirect_to :controller => 'main', :action => 'index'
                       end
                     rescue
                     end
                   end
                   return true
                 end
                 #redirect to root (and also force logout)
                 #if the user use different ip from the previous connection
                 #  only applicable when MULTIPLE_IP_LOGIN options is false only
                 def authenticate_by_ip_address
                   #this assume that we have already authenticate normally
                   unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
                     user = User.find(session[:user_id])
                     if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id)
                       flash[:notice] = "You cannot use the system from two different places"
                       redirect_to :controller => 'main', :action => 'login'
                       return false
                     end
                     unless user.last_ip
                       user.last_ip = unique_visitor_id
                       user.save
                     end
                   end
                   return true
                 end
                 def authorization
                   return false unless check_valid_login
                   user = User.find(session[:user_id])
                   unless user.roles.detect { |role|
                       role.rights.detect{ |right|
                         right.controller == self.class.controller_name and
                           (right.action == 'all' || right.action == action_name)
                       }
                     }
                     flash[:notice] = 'You are not authorized to view the page you requested'
                     #request.env['HTTP_REFERER'] ? (redirect_to :back) : (redirect_to :controller => 'login')
                     redirect_to :controller => 'main', :action => 'login'
                     return false
                   end
                 end
                 def verify_time_limit
                   return true if session[:user_id]==nil
                   user = User.find(session[:user_id], :include => :site)
                   return true if user==nil || user.site == nil
                   if user.contest_finished?
                     flash[:notice] = 'Error: the contest you are participating is over.'
                     redirect_to :back
                     return false
                   end
                   return true
                 end
                 def is_request_ip_allowed?
                   unless GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
                     user_ip = IPAddr.new(request.remote_ip)
                     allowed = GraderConfiguration[WHITELIST_IP_CONF_KEY] || ''
                     allowed.delete(' ').split(',').each do |ips|
                       allow_ips = IPAddr.new(ips)
                       if allow_ips.include?(user_ip)
                         return true
                       end
                     end
                     return false
                   end
                   return true
                 end
                 #function for datatable ajax query
                 #return record,total_count,filter_count
                 def process_query_record(record,
                                          total_count: nil,
                                          select: '',
                                          global_search: [],
                                          no_search: false,
                                          force_order: '',
                                          date_filter: '', date_param_since: 'date_since',date_param_until: 'date_until',
                                          hard_limit: nil)
                   arel_table = record.model.arel_table
                   if !no_search && params['search']
                     global_value = record.model.sanitize_sql(params['search']['value'].strip.downcase)
                     if !global_value.blank?
                       global_value.split.each do |value|
                         global_where = global_search.map{|f| "LOWER(#{f}) like '%#{value}%'"}.join(' OR ')
                         record = record.where(global_where)
                       end

app/controllers/login_controller.rb ¶ +1

               class LoginController < ApplicationController
                 @@authenticators = []
                 def index
                   # show login screen
                   reset_session
                   redirect_to :controller => 'main', :action => 'login'
                 end
                 def login
                   user = get_authenticated_user(params[:login], params[:password])
                   unless user
                     flash[:notice] = 'Wrong password'
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
                   if (!GraderConfiguration['right.bypass_agreement']) and (!params[:accept_agree]) and !user.admin?
                     flash[:notice] = 'You must accept the agreement before logging in'
                     redirect_to :controller => 'main', :action => 'login'
                     return
                   end
                   #store uuid when login
                   if user.last_ip.nil?
                     user.last_ip = cookies.encrypted[:uuid]
                   else
                     if user.last_ip != cookies.encrypted[:uuid]
                       user.last_ip =cookies.encrypted[:uuid]
                       #log different login
                     end
                   end
                   #process logging in
                   session[:user_id] = user.id
+            +     session[:last_password_hash] = user.hashed_password
                   session[:admin] = user.admin?
                   # clear forced logout flag for multicontests contest change
                   if GraderConfiguration.multicontests?
                     contest_stat = user.contest_stat
                     if contest_stat.respond_to? :forced_logout
                       if contest_stat.forced_logout
                         contest_stat.forced_logout = false
                         contest_stat.save
                       end
                     end
                   end
                   #save login information
                   Login.create(user_id: user.id, ip_address: cookies.encrypted[:uuid])
                   redirect_to :controller => 'main', :action => 'list'
                 end
                 def site_login
                   begin
                     site = Site.find(params[:login][:site_id])
                   rescue ActiveRecord::RecordNotFound
                     site = nil
                   end
                   if site==nil
                     flash[:notice] = 'Wrong site'
                     redirect_to :controller => 'main', :action => 'login'  and return
                   end
                   if (site.password) and (site.password == params[:login][:password])
                     session[:site_id] = site.id
                     redirect_to :controller => 'site', :action => 'index'
                   else
                     flash[:notice] = 'Wrong site password'
                     redirect_to :controller => 'site', :action => 'login'
                   end
                 end
                 def logout
                   redirect_to root_path
                 end
                 def self.add_authenticator(authenticator)
                   @@authenticators << authenticator
                 end
                 protected
                 def get_authenticated_user(login, password)
                   if @@authenticators.empty?
                     return User.authenticate(login, password)
                   else
                     user = User.authenticate(login, password)
                     @@authenticators.each do |authenticator|
                       if not user
                         user = authenticator.authenticate(login, password)
                       end
                     end
                     return user
                   end
                 end
               end

Write
Preview

You need to be logged in to leave comments. Login now

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository permissions settings

Sign in to your account

Author

r884:490fbe2ccf0b - Fri, 28 Oct 2022 03:35:24 - 2 files changed: 6 inserted, 0 deleted

Sign in to your account

Commit r884:490fbe2ccf0b public

Author

r884:490fbe2ccf0b - Fri, 28 Oct 2022 03:35:24 - 2 files changed: 6 inserted, 0 deleted

Commit `r884:490fbe2ccf0b` public