Module: Sinatra::SessionAuth

Defined in:
lib/sinatra/sessionauth.rb

Defined Under Namespace

Modules: Helpers

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.registered(app) ⇒ Object 



114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
 
# File 'lib/sinatra/sessionauth.rb', line 114

def self.registered(app)
  app.helpers SessionAuth::Helpers
  # todo: create a list of uri not evaluated for authentification
  app.before do
    excluded_path=[/file\/\d+\/download_external/,
                    /forgotten_password/,
                   /reset_link/
    ]
    external_path_match= excluded_path.any? { |regex| request.path_info =~ regex }
    #$log.info(request.path_info=~external_path)
    #external_path=nil
    if session['user'].nil? and not external_path_match
      request.path_info='/login'
    end
  end


  app.get '/login' do
    haml :login_2, :layout=>:layout_empty, :escape_html=>false
  end

  app.post '/login' do
    if authorize(params['user'].strip, params['password'].strip)
      add_message ::I18n.t(:Successful_authentification)
      #log.info( ::I18n::t("sinatra_auth.sucessful_auth_for_user", user:params['user']))
      redirect(url("/"))
    else
      add_message ::I18n::t("sinatra_auth.error_on_auth"), :error
      redirect(url("/login"))
    end
  end


  app.get '/logout' do
    logout
    redirect(url('/login'))
  end

  app.get '/reset_link' do
    @t=params['t']
    if @t
      @user=User[token_password: @t]
      if @user and (Time.now - @user.token_datetime)<60*30
        haml :reset_link, :layout=>:layout_empty, :escape_html=>false
      else
        redirect url("/login")  
      end
    else
      redirect url("/login")
    end

  end

  app.post '/reset_link' do

    @user=User[id: params['user_id']]
    raise Buhos::NoUserIdError, params['user_id'] unless @user
    if @user[:token_password]!=params['t']
      add_message(::I18n::t("sinatra_auth.token_error"), :info)
      SecurityEvent.add_user_event("token error for password reset",  request.ip,request.path_info,
                                   "password token", @user[:id] )
      redirect url("/login")
    else
      password_1=params['password']
      password_2=params['repeat_password']
      if password_1!=password_2
        add_message(::I18n::t("password.not_equal_password"), :error)
        redirect back
      else
        @user.update(token_password:nil,token_datetime: nil)
        @user.change_password(password_1)

        SecurityEvent.add_user_event("password reset by reset link",  request.ip,request.path_info,
                                     "password changed for user using reset link", @user[:id] )
        add_message(::I18n::t("sinatra_auth.password_update_relogin"))
        redirect url("/login")
      end

    end

  end


  app.get '/forgotten_password' do
    haml :forgotten_password, :layout=>:layout_empty, :escape_html=>false
  end

  app.post '/forgotten_password' do
    email=params['email']
    if not email.include? "@"
      add_message(::I18n::t("sinatra_auth.not_an_email"), :error)
      redirect url("/forgotten_password")
    end

    user=User.where(Sequel.lit('email=? and email IS NOT NULL', email)).first
    if user
      previous_datetime=user.token_datetime
      if previous_datetime
        #prev_dat=Sequel.string_to_datetime(previous_datetime)
        if(Time.now - previous_datetime)<60
          add_message(::I18n::t("sinatra_auth.wait_for_next_reset"), :error)
          redirect url("/login")
        end
      end


      token=Digest::SHA1.hexdigest(DateTime.to_s+user.password+user.name)
      user.update(token_password:token, token_datetime:DateTime.now)
      url="#{request.base_url}/reset_link?t=#{token}"
      subject=::I18n::t("sinatra_auth.password_reset_subject")
      message=::I18n::t("sinatra_auth.password_reset_message", url:url)
      oe=OutgoingEmail.new()
      oe.send_email(email,subject,message)

      SecurityEvent.add_user_event("forgotten_password",  request.ip,request.path_info,
                                   "password request for email #{email}", user[:id] )

    else
      SecurityEvent.add_nonuser_event("forgotten_password_bad_user",  request.ip,request.path_info,
                                   "password request for email #{email}", SecurityEvent::SECURITY_MEDIUM )
    end
    add_message(::I18n::t("sinatra_auth.if_email_exists_forgotten_sent"), :info)
    redirect url("/login")

  end



end

Instance Method Details

#GET '/forgotten_password' ⇒ Object 



197
198
199
 
# File 'lib/sinatra/sessionauth.rb', line 197

app.get '/forgotten_password' do
  haml :forgotten_password, :layout=>:layout_empty, :escape_html=>false
end

#GET '/login' ⇒ Object 



131
132
133
 
# File 'lib/sinatra/sessionauth.rb', line 131

app.get '/login' do
  haml :login_2, :layout=>:layout_empty, :escape_html=>false
end

#GET '/logout' ⇒ Object 



147
148
149
150
 
# File 'lib/sinatra/sessionauth.rb', line 147

app.get '/logout' do
  logout
  redirect(url('/login'))
end

#GET '/reset_link' ⇒ Object 



152
153
154
155
156
157
158
159
160
161
162
163
164
165
 
# File 'lib/sinatra/sessionauth.rb', line 152

app.get '/reset_link' do
  @t=params['t']
  if @t
    @user=User[token_password: @t]
    if @user and (Time.now - @user.token_datetime)<60*30
      haml :reset_link, :layout=>:layout_empty, :escape_html=>false
    else
      redirect url("/login")  
    end
  else
    redirect url("/login")
  end

end

#POST '/forgotten_password' ⇒ Object 



201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
 
# File 'lib/sinatra/sessionauth.rb', line 201

app.post '/forgotten_password' do
  email=params['email']
  if not email.include? "@"
    add_message(::I18n::t("sinatra_auth.not_an_email"), :error)
    redirect url("/forgotten_password")
  end

  user=User.where(Sequel.lit('email=? and email IS NOT NULL', email)).first
  if user
    previous_datetime=user.token_datetime
    if previous_datetime
      #prev_dat=Sequel.string_to_datetime(previous_datetime)
      if(Time.now - previous_datetime)<60
        add_message(::I18n::t("sinatra_auth.wait_for_next_reset"), :error)
        redirect url("/login")
      end
    end


    token=Digest::SHA1.hexdigest(DateTime.to_s+user.password+user.name)
    user.update(token_password:token, token_datetime:DateTime.now)
    url="#{request.base_url}/reset_link?t=#{token}"
    subject=::I18n::t("sinatra_auth.password_reset_subject")
    message=::I18n::t("sinatra_auth.password_reset_message", url:url)
    oe=OutgoingEmail.new()
    oe.send_email(email,subject,message)

    SecurityEvent.add_user_event("forgotten_password",  request.ip,request.path_info,
                                 "password request for email #{email}", user[:id] )

  else
    SecurityEvent.add_nonuser_event("forgotten_password_bad_user",  request.ip,request.path_info,
                                 "password request for email #{email}", SecurityEvent::SECURITY_MEDIUM )
  end
  add_message(::I18n::t("sinatra_auth.if_email_exists_forgotten_sent"), :info)
  redirect url("/login")

end

#POST '/login' ⇒ Object 



135
136
137
138
139
140
141
142
143
144
 
# File 'lib/sinatra/sessionauth.rb', line 135

app.post '/login' do
  if authorize(params['user'].strip, params['password'].strip)
    add_message ::I18n.t(:Successful_authentification)
    #log.info( ::I18n::t("sinatra_auth.sucessful_auth_for_user", user:params['user']))
    redirect(url("/"))
  else
    add_message ::I18n::t("sinatra_auth.error_on_auth"), :error
    redirect(url("/login"))
  end
end

#POST '/reset_link' ⇒ Object 



167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
 
# File 'lib/sinatra/sessionauth.rb', line 167

app.post '/reset_link' do

  @user=User[id: params['user_id']]
  raise Buhos::NoUserIdError, params['user_id'] unless @user
  if @user[:token_password]!=params['t']
    add_message(::I18n::t("sinatra_auth.token_error"), :info)
    SecurityEvent.add_user_event("token error for password reset",  request.ip,request.path_info,
                                 "password token", @user[:id] )
    redirect url("/login")
  else
    password_1=params['password']
    password_2=params['repeat_password']
    if password_1!=password_2
      add_message(::I18n::t("password.not_equal_password"), :error)
      redirect back
    else
      @user.update(token_password:nil,token_datetime: nil)
      @user.change_password(password_1)

      SecurityEvent.add_user_event("password reset by reset link",  request.ip,request.path_info,
                                   "password changed for user using reset link", @user[:id] )
      add_message(::I18n::t("sinatra_auth.password_update_relogin"))
      redirect url("/login")
    end

  end

end