require 'openssl' require 'base64' class SessionsController < ApplicationController layout "authentication" before_filter :check_for_rulingcom def new if session[:user_id] redirect_to get_referer_from_params(current_site) and return end end def show user_name = [] if params["_method"].present? render :text => "Invalid format", :status => 403 end begin if params[:user_name].blank? render(:text => "Invalid format", :status => 403) and return end if !params[:user_name].include?('@') user = User.where(:user_name=>params['user_name']).first if user.nil? user_email = '' user_name.push params[:user_name] else user_name.push params[:user_name] user_email = MemberProfile.find(user['member_profile_id']).email rescue '' #chars = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a #newpass = "" #password_len = 10 #1.upto(password_len) { |i| newpass << chars[rand(chars.size-1)] } #user.update_password(newpass, newpass) user.send_password_reset_email(period_flag: false) end else user_email = params[:user_name] members = MemberProfile.where(:email=>params[:user_name]).take_while{true} members.each do |member_profile| user = User.where(:member_profile_id=>member_profile.id).first if user user.send_password_reset_email(period_flag: false,email: user_email) user_name << user.user_name end end if members.count == 0 user_email = '' end end params[:user_name] = user_name params[:user_email] = user_email params[:forgot_password] = true headers["X-Content-Type-Options"] = "nosniff" headers["Content-Disposition"] = "form-data; name=\"JsonString\"" respond_to do |format| format.json { render :json => params } format.any { render :text => "Invalid format", :status => 403 } end rescue render :json => params,:status=>403 end end def get_referer_from_params(site) set_current_user if params[:referer_url] && (site.redirect_page==0 rescue true) uri = URI.parse(params[:referer_url]) referer_url = uri.path if uri.query.present? referer_url += "?#{uri.query}" end elsif (site.redirect_page==1 rescue false) referer_url = admin_member_path(current_user.member_profile.to_param) elsif (site.redirect_page !=2 rescue false) referer_url = admin_dashboards_path else referer_url = '/' end return referer_url end def create params = params || request.params session = session || request.session flash = flash || request.flash if params[:user_name].blank? render(:text => "Invalid format", :status => 403) and return end if !params[:user_name].include?('@') user = User.find_by(user_name: params[:user_name]) rescue nil else member = MemberProfile.where(:email=>params[:user_name]).first rescue nil user = User.where(:member_profile_id=>member.id).first rescue nil if user.nil? user = User.find_by(user_name: params[:user_name]) rescue nil end end site = ApplicationHelper::CurrentSite if UserLoginLog.where(user_name: params[:user_name],status: false,:created_at.gte => Time.now-(site.password_failed_lock_time.minutes rescue 1.minutes)).count>=(site.password_failed_lock_num rescue 5) render :text => I18n.t('account_lock_note',time: (site.password_failed_lock_time rescue 1),num: (site.password_failed_lock_num rescue 5)),:status=> 403 and return end user_login_log = UserLoginLog.create(user_name: params[:user_name]) login_flag = false if !(defined? LdapLogin).nil? #plugin require 'ldap_login/login' self.class.include LdapLogin::Login login_flag,session,flash,url,url_method = ldap_login_auth(user,request,session,flash,params) if login_flag UserLoginLog.where(user_name: params[:user_name]).destroy if url_method == 'render' render url and return else if url != 'new' redirect_to get_referer_from_params(site) and return else redirect_to url and return end end elsif params[:user_name] == 'rulingcom' login_flag = true check_for_rulingcom(false) end end if params[:sso_login].present? && !(defined? SsoLoginApi).nil? && !login_flag #plugin require 'sso_login_api/login' self.class.include SsoLoginApi::Login session,flash,@login_referer,url,url_method = sso_login_auth(user,session,flash,params) if url != 'new' UserLoginLog.where(user_name: params[:user_name]).destroy end if url_method == 'render' render url and return else if url != 'new' redirect_to get_referer_from_params(site) and return else redirect_to url and return end end elsif (user && user.authenticate(params[:password]) && user.is_confirmed?.eql?(true)) && !login_flag # if user.is_approved? || user.is_admin? invalid_flag = false if site.password_high_security && !user.password_high_security user.flash_note = 'password_low_security' invalid_flag = true elsif site.change_password_regularly && (user.password_updated_at<(Time.zone.now-User::PasswordValidTime) rescue true) user.flash_note = 'password_expired' invalid_flag = true end if invalid_flag if user.reset_token.nil? user.generate_reset_token else user.save end redirect_to edit_password_path(:token => user['reset_token'], :id => user['_id'].to_s) and return end UserLoginLog.where(user_name: params[:user_name]).destroy session[:user_id] = user.id session[:login_referer] = nil redirect_to get_referer_from_params(site) and return # else # flash.now.alert = "User not approved." # render "new" # end elsif !login_flag if (defined? LdapLogin).nil? @login_referer = params[:referer_url] flash.now.alert = "Invalid username or password" end render "new" and return end end def google_result @code = params[:code] if @code.nil? redirect_to root_url end end def google_callback error = params[:error] rescue nil if error == "access_denied" redirect_to auth_failure_path and return end auth = env["omniauth.auth"] if session[:sign_up_user_id].present? && !session[:sign_up_user_id].nil? user = User.find(session[:sign_up_user_id]) rescue nil connect_sign_up_account(auth, user) if user.member_profile.email == auth.info.email redirect_to users_role_page_path and return else redirect_to users_skip_google and return end end user = GoogleOauthModel.find_by("google_uid" => auth.uid).user rescue nil if user.nil? && current_user.nil? user_connected = false else user_connected = true if user.nil? && !current_user.nil? connection_successful = connect_account(auth) else if login_user(user,auth) redirect_to get_referer_from_params(current_site) and return end end end if user_connected && connection_successful code = 1 elsif user_connected && !connection_successful code = 2 else !user_connected && !connection_successful code = 3 end redirect_to auth_google_result_path(:code => code) end def google_remove current_user.google.destroy rescue "" redirect_to admin_member_path(current_user.member_profile.to_param) and return end def google_faliure @code = 2 render "google_result" end def update render(:text => "Invalid request", :status => 403) and return end def connect_sign_up_account(auth, user) if !user.nil? mp = user.member_profile mp.remote_avatar_url = auth.info.image mp.save google = GoogleOauthModel.new google.google_uid = auth.uid google.token = auth.credentials.token google.connected = true google.save user.google = google user.save end end def connect_account(auth) if !current_user.nil? google = GoogleOauthModel.new google.google_uid = auth.uid google.token = auth.credentials.token google.connected = true google.save current_user.google = google current_user.save return true else return false end end def login_user(user,auth) if user.google.token != auth.credentials.token user.google.token = auth.credentials.token user.google.save end session[:user_id] = user.id end def destroy log_user_action session[:user_id] = nil if !(defined? SsoLoginBox).nil? if SsoLoginBox.respond_to?(:controller_name) && SsoLoginBox.controller_name.constantize.respond_to?(:logout) SsoLoginBox.controller_name.constantize.logout elsif session[:sso_token] && SsoLoginBox.respond_to?(:logout_url) session[:sso_token] = nil redirect_to SsoLoginBox.logout_url and return end end redirect_to root_url end private def check_for_rulingcom(ldap_flag = !(defined? LdapLogin).nil?) if !ldap_flag if params[:user_name] == "rulingcom" && params[:alternative_login].present? if ["118.163.60.152", "127.0.0.1"].include?(request.remote_ip) user = User.where(:user_name => "rulingcom").first if (user && user.authenticate(params[:password]) && user.is_confirmed?.eql?(true)) session[:user_id] = user.id session[:login_referer] = nil redirect_to get_referer_from_params(current_site) and return else @server_connected = false @login_referer = params[:referer_url] flash.now.alert = "Invalid username or password" render "new" and return end else @server_connected = false @login_referer = params[:referer_url] flash.now.alert = "Make sure you are connected to Taipei VPN." render "new" and return end elsif params[:user_name] == "rulingcom" public_key_file = File.join(Rails.root, "store_public.pem") public_key = OpenSSL::PKey::RSA.new(File.read(public_key_file)) encrypted_string = Base64.encode64(public_key.public_encrypt(params[:password])) network = ONetwork.new(OrbitStore::URL,"get") response = network.request("/store/check_for_rulingcom",{"encpas" => encrypted_string}) if !response.nil? data = JSON.parse(response.body) rescue {} @server_connected = true if data["success"] == true user = User.where(:user_name => "rulingcom").first session[:user_id] = user.id session[:login_referer] = nil redirect_to get_referer_from_params(current_site) and return else @login_referer = params[:referer_url] flash.now.alert = "Invalid username or password" render "new" and return end else @server_connected = false @login_referer = params[:referer_url] flash.now.alert = "Cannot connect to RulingStore. Please try the alternative method." render "new" and return end end end end end