sessions_controller.rb 7.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329
  1. # Copyright (C) 2012-2016 Zammad Foundation, http://zammad-foundation.org/
  2. class SessionsController < ApplicationController
  3. prepend_before_action :authentication_check, only: [:switch_to_user, :list, :delete]
  4. skip_before_action :verify_csrf_token, only: [:create, :show, :destroy, :create_omniauth, :create_sso]
  5. # "Create" a login, aka "log the user in"
  6. def create
  7. # in case, remove switched_from_user_id
  8. session[:switched_from_user_id] = nil
  9. # authenticate user
  10. user = User.authenticate(params[:username], params[:password])
  11. # check maintenance mode
  12. check_maintenance(user)
  13. # auth failed
  14. raise Exceptions::NotAuthorized, 'Wrong Username or Password combination.' if !user
  15. # remember me - set session cookie to expire later
  16. expire_after = nil
  17. if params[:remember_me]
  18. expire_after = 1.year
  19. end
  20. request.env['rack.session.options'][:expire_after] = expire_after
  21. # set session user
  22. current_user_set(user)
  23. # log device
  24. return if !user_device_log(user, 'session')
  25. # log new session
  26. user.activity_stream_log('session started', user.id, true)
  27. # add session user assets
  28. assets = {}
  29. assets = user.assets(assets)
  30. # auto population of default collections
  31. collections, assets = SessionHelper.default_collections(user, assets)
  32. # get models
  33. models = SessionHelper.models(user)
  34. # sessions created via this
  35. # controller are persistent
  36. session[:persistent] = true
  37. # return new session data
  38. render status: :created,
  39. json: {
  40. session: user,
  41. config: config_frontend,
  42. models: models,
  43. collections: collections,
  44. assets: assets,
  45. }
  46. end
  47. def show
  48. user_id = nil
  49. # no valid sessions
  50. if session[:user_id]
  51. user_id = session[:user_id]
  52. end
  53. if !user_id
  54. # get models
  55. models = SessionHelper.models()
  56. render json: {
  57. error: 'no valid session',
  58. config: config_frontend,
  59. models: models,
  60. collections: {
  61. Locale.to_app_model => Locale.where(active: true)
  62. },
  63. }
  64. return
  65. end
  66. # Save the user ID in the session so it can be used in
  67. # subsequent requests
  68. user = User.find(user_id)
  69. # log device
  70. return if !user_device_log(user, 'session')
  71. # add session user assets
  72. assets = {}
  73. assets = user.assets(assets)
  74. # auto population of default collections
  75. collections, assets = SessionHelper.default_collections(user, assets)
  76. # get models
  77. models = SessionHelper.models(user)
  78. # return current session
  79. render json: {
  80. session: user,
  81. config: config_frontend,
  82. models: models,
  83. collections: collections,
  84. assets: assets,
  85. }
  86. end
  87. # "Delete" a login, aka "log the user out"
  88. def destroy
  89. # Remove the user id from the session
  90. @_current_user = nil
  91. # reset session
  92. request.env['rack.session.options'][:expire_after] = nil
  93. session.clear
  94. render json: {}
  95. end
  96. def create_omniauth
  97. # in case, remove switched_from_user_id
  98. session[:switched_from_user_id] = nil
  99. auth = request.env['omniauth.auth']
  100. if !auth
  101. logger.info('AUTH IS NULL, SERVICE NOT LINKED TO ACCOUNT')
  102. # redirect to app
  103. redirect_to '/'
  104. end
  105. # Create a new user or add an auth to existing user, depending on
  106. # whether there is already a user signed in.
  107. authorization = Authorization.find_from_hash(auth)
  108. if !authorization
  109. authorization = Authorization.create_from_hash(auth, current_user)
  110. end
  111. # check maintenance mode
  112. if check_maintenance_only(authorization.user)
  113. redirect_to '/#'
  114. return
  115. end
  116. # set current session user
  117. current_user_set(authorization.user)
  118. # log new session
  119. authorization.user.activity_stream_log('session started', authorization.user.id, true)
  120. # remember last login date
  121. authorization.user.update_last_login
  122. # redirect to app
  123. redirect_to '/'
  124. end
  125. def create_sso
  126. # in case, remove switched_from_user_id
  127. session[:switched_from_user_id] = nil
  128. user = User.sso(params)
  129. # Log the authorizing user in.
  130. if user
  131. # check maintenance mode
  132. if check_maintenance_only(user)
  133. redirect_to '/#'
  134. return
  135. end
  136. # set current session user
  137. current_user_set(user)
  138. # log new session
  139. user.activity_stream_log('session started', user.id, true)
  140. # remember last login date
  141. user.update_last_login
  142. end
  143. # redirect to app
  144. redirect_to '/#'
  145. end
  146. # "switch" to user
  147. def switch_to_user
  148. permission_check(['admin.session', 'admin.user'])
  149. # check user
  150. if !params[:id]
  151. render(
  152. json: { message: 'no user given' },
  153. status: :not_found
  154. )
  155. return false
  156. end
  157. user = User.find(params[:id])
  158. if !user
  159. render(
  160. json: {},
  161. status: :not_found
  162. )
  163. return false
  164. end
  165. # remember old user
  166. session[:switched_from_user_id] = current_user.id
  167. # log new session
  168. user.activity_stream_log('switch to', current_user.id, true)
  169. # set session user
  170. current_user_set(user)
  171. render(
  172. json: {
  173. success: true,
  174. location: '',
  175. },
  176. )
  177. end
  178. # "switch" back to user
  179. def switch_back_to_user
  180. # check if it's a swich back
  181. if !session[:switched_from_user_id]
  182. response_access_deny
  183. return false
  184. end
  185. user = User.lookup(id: session[:switched_from_user_id])
  186. if !user
  187. render(
  188. json: {},
  189. status: :not_found
  190. )
  191. return false
  192. end
  193. # rememeber current user
  194. current_session_user = current_user
  195. # remove switched_from_user_id
  196. session[:switched_from_user_id] = nil
  197. # set old session user again
  198. current_user_set(user)
  199. # log end session
  200. current_session_user.activity_stream_log('ended switch to', user.id, true)
  201. render(
  202. json: {
  203. success: true,
  204. location: '',
  205. },
  206. )
  207. end
  208. def available
  209. render json: {
  210. app_version: AppVersion.get
  211. }
  212. end
  213. def list
  214. permission_check('admin.session')
  215. assets = {}
  216. sessions_clean = []
  217. SessionHelper.list.each do |session|
  218. next if session.data['user_id'].blank?
  219. sessions_clean.push session
  220. next if session.data['user_id']
  221. user = User.lookup(id: session.data['user_id'])
  222. next if !user
  223. assets = user.assets(assets)
  224. end
  225. render json: {
  226. sessions: sessions_clean,
  227. assets: assets,
  228. }
  229. end
  230. def delete
  231. permission_check('admin.session')
  232. SessionHelper.destroy(params[:id])
  233. render json: {}
  234. end
  235. private
  236. def config_frontend
  237. # config
  238. config = {}
  239. Setting.select('name, preferences').where(frontend: true).each do |setting|
  240. next if setting.preferences[:authentication] == true && !current_user
  241. value = Setting.get(setting.name)
  242. next if !current_user && (value == false || value.nil?)
  243. config[setting.name] = value
  244. end
  245. # remember if we can to swich back to user
  246. if session[:switched_from_user_id]
  247. config['switch_back_to_possible'] = true
  248. end
  249. # remember session_id for websocket logon
  250. if current_user
  251. config['session_id'] = session.id
  252. end
  253. config
  254. end
  255. end