cafe-grader-web

Commit r884:490fbe2ccf0b public

parent | child
Description:
force log out when password change
Commit status:
[Not Reviewed]
References:
tip algo
Diff options:
Raw Diff | Patch Diff | Download Diff | Ignore whitespace | Increase context
Comments:
0 Commit comments 0 Inline Comments
Unresolved TODOs:
There are no unresolved TODOs
Side by Side Unified
Expand All Files Collapse All Files Wide Mode Diff
Add another comment
Browse Files

r884:490fbe2ccf0b - - 2 files changed: 7 inserted, 1 deleted

Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -93,48 +93,53
93 93 end
94 94
95 95 # check if run in single user mode
96 96 if GraderConfiguration[SINGLE_USER_MODE_CONF_KEY]
97 97 if @current_user==nil || (!@current_user.admin?)
98 98 unauthorized_redirect('You cannot log in at this time')
99 99 return false
100 100 end
101 101 end
102 102
103 103 # check if the user is enabled
104 104 unless @current_user.enabled? || @current_user.admin?
105 105 unauthorized_redirect 'Your account is disabled'
106 106 return false
107 107 end
108 108
109 109 # check if user ip is allowed
110 110 unless @current_user.admin? || GraderConfiguration[WHITELIST_IGNORE_CONF_KEY]
111 111 unless is_request_ip_allowed?
112 112 unauthorized_redirect 'Your IP is not allowed to login at this time.'
113 113 return false
114 114 end
115 115 end
116 116
117 + # check if password is changed
118 + if session[:last_password_hash] != @current_user.hashed_password
119 + unauthorized_redirect 'You are forced to log out.'
120 + end
121 +
117 122 if GraderConfiguration.multicontests?
118 123 return true if @current_user.admin?
119 124 begin
120 125 if @current_user.contest_stat(true).forced_logout
121 126 flash[:notice] = 'You have been automatically logged out.'
122 127 redirect_to :controller => 'main', :action => 'index'
123 128 end
124 129 rescue
125 130 end
126 131 end
127 132 return true
128 133 end
129 134
130 135 #redirect to root (and also force logout)
131 136 #if the user use different ip from the previous connection
132 137 # only applicable when MULTIPLE_IP_LOGIN options is false only
133 138 def authenticate_by_ip_address
134 139 #this assume that we have already authenticate normally
135 140 unless GraderConfiguration[MULTIPLE_IP_LOGIN_CONF_KEY]
136 141 user = User.find(session[:user_id])
137 142 if (!user.admin? && user.last_ip && user.last_ip != unique_visitor_id)
138 143 flash[:notice] = "You cannot use the system from two different places"
139 144 redirect_to :controller => 'main', :action => 'login'
140 145 return false
Show file before | Show file after | Raw diff | Download diff | Ignore whitespace Increase context Show commentsHide comments
@@ -1,60 +1,61
1 1 class LoginController < ApplicationController
2 2
3 3 @@authenticators = []
4 -
4 +
5 5 def index
6 6 # show login screen
7 7 reset_session
8 8 redirect_to :controller => 'main', :action => 'login'
9 9 end
10 10
11 11 def login
12 12 user = get_authenticated_user(params[:login], params[:password])
13 13 unless user
14 14 flash[:notice] = 'Wrong password'
15 15 redirect_to :controller => 'main', :action => 'login'
16 16 return
17 17 end
18 18
19 19 if (!GraderConfiguration['right.bypass_agreement']) and (!params[:accept_agree]) and !user.admin?
20 20 flash[:notice] = 'You must accept the agreement before logging in'
21 21 redirect_to :controller => 'main', :action => 'login'
22 22 return
23 23 end
24 24
25 25 #store uuid when login
26 26 if user.last_ip.nil?
27 27 user.last_ip = cookies.encrypted[:uuid]
28 28 else
29 29 if user.last_ip != cookies.encrypted[:uuid]
30 30 user.last_ip =cookies.encrypted[:uuid]
31 31 #log different login
32 32 end
33 33 end
34 34
35 35 #process logging in
36 36 session[:user_id] = user.id
37 + session[:last_password_hash] = user.hashed_password
37 38 session[:admin] = user.admin?
38 39
39 40 # clear forced logout flag for multicontests contest change
40 41 if GraderConfiguration.multicontests?
41 42 contest_stat = user.contest_stat
42 43 if contest_stat.respond_to? :forced_logout
43 44 if contest_stat.forced_logout
44 45 contest_stat.forced_logout = false
45 46 contest_stat.save
46 47 end
47 48 end
48 49 end
49 50
50 51 #save login information
51 52 Login.create(user_id: user.id, ip_address: cookies.encrypted[:uuid])
52 53
53 54 redirect_to :controller => 'main', :action => 'list'
54 55 end
55 56
56 57 def site_login
57 58 begin
58 59 site = Site.find(params[:login][:site_id])
59 60 rescue ActiveRecord::RecordNotFound
60 61 site = nil
You need to be logged in to leave comments. Login now