You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

account_controller.rb 14KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438
  1. # frozen_string_literal: true
  2. # Redmine - project management software
  3. # Copyright (C) 2006- Jean-Philippe Lang
  4. #
  5. # This program is free software; you can redistribute it and/or
  6. # modify it under the terms of the GNU General Public License
  7. # as published by the Free Software Foundation; either version 2
  8. # of the License, or (at your option) any later version.
  9. #
  10. # This program is distributed in the hope that it will be useful,
  11. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  12. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13. # GNU General Public License for more details.
  14. #
  15. # You should have received a copy of the GNU General Public License
  16. # along with this program; if not, write to the Free Software
  17. # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18. class AccountController < ApplicationController
  19. helper :custom_fields
  20. include CustomFieldsHelper
  21. self.main_menu = false
  22. # prevents login action to be filtered by check_if_login_required application scope filter
  23. skip_before_action :check_if_login_required, :check_password_change
  24. skip_before_action :check_twofa_activation, :only => :logout
  25. # Login request and validation
  26. def login
  27. if request.post?
  28. authenticate_user
  29. else
  30. if User.current.logged?
  31. redirect_back_or_default home_url, :referer => true
  32. end
  33. end
  34. rescue AuthSourceException => e
  35. logger.error "An error occurred when authenticating #{params[:username]}: #{e.message}"
  36. render_error :message => e.message
  37. end
  38. # Log out current user and redirect to welcome page
  39. def logout
  40. if User.current.anonymous?
  41. redirect_to home_url
  42. elsif request.post?
  43. logout_user
  44. redirect_to home_url
  45. end
  46. # display the logout form
  47. end
  48. # Lets user choose a new password
  49. def lost_password
  50. (redirect_to(home_url); return) unless Setting.lost_password?
  51. if prt = (params[:token] || session[:password_recovery_token])
  52. @token = Token.find_token("recovery", prt.to_s)
  53. if @token.nil?
  54. redirect_to home_url
  55. return
  56. elsif @token.expired?
  57. # remove expired token from session and let user try again
  58. session[:password_recovery_token] = nil
  59. flash[:error] = l(:error_token_expired)
  60. redirect_to lost_password_url
  61. return
  62. end
  63. # redirect to remove the token query parameter from the URL and add it to the session
  64. if request.query_parameters[:token].present?
  65. session[:password_recovery_token] = @token.value
  66. redirect_to lost_password_url
  67. return
  68. end
  69. @user = @token.user
  70. unless @user && @user.active?
  71. redirect_to home_url
  72. return
  73. end
  74. if request.post?
  75. if @user.must_change_passwd? && @user.check_password?(params[:new_password])
  76. flash.now[:error] = l(:notice_new_password_must_be_different)
  77. else
  78. @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation]
  79. @user.must_change_passwd = false
  80. if @user.save
  81. @token.destroy
  82. Mailer.deliver_password_updated(@user, User.current)
  83. flash[:notice] = l(:notice_account_password_updated)
  84. redirect_to signin_path
  85. return
  86. end
  87. end
  88. end
  89. render :template => "account/password_recovery"
  90. return
  91. else
  92. if request.post?
  93. email = params[:mail].to_s.strip
  94. user = User.find_by_mail(email)
  95. # user not found
  96. unless user
  97. # Don't show an error indicating a non-existent email address
  98. # to prevent email harvesting
  99. flash[:notice] = l(:notice_account_lost_email_sent)
  100. return
  101. end
  102. unless user.active?
  103. handle_inactive_user(user, lost_password_path)
  104. return
  105. end
  106. # user cannot change its password
  107. unless user.change_password_allowed?
  108. flash.now[:error] = l(:notice_can_t_change_password)
  109. return
  110. end
  111. # create a new token for password recovery
  112. token = Token.new(:user => user, :action => "recovery")
  113. if token.save
  114. # Don't use the param to send the email
  115. recipent = user.mails.detect {|e| email.casecmp(e) == 0} || user.mail
  116. Mailer.deliver_lost_password(user, token, recipent)
  117. flash[:notice] = l(:notice_account_lost_email_sent)
  118. redirect_to signin_path
  119. return
  120. end
  121. end
  122. end
  123. end
  124. # User self-registration
  125. def register
  126. (redirect_to(home_url); return) unless Setting.self_registration? || session[:auth_source_registration]
  127. if !request.post?
  128. session[:auth_source_registration] = nil
  129. @user = User.new(:language => current_language.to_s)
  130. else
  131. user_params = params[:user] || {}
  132. @user = User.new
  133. @user.safe_attributes = user_params
  134. @user.pref.safe_attributes = params[:pref]
  135. @user.admin = false
  136. @user.register
  137. if session[:auth_source_registration]
  138. @user.activate
  139. @user.login = session[:auth_source_registration][:login]
  140. @user.auth_source_id = session[:auth_source_registration][:auth_source_id]
  141. if @user.save
  142. session[:auth_source_registration] = nil
  143. self.logged_user = @user
  144. flash[:notice] = l(:notice_account_activated)
  145. redirect_to my_account_path
  146. end
  147. else
  148. unless user_params[:password].blank? && user_params[:password_confirmation].blank?
  149. @user.password, @user.password_confirmation = user_params[:password], user_params[:password_confirmation]
  150. end
  151. case Setting.self_registration
  152. when '1'
  153. register_by_email_activation(@user)
  154. when '3'
  155. register_automatically(@user)
  156. else
  157. register_manually_by_administrator(@user)
  158. end
  159. end
  160. end
  161. end
  162. # Token based account activation
  163. def activate
  164. (redirect_to(home_url); return) unless Setting.self_registration? && params[:token].present?
  165. token = Token.find_token('register', params[:token].to_s)
  166. (redirect_to(home_url); return) unless token and !token.expired?
  167. user = token.user
  168. (redirect_to(home_url); return) unless user.registered?
  169. user.activate
  170. if user.save
  171. token.destroy
  172. flash[:notice] = l(:notice_account_activated)
  173. end
  174. redirect_to signin_path
  175. end
  176. # Sends a new account activation email
  177. def activation_email
  178. if session[:registered_user_id] && Setting.self_registration == '1'
  179. user_id = session.delete(:registered_user_id).to_i
  180. user = User.find_by_id(user_id)
  181. if user && user.registered?
  182. register_by_email_activation(user)
  183. return
  184. end
  185. end
  186. redirect_to(home_url)
  187. end
  188. before_action :require_active_twofa, :twofa_setup, only: [:twofa_resend, :twofa_confirm, :twofa]
  189. before_action :prevent_twofa_session_replay, only: [:twofa_resend, :twofa]
  190. def twofa_resend
  191. # otp resends count toward the maximum of 3 otp entry tries per password entry
  192. if session[:twofa_tries_counter] > 3
  193. destroy_twofa_session
  194. flash[:error] = l('twofa_too_many_tries')
  195. redirect_to home_url
  196. else
  197. if @twofa.send_code(controller: 'account', action: 'twofa')
  198. flash[:notice] = l('twofa_code_sent')
  199. end
  200. redirect_to account_twofa_confirm_path
  201. end
  202. end
  203. def twofa_confirm
  204. @twofa_view = @twofa.otp_confirm_view_variables
  205. end
  206. def twofa
  207. if @twofa.verify!(params[:twofa_code].to_s)
  208. destroy_twofa_session
  209. handle_active_user(@user)
  210. # allow at most 3 otp entry tries per successfull password entry
  211. # this allows using anti brute force techniques on the password entry to also
  212. # prevent brute force attacks on the one-time password
  213. elsif session[:twofa_tries_counter] > 3
  214. destroy_twofa_session
  215. flash[:error] = l('twofa_too_many_tries')
  216. redirect_to home_url
  217. else
  218. flash[:error] = l('twofa_invalid_code')
  219. redirect_to account_twofa_confirm_path
  220. end
  221. end
  222. private
  223. def prevent_twofa_session_replay
  224. renew_twofa_session(@user)
  225. end
  226. def twofa_setup
  227. # twofa sessions are only valid 2 minutes at a time
  228. twomind = 0.0014 # a little more than 2 minutes in days
  229. @user = Token.find_active_user('twofa_session', session[:twofa_session_token].to_s, twomind)
  230. if @user.blank?
  231. destroy_twofa_session
  232. redirect_to home_url
  233. return
  234. end
  235. # copy back_url, autologin back to params where they are expected
  236. params[:back_url] ||= session[:twofa_back_url]
  237. params[:autologin] ||= session[:twofa_autologin]
  238. # set locale for the twofa user
  239. set_localization(@user)
  240. # set the requesting IP of the twofa user (e.g. for security notifications)
  241. @user.remote_ip = request.remote_ip
  242. @twofa = Redmine::Twofa.for_user(@user)
  243. end
  244. def require_active_twofa
  245. Setting.twofa? ? true : deny_access
  246. end
  247. def setup_twofa_session(user, previous_tries=1)
  248. token = Token.create(user: user, action: 'twofa_session')
  249. session[:twofa_session_token] = token.value
  250. session[:twofa_tries_counter] = previous_tries
  251. session[:twofa_back_url] = params[:back_url]
  252. session[:twofa_autologin] = params[:autologin]
  253. end
  254. # Prevent replay attacks by using each twofa_session_token only for exactly one request
  255. def renew_twofa_session(user)
  256. twofa_tries = session[:twofa_tries_counter].to_i + 1
  257. destroy_twofa_session
  258. setup_twofa_session(user, twofa_tries)
  259. end
  260. def destroy_twofa_session
  261. # make sure tokens can only be used once server-side to prevent replay attacks
  262. Token.find_token('twofa_session', session[:twofa_session_token].to_s).try(:delete)
  263. session[:twofa_session_token] = nil
  264. session[:twofa_tries_counter] = nil
  265. session[:twofa_back_url] = nil
  266. session[:twofa_autologin] = nil
  267. end
  268. def authenticate_user
  269. password_authentication
  270. end
  271. def password_authentication
  272. user = User.try_to_login!(params[:username], params[:password], false)
  273. if user.nil?
  274. invalid_credentials
  275. elsif user.new_record?
  276. onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id})
  277. else
  278. # Valid user
  279. if user.active?
  280. if user.twofa_active?
  281. setup_twofa_session user
  282. twofa = Redmine::Twofa.for_user(user)
  283. if twofa.send_code(controller: 'account', action: 'twofa')
  284. flash[:notice] = l('twofa_code_sent')
  285. end
  286. redirect_to account_twofa_confirm_path
  287. else
  288. handle_active_user(user)
  289. end
  290. else
  291. handle_inactive_user(user)
  292. end
  293. end
  294. end
  295. def handle_active_user(user)
  296. successful_authentication(user)
  297. update_sudo_timestamp! # activate Sudo Mode
  298. end
  299. def successful_authentication(user)
  300. logger.info "Successful authentication for '#{user.login}' from #{request.remote_ip} at #{Time.now.utc}"
  301. # Valid user
  302. self.logged_user = user
  303. # generate a key and set cookie if autologin
  304. if params[:autologin] && Setting.autologin?
  305. set_autologin_cookie(user)
  306. end
  307. call_hook(:controller_account_success_authentication_after, {:user => user})
  308. redirect_back_or_default my_page_path
  309. end
  310. def set_autologin_cookie(user)
  311. token = user.generate_autologin_token
  312. secure = Redmine::Configuration['autologin_cookie_secure']
  313. if secure.nil?
  314. secure = request.ssl?
  315. end
  316. cookie_options = {
  317. :value => token,
  318. :expires => 1.year.from_now,
  319. :path => (Redmine::Configuration['autologin_cookie_path'] || RedmineApp::Application.config.relative_url_root || '/'),
  320. :same_site => :lax,
  321. :secure => secure,
  322. :httponly => true
  323. }
  324. cookies[autologin_cookie_name] = cookie_options
  325. end
  326. # Onthefly creation failed, display the registration form to fill/fix attributes
  327. def onthefly_creation_failed(user, auth_source_options = {})
  328. @user = user
  329. session[:auth_source_registration] = auth_source_options unless auth_source_options.empty?
  330. render :action => 'register'
  331. end
  332. def invalid_credentials
  333. logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}"
  334. flash.now[:error] = l(:notice_account_invalid_credentials)
  335. end
  336. # Register a user for email activation.
  337. #
  338. # Pass a block for behavior when a user fails to save
  339. def register_by_email_activation(user, &block)
  340. token = Token.new(:user => user, :action => "register")
  341. if user.save and token.save
  342. Mailer.deliver_register(user, token)
  343. flash[:notice] = l(:notice_account_register_done, :email => ERB::Util.h(user.mail))
  344. redirect_to signin_path
  345. else
  346. yield if block
  347. end
  348. end
  349. # Automatically register a user
  350. #
  351. # Pass a block for behavior when a user fails to save
  352. def register_automatically(user, &block)
  353. # Automatic activation
  354. user.activate
  355. user.last_login_on = Time.now
  356. if user.save
  357. self.logged_user = user
  358. flash[:notice] = l(:notice_account_activated)
  359. redirect_to my_account_path
  360. else
  361. yield if block
  362. end
  363. end
  364. # Manual activation by the administrator
  365. #
  366. # Pass a block for behavior when a user fails to save
  367. def register_manually_by_administrator(user, &block)
  368. if user.save
  369. # Sends an email to the administrators
  370. Mailer.deliver_account_activation_request(user)
  371. account_pending(user)
  372. else
  373. yield if block
  374. end
  375. end
  376. def handle_inactive_user(user, redirect_path=signin_path)
  377. if user.registered?
  378. account_pending(user, redirect_path)
  379. else
  380. account_locked(user, redirect_path)
  381. end
  382. end
  383. def account_pending(user, redirect_path=signin_path)
  384. if Setting.self_registration == '1'
  385. flash[:error] = l(:notice_account_not_activated_yet, :url => activation_email_path)
  386. session[:registered_user_id] = user.id
  387. else
  388. flash[:error] = l(:notice_account_pending)
  389. end
  390. redirect_to redirect_path
  391. end
  392. def account_locked(user, redirect_path=signin_path)
  393. flash[:error] = l(:notice_account_locked)
  394. redirect_to redirect_path
  395. end
  396. end