model_security_generator 0.0.5 → 0.0.6

data/templates/controllers/user_controller.rb

@@ -92,7 +92,7 @@ public
   # it!
   def logout
     User.sign_off
-    session[:user_id] = nil
+    reset_session
     session[:skip_user_setup] = true
     redirect_to :action => 'login'
   end
@@ -114,7 +114,7 @@ public
           @user.save
           User.sign_on_by_session(1)
           session[:user_id] = 1
-          render :file => 'app/views/user/admin_created.rhtml'
+          render :action => 'admin_created'
 	# Mail the user instructions on how to activate their account.
         else
           url_params = {
@@ -125,7 +125,8 @@ public
           }
           url = url_for(url_params)
           UserMailer.deliver_new_user(p, url, @user.token_expiry)
-          render :file => 'app/views/user/created.rhtml'
+          @email = p['email']
+          render :action => 'created'
         end
       else
         flash['notice'] = 'Creation of new user failed.'

data/templates/db/users.sql

@@ -5,7 +5,7 @@ create table users (
 	admin		integer(1) not null default 0,
 	activated	integer(1) not null default 0,
 	email		varchar(80) not null,
-  	cypher		varchar(512) not null,
+  	cypher		text not null,
 	salt		char(40) not null,
 	token		char(10) not null,
 	token_expiry	timestamp not null,

data/templates/lib/model_security.rb

@@ -278,9 +278,6 @@ private
   # *attribute* is the name of the attribute upon which an access is
   # being attempted.
   #
-  # FIX: Is exception information displayed in production mode? I put a lot
-  # of sensitive data in this exception.
-  #
   def security_error(permission, attribute)
     global = nil
     local = nil
@@ -345,7 +342,6 @@ public
   def write_attribute(name, value)
     if not writable?(name)
       security_error(:let_write, name)
-      raise SecurityError
     end
     old_write_attribute(name, value)
   end

data/templates/lib/user_support.rb

@@ -22,18 +22,33 @@ module UserSupport
   end
 
   
+  # FIX: This only works for require_login and require_admin for now, because
+  # I'm not passing the block across invocations.
+  #
+  # This is meant to be used as a before_filter. 
+  # A condition that is dependent on the user's login is in the block.
+  # If the condition isn't true, a login panel is put up, and the explanation 
+  # that is passed as an argument may (or may not) be presented to the user,
+  # depending on whether we're using HTTP authentication or not.
+  # Once the condition is met, it resumes the action it was protecting.
+  def require_condition(e)
+    if yield
+      return true
+    else
+      if controller_name != 'user' and (action_name != 'login' and action_name != 'login_admin')
+        store_location
+      end
+      redirect_to :controller => 'user', :action => 'login', :explanation => e
+      return false
+    end
+  end
+
   # This is meant to be used as a before_filter. It requires an
   # administrative login, putting up a login panel if the administrator
   # isn't currently logged in. Once the administrator logs in, it resumes
   # the action it was protecting.
   def require_admin
-    if admin?
-      return true
-    else
-      store_location
-      redirect_to :controller => 'user', :action => 'login_admin'
-      return false
-    end
+    require_condition("Administrative user required.") { admin? }
   end
 
   # This is meant to be used as a before_filter. It requires a
@@ -41,13 +56,7 @@ module UserSupport
   # logged in. Once a user logs in, it resumes the action it was
   # protecting.
   def require_login
-    if User.current
-      true
-    else
-      store_location
-      redirect_to :controller => 'user', :action => 'login'
-      false
-    end
+    require_condition("Login required.") { User.current }
   end
 
   # This is a before filter for the entire application, used to set up the

data/templates/models/user.rb

@@ -140,7 +140,7 @@ private
 
   
   # The security token can only be changed if we're the special "login" user.
-  let_write :activated, :password, :token, :token_expiry, :if => :logging_in?
+  let_write :activated, :token, :token_expiry, :if => :logging_in?
 
 public
   attr_accessor :password, :password_confirmation, :old_password

metadata

@@ -3,8 +3,8 @@ rubygems_version: 0.8.4
 specification_version: 1
 name: model_security_generator
 version: !ruby/object:Gem::Version 
-  version: 0.0.5
-date: 2005-10-04
+  version: 0.0.6
+date: 2005-10-10
 summary: "[Rails] Model security and authentication generator."
 require_paths: 
   - "."