ensl/ensl.org
0
0
Fork 0
mirror of https://github.com/ENSL/ensl.org.git synced 2025-01-30 21:20:43 +00:00
Code Issues Projects Releases Packages Wiki Activity

FIX

Browse source 
in User#authenticate:
* make search by username case sensitive as in prod there already are
  usernames diffing only in case
* use guard clause instead of nesting
This commit is contained in:
Absurdon 2020-04-13 15:34:12 +00:00
parent 88a6c697cc
commit 6f05d47a8d
1 changed files with 31 additions and 31 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

58
app/models/user.rb
View file

@ -449,38 +449,38 @@ class User < ActiveRecord::Base
end end
def self.authenticate(login) def self.authenticate(login)
if (user = where("LOWER(username) = LOWER(?)", login[:username]).first) user = where('username = ?', login[:username]).first
begin return nil unless user
case user.password_hash
when User::PASSWORD_SCRYPT begin
# FIXME: If exception occurs here, user cannot log in case user.password_hash
pass = SCrypt::Password.new(user.password) when User::PASSWORD_SCRYPT
return user if pass == login[:password] # FIXME: If exception occurs here, user cannot log in
when User::PASSWORD_MD5_SCRYPT pass = SCrypt::Password.new(user.password)
pass = SCrypt::Password.new(user.password) return user if pass == login[:password]
# Match to Scrypt(Md5(password)) when User::PASSWORD_MD5_SCRYPT
if pass == Digest::MD5.hexdigest(login[:password]) pass = SCrypt::Password.new(user.password)
user.raw_password = login[:password] # Match to Scrypt(Md5(password))
user.update_password if pass == Digest::MD5.hexdigest(login[:password])
user.save! user.raw_password = login[:password]
return user user.update_password
end user.save!
# when User::PASSWORD_MD5 return user
else end
if user.password == Digest::MD5.hexdigest(login[:password]) # when User::PASSWORD_MD5
user.raw_password = login[:password] else
user.update_password if user.password == Digest::MD5.hexdigest(login[:password])
user.save! user.raw_password = login[:password]
return user user.update_password
end user.save!
return user
end end
# TODO: controller needs to handle this
#rescue Exception => ex
# user.errors.add(:password, "%s (%s)" % [I18n.t(:password_corrupt), ex.class.to_s])
# return nil
end end
# TODO: controller needs to handle this
#rescue Exception => ex
# user.errors.add(:password, "%s (%s)" % [I18n.t(:password_corrupt), ex.class.to_s])
# return nil
end end
return nil
end end
def self.get(id) def self.get(id)