barkest_core 1.5.3.0

data/app/controllers/access_groups_controller.rb

@@ -0,0 +1,74 @@
+##
+# This is the controller that allows managing the access groups used for authorizing access to resources.
+#
+class AccessGroupsController < ApplicationController
+  before_action :validate_user
+  before_action :set_access_group, only: [:show, :edit, :update, :destroy]
+
+  ##
+  # GET /access_groups
+  def index
+    @access_groups = AccessGroup.all.sorted
+  end
+
+  ##
+  # GET /access_groups/1
+  def show
+  end
+
+  ##
+  # GET /access_groups/new
+  def new
+    @access_group = AccessGroup.new
+  end
+
+  ##
+  # GET /access_groups/1/edit
+  def edit
+  end
+
+  ##
+  # POST /access_groups
+  def create
+    @access_group = AccessGroup.new(access_group_params)
+
+    if @access_group.save
+      redirect_to access_groups_url, notice: 'Access group was successfully created.'
+    else
+      render :new
+    end
+  end
+
+  ##
+  # PATCH/PUT /access_groups/1
+  def update
+    if @access_group.update(access_group_params)
+      redirect_to access_groups_url, notice: 'Access group was successfully updated.'
+    else
+      render :edit
+    end
+  end
+
+  ##
+  # DELETE /access_groups/1
+  def destroy
+    @access_group.destroy
+    redirect_to access_groups_url, notice: 'Access group was successfully destroyed.'
+  end
+
+  private
+
+  def validate_user
+    authorize! true
+  end
+
+  # Use callbacks to share common setup or constraints between actions.
+  def set_access_group
+    @access_group = AccessGroup.find(params[:id])
+  end
+
+  # Only allow a trusted parameter "white list" through.
+  def access_group_params
+    params.require(:access_group).permit(:name, :ldap_group_list)
+  end
+end

data/app/controllers/account_activations_controller.rb

@@ -0,0 +1,29 @@
+##
+# This is a simple controller that handles account activation requests.
+#
+class AccountActivationsController < ApplicationController
+
+  ##
+  # Takes in the user's email address and activation token as parameters.
+  #
+  # If the activation token is correct for the email, then the account is activated.
+  # If a user is logged in, then the user must be activated already, so alert them that reactivation is not allowed.
+  def edit
+    if logged_in?
+      flash[:danger] = 'You cannot reactivate your account.'
+      redirect_to root_url
+    else
+      user = User.find_by(email: params[:email].downcase)
+      if user && !user.activated? && user.authenticated?(:activation, params[:id])
+        user.activate
+        log_in user
+        flash[:success] = 'Your account has been activated.'
+        redirect_to user
+      else
+        flash[:danger] = 'Invalid activation link'
+        redirect_to root_url
+      end
+    end
+  end
+
+end

data/app/controllers/application_controller.rb

@@ -0,0 +1,5 @@
+##
+# Default application controller.  Easy to override in child apps.
+class ApplicationController < ::BarkestCore::ApplicationControllerBase
+
+end

data/app/controllers/barkest_core/application_controller_base.rb

@@ -0,0 +1,113 @@
+module BarkestCore
+  ##
+  # This is the default application controller for the Barkest library.
+  # The application's ApplicationController should inherit from this.
+  class ApplicationControllerBase < ActionController::Base
+
+    include BarkestCore::SessionsHelper
+    include BarkestCore::RecaptchaHelper
+    include BarkestCore::StatusHelper
+
+    protect_from_forgery with: :exception
+    layout 'layouts/application'
+    helper BarkestCore::Engine.helpers
+
+    ##
+    # Should we show the denial reason when a user cannot access an action?
+    #
+    # Override this for any controller you want to show the denial reasons on.
+    def show_denial_reason?
+      false
+    end
+
+    ##
+    # Authorize the current action.
+    #
+    # * If +group_list+ is not provided or only contains +false+ then any authenticated user will be authorized.
+    # * If +group_list+ contains +true+ then only system administrators will be authorized.
+    # * Otherwise the +group_list+ contains a list of accepted groups that will be authorized.
+    #   Any user with one or more groups from the list will be granted access.
+    def authorize!(*group_list)
+      begin
+
+        # an authenticated user must exist.
+        unless logged_in?
+          store_location
+
+          raise_not_logged_in "You need to login to access '#{request.fullpath}'.",
+                              'nobody is logged in'
+        end
+
+        # clean up the group list.
+        group_list ||= []
+        group_list.delete false
+        group_list.delete ''
+
+        if group_list.include?(true)
+          # group_list contains "true" so only a system admin may continue.
+          unless system_admin?
+            if show_denial_reason?
+              flash[:info] = 'The requested path is only available to system administrators.'
+            end
+            raise_authorize_failure "Your are not authorized to access '#{request.fullpath}'.",
+                                    'requires system administrator'
+          end
+          log_authorize_success 'user is system admin'
+
+        elsif group_list.blank?
+          # group_list is empty or contained nothing but empty strings and boolean false.
+          # everyone can continue.
+          log_authorize_success 'only requires authenticated user'
+
+        else
+          # the group list contains one or more authorized groups.
+          # we want them to all be uppercase strings.
+          group_list = group_list.map{|v| v.to_s.upcase}.sort
+          result = current_user.has_any_group?(*group_list)
+          unless result
+            message = group_list.join(', ')
+            if show_denial_reason?
+              flash[:info] = "The requested path requires one of these groups: #{message}"
+            end
+            raise_authorize_failure "You are not authorized to access '#{request.fullpath}'.",
+                                    "requires one of: #{message}"
+          end
+          log_authorize_success "user has '#{result}' group"
+        end
+
+      rescue BarkestCore::AuthorizeFailure => err
+        flash[:danger] = err.message
+        redirect_to root_url and return false
+      end
+      true
+    end
+
+    rescue_from NotLoggedIn do |exception|
+      flash[:info] = exception.message
+      redirect_to login_url
+    end
+
+
+    private
+
+    def raise_authorize_failure(message, log_message = nil)
+      log_authorize_failure message, log_message
+      raise BarkestCore::AuthorizeFailure.new(message)
+    end
+
+    def raise_not_logged_in(message, log_message = nil)
+      log_authorize_failure message, log_message
+      raise BarkestCore::NotLoggedIn.new(message)
+    end
+
+    def log_authorize_failure(message, log_message = nil)
+      log_message ||= message
+      Rails.logger.info "AUTH(FAILURE): #{request.fullpath}, #{current_user}, #{message}"
+    end
+
+    def log_authorize_success(message)
+      Rails.logger.debug "AUTH(SUCCESS): #{request.fullpath}, #{current_user}, #{message}"
+    end
+
+  end
+end

data/app/controllers/barkest_core/engine_controller_base.rb

@@ -0,0 +1,15 @@
+module BarkestCore
+  ##
+  # An application controller base with a few modifications making it ideal for the parent class to engine controllers.
+  class EngineControllerBase < ApplicationControllerBase
+
+    # As an engine, we need to make sure the NotLoggedIn exception flows properly.
+    # If we let this fall through, it looks for the route inside our engine.
+    # We need to tell it to look at the main app instead.
+    rescue_from NotLoggedIn do |exception|
+      flash[:info] = exception.message
+      redirect_to main_app.login_url
+    end
+
+  end
+end

data/app/controllers/barkest_core/testsub_controller.rb

@@ -0,0 +1,21 @@
+
+module BarkestCore
+
+  ##
+  # A namespaced controller just for testing the submenu.
+  class TestsubController < ApplicationController
+
+    def page1
+
+    end
+
+    def page2
+      flash.now[:success] = 'The subheader should be above this message.'
+    end
+
+    def page3
+
+    end
+
+  end
+end

data/app/controllers/contact_controller.rb

@@ -0,0 +1,32 @@
+##
+# This controller provides the basic contact form.
+#
+class ContactController < ApplicationController
+
+  ##
+  # GET /contact
+  def index
+    @msg = BarkestCore::ContactMessage.new
+  end
+
+  ##
+  # POST /contact
+  def create
+    @msg = get_message
+    if @msg.valid? && verify_recaptcha_challenge(@msg)
+      @msg.remote_ip = request.remote_ip
+      @msg.send_message
+      flash[:success] = 'Your message has been sent.'
+      redirect_to root_url
+    else
+      render 'index'
+    end
+  end
+
+  private
+
+  def get_message
+    BarkestCore::ContactMessage.new(params.require(:barkest_core_contact_message).permit(:your_name, :your_email, :related_to, :subject, :body))
+  end
+
+end

data/app/controllers/log_view_controller.rb

@@ -0,0 +1,31 @@
+require 'time'
+
+class LogViewController < ApplicationController
+
+  before_action :valid_user
+  before_action :load_options
+  before_action :load_log
+
+  def index
+    @options.max_records = 50
+  end
+
+  private
+
+  def valid_user
+    authorize! true
+  end
+
+  def load_options
+    @options = BarkestCore::LogViewOptions.new(
+        params.include?(:barkest_core_log_view_options) ?
+            params.require(:barkest_core_log_view_options).permit(:min_severity, :start_time, :end_time, :search) :
+            { start_time: 7.days.ago }
+    )
+  end
+
+  def load_log
+    # load, filter, and reverse sort.
+    @log = BarkestCore::LogEntry.read_log.keep_if{ |r| @options.keep_log_entry? r }.sort{ |a,b| b <=> a }
+  end
+end

data/app/controllers/password_resets_controller.rb

@@ -0,0 +1,126 @@
+##
+# This is a simple controller that processes user password reset requests.
+#
+class PasswordResetsController < ApplicationController
+  before_action :not_logged_in
+  before_action :load_user, only: [:edit, :update]
+  before_action :valid_user, only: [:edit, :update]
+  before_action :check_expiration, only: [:edit, :update]
+
+  ##
+  # Shows the form allowing the user to enter their email address and confirm their non-robot status.
+  #
+  def new
+
+  end
+
+  ##
+  # Verifies that the user is not a robot via recaptcha, once that is complete the submitted
+  # email address is looked up.  Depending on the status of the user account looked up, one
+  # of four actions will occur.
+  #
+  # 1. The user account is active and valid, a reset email is sent.
+  # 2. The user account is disabled, a disabled account message is sent.
+  # 3. The user account has not been activated, an inactive account message is sent.
+  # 4. The user account doesn't exist, a non-existent account message is sent.
+  #
+  # Because a message is always sent, the caller cannot determine if the email address
+  # is a valid user account.  If it is a valid attempt on a non-existent account,
+  # only the recipient will know that the email address is not associated with an account
+  # and will be able to work from there to create a new account.
+  #
+  def create
+    unless verify_recaptcha_challenge
+      flash.now[:danger] = 'You must complete the recaptcha challenge to reset your password.'
+      render 'new' and return
+    end
+    email = params[:password_reset][:email].downcase
+    unless email && User::VALID_EMAIL_REGEX.match(email)
+      flash.now[:danger] = 'You must provide a valid email address to reset your password.'
+      render 'new' and return
+    end
+
+    @user = User.find_by(email: email)
+    if @user && @user.ldap?
+      User.send_ldap_reset_email(email, request.remote_ip)
+    elsif @user && @user.enabled? && @user.activated?
+      @user.create_reset_digest
+      @user.send_password_reset_email request.remote_ip
+    elsif @user
+      if !@user.enabled?
+        User.send_disabled_reset_email(email, request.remote_ip)
+      elsif !@user.active?
+        User.send_inactive_reset_email(email, request.remote_ip)
+      else
+        User.send_missing_reset_email(email, request.remote_ip)
+      end
+    else
+      User.send_missing_reset_email(email, request.remote_ip)
+    end
+
+    flash[:info] = 'An email with password reset information has been sent to you.'
+    redirect_to root_url
+  end
+
+  ##
+  # Shows a form allowing the user to specify a new password for their account.
+  # This is of course after verifying that the email address is correct and the
+  # password reset token for the email address is correct.
+  #
+  def edit
+
+  end
+
+  ##
+  # Resets the user's password.  This is only done once the email address is
+  # confirmed as being associated with a valid account, and the password reset
+  # token provided matches that account.  The user must also complete a
+  # recaptcha challenge to prevent robotic submissions, and the user's password
+  # must not be blank.
+  #
+  def update
+    if params[:user][:password].blank?
+      @user.errors.add(:password, 'can\'t be blank')
+      render 'edit'
+    elsif !verify_recaptcha_challenge(@user)
+      render 'edit'
+    elsif @user.update_attributes(user_params)
+      log_in @user
+      flash[:success] = 'Password has been reset.'
+      redirect_to @user
+    else
+      render 'edit'
+    end
+  end
+
+  private
+
+  def not_logged_in
+    if logged_in?
+      flash[:danger] = 'A logged in user cannot request a password reset.'
+      redirect_to root_url
+    end
+  end
+
+  def user_params
+    params.require(:user).permit(:password, :password_confirmation)
+  end
+
+  def load_user
+    @user = User.find_by(email: params[:email])
+  end
+
+  def valid_user
+    unless @user && !@user.ldap? && @user.enabled? && @user.activated? && @user.authenticated?(:reset, params[:id])
+      redirect_to root_url
+    end
+  end
+
+  def check_expiration
+    if @user.password_reset_expired?
+      flash[:danger] = 'Password reset request has expired.'
+      redirect_to new_password_reset_url
+    end
+  end
+
+end