Changeset 470

Timestamp:

10/19/06 04:38:25 (2 years ago)

Author:

hlame

Message:

Adding functionality to the password expiry, such that (through use of another before_filter) it will force the user to change their password if it is expired before allowing them access to any other controller/action. The old version would only redirect during login, so you could just click away and ignore it, making the whole expired_password thing a bit blah. This version attempts to be smart enough to not force you to change your password *during* a session, only at the start (it checks the expiry date of the password against the logged_in_at date of the user object... hardly an ideal solution, but we have no other mechanism at the model level to know if a user is actually currently logged in or not.

Files:

• login_engine/trunk/app/controllers/user_controller.rb (modified) (2 diffs)
• login_engine/trunk/lib/login_engine.rb (modified) (1 diff)
• login_engine/trunk/lib/login_engine/authenticated_system.rb (modified) (2 diffs)
• login_engine/trunk/lib/login_engine/authenticated_user.rb (modified) (1 diff)
• login_engine/trunk/test/functional/user_controller_test.rb (modified) (1 diff)

login_engine/trunk/app/controllers/user_controller.rb

@@ -29 +29 @@
-      flash[:notice] = 'Login successful'
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    else
-      @login = params[:user][:login]
@@ -104 +97 @@
-      # since sometimes we're changing the password from within another action/template...
-      #redirect_to :action => params[:back_to] if params[:back_to]
-
+
+
-      # after we have changed the password, do we really want to end up back in the same place?
-      # Why not redirect to the stored location or default?

login_engine/trunk/lib/login_engine.rb

@@ -60 +60 @@
-  # password expiry time in days
-  # 0 means it will not expire
+  # non-zero requires use of the 
+  # detect_expired_password filter in your
+  # controllers
-  config :password_expiry, 0
-

login_engine/trunk/lib/login_engine/authenticated_system.rb

@@ -60 +60 @@
-    end
-
+    # filter for detecting expired passwords. add
+    #
+    #   before_filter :detect_expired_password
+    #
+    # to application_controller if you want to force password changes when
+    # someone logs in and their password has expired.
+    # Only really makes sense if you have the password_expiry config
+    # set to non-zero value.
+    def detect_expired_password
+      if user?
+        u = session[:user].reload
+        # if password has expired, the redirect to login
+        # but only if it expired before the user logged in, forcing unavoidable password changes
+        # during a session would be cruel.  Once you are in, you are in.
+        if !u.passwords.empty? && u.password_expired_during_current_login_session?
+          if request.get?
+            store_location
+          end
+          flash.now[:warning] = 'Password expired. You must change your password before continuing'
+          redirect_to :controller => 'user', :action => 'change_password'
+          # Return false to halt the filter chain
+          return false
+        end
+      end
+      return true
+    end
+
-    # overwrite if you want to have special behavior in case the user is not authorized
-    # to access the current operation. 
@@ -93 +120 @@
-    end
-
+    def redirect_to_stored_or_back_or_default(default=default_home)
+      if !session['return-to'].nil?
+        redirect_to_url session['return-to']
+        session['return-to'] = nil
+      elsif !request.env["HTTP_REFERER"].nil?
+        redirect_to(request.env["HTTP_REFERER"]) # same as redirect_to :back
+      else
+        redirect_to default
+      end
+    end
+    
-    def default_home
-      case LoginEngine.config(:default_home) 

login_engine/trunk/lib/login_engine/authenticated_user.rb

@@ -145 +145 @@
-    end
-    
+    # TODO - this only really makes sense if we know if a given user is logged in
+    # which we don't really...
+    def password_expired_during_current_login_session?
+      return (password_expired? and self.passwords.first.created_at < self.logged_in_at)
+    end
+  
-    protected
-

login_engine/trunk/test/functional/user_controller_test.rb

@@ -551 +551 @@
-    assert session[:user].password_expired?
-
-
+
+
-    assert_redirect_url(@controller.url_for(:action => "change_password"))
-  end