0
module AuthenticatedSystem
0
+ (@current_user ||= session[:user] ? User.find_by_id(session[:user]) : :false).is_a?(User)
0
- # accesses the current user from the session.
0
- # overwrite this to set how the current user is retrieved from the session.
0
- # To store just the whole user model in the session:
0
- @current_user ||= session[:user] ? User.find_by_id(session[:user]) : nil
0
- @current_user ||= cookies[:user] ? User.find(:first, :conditions => ['activation_code = ? and activated_at is null', cookies[:user]]) : nil
0
+ @current_user if logged_in?
0
+ def current_user=(new_user)
0
+ session[:user] = (new_user.nil? || new_user.is_a?(Symbol)) ? nil : new_user.id
0
+ @current_user = new_user
0
+ username, passwd = get_auth_data
0
+ self.current_user ||= User.authenticate(username, passwd) || :false if username && passwd
0
+ logged_in? && authorized? ? true : access_denied
0
- # store the given user in the session. overwrite this to set how
0
- # users are stored in the session. To store the whole user model, do:
0
- # def current_user=(new_user)
0
- # session[:user] = new_user
0
- def current_user=(new_user)
0
- session[:user] = new_user.nil? ? nil : new_user.id
0
- :value => new_user ? new_user.make_activation_code : '',
0
- :expires => new_user ? 2.weeks.from_now : 2.weeks.ago
0
- } unless new_user.nil?
0
- @current_user = new_user
0
+ respond_to do |accepts|
0
+ redirect_to :controller=>"/account", :action =>"login"
0
+ accepts.xml { access_denied_with_basic_auth }
0
- # overwrite this if you want to restrict access to only a few actions
0
- # or if you want to check if the user has the correct rights
0
- # # only allow nonbobs
0
- # def authorize?(user)
0
+ # store current uri in the session.
0
+ # we can return to this location by calling return_location
0
+ session[:return_to] = request.request_uri
0
+ # move to the last store_location call or to the passed default one
0
+ def redirect_back_or_default(default)
0
+ session[:return_to] ? redirect_to_url(session[:return_to]) : redirect_to(default)
0
+ session[:return_to] = nil
0
+ def basic_auth_required
0
+ unless session[:user] = User.authenticate(*get_auth_data)
0
+ access_denied_with_basic_auth
0
+ # adds ActionView helper methods
0
+ def self.included(base)
0
+ base.send :helper_method, :current_user, :logged_in?
0
- # overwrite this method if you only want to protect certain actions of the controller
0
- # # don't protect the login and the about method
0
- # def protect?(action)
0
- # if ['action', 'about'].include?(action)
0
- # To require logins, use:
0
- # before_filter :login_required # restrict all actions
0
- # before_filter :login_required, :only => [:edit, :update] # only restrict these actions
0
- # To skip this in a subclassed controller:
0
- # skip_before_filter :login_required
0
- # skip login check if action is not protected
0
- return true unless protect?(action_name)
0
- # check if user is logged in and authorized
0
- return true if logged_in? and authorized?(current_user)
0
- # store current location so that we can
0
- # come back after the user logged in
0
- # call overwriteable reaction to unauthorized access
0
- access_denied and return false
0
- # overwrite if you want to have special behavior in case the user is not authorized
0
- # to access the current operation.
0
- # the default action is to redirect to the login screen
0
- # a popup window might just close itself for instance
0
- redirect_to :controller=>"/account", :action =>"login"
0
- # store current uri in the session.
0
- # we can return to this location by calling return_location
0
- session[:return_to] = request.request_uri
0
- # move to the last store_location call or to the passed default one
0
- def redirect_back_or_default(default)
0
- session[:return_to] ? redirect_to_url(session[:return_to]) : redirect_to(default)
0
- session[:return_to] = nil
0
- def basic_auth_required(realm='Web Password', error_message="Could't authenticate you")
0
- username, passwd = get_auth_data
0
- unless session[:user] = User.authenticate(username, passwd)
0
- # the user does not exist or the password was wrong
0
- headers["Status"] = "Unauthorized"
0
- headers["WWW-Authenticate"] = "Basic realm=\"#{realm}\""
0
- render :text => error_message, :status => '401 Unauthorized'
0
- # adds ActionView helper methods
0
- def self.included(base)
0
- base.send :helper_method, :current_user, :logged_in?
0
+ # When called with before_filter :login_from_cookie will check for an :auth_token
0
+ # cookie and log the user back in if apropriate
0
+ return unless cookies[:auth_token] && !logged_in?
0
+ user = User.find_by_remember_token(cookies[:auth_token])
0
+ if user && user.remember_token?
0
+ self.current_user = user
0
+ cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at }
0
+ flash[:notice] = "Logged in successfully"
0
- # gets BASIC auth info
0
- # extract authorisation credentials
0
- if request.env.has_key? 'X-HTTP_AUTHORIZATION'
0
- # try to get it where mod_rewrite might have put it
0
- authdata = request.env['X-HTTP_AUTHORIZATION'].to_s.split
0
- elsif request.env.has_key? 'HTTP_AUTHORIZATION'
0
- # this is the regular location
0
- authdata = request.env['HTTP_AUTHORIZATION'].to_s.split
0
- # at the moment we only support basic authentication
0
- if authdata and authdata[0] == 'Basic'
0
- user, pass = Base64.decode64(authdata[1]).split(':')[0..1]
0
+ def access_denied_with_basic_auth
0
+ headers["Status"] = "Unauthorized"
0
+ headers["WWW-Authenticate"] = %(Basic realm="Web Password")
0
+ render :text => "Could't authenticate you", :status => '401 Unauthorized'
0
+ # gets BASIC auth info
0
+ # extract authorisation credentials
0
+ if request.env.has_key? 'X-HTTP_AUTHORIZATION'
0
+ # try to get it where mod_rewrite might have put it
0
+ authdata = request.env['X-HTTP_AUTHORIZATION'].to_s.split
0
+ elsif request.env.has_key? 'HTTP_AUTHORIZATION'
0
+ # this is the regular location
0
+ authdata = request.env['HTTP_AUTHORIZATION'].to_s.split
0
+ # at the moment we only support basic authentication
0
+ if authdata && authdata[0] == 'Basic'
0
+ user, pass = Base64.decode64(authdata[1]).split(':')[0..1]
0
\ No newline at end of file
) is private.
Comments
No one has commented yet.