refinerycms 0.9.0

data/vendor/plugins/authentication/app/controllers/sessions_controller.rb

@@ -0,0 +1,30 @@
+class SessionsController < ApplicationController
+  
+  layout 'admin'
+  filter_parameter_logging 'password', 'password_confirmation'
+    
+  def create
+    self.current_user = User.authenticate(params[:session][:login], params[:session][:password])
+    if logged_in?
+      if params[:session][:remember_me] == "1"
+        current_user.remember_me unless current_user.remember_token?
+        cookies[:auth_token] = {:value => self.current_user.remember_token ,
+                                :expires => self.current_user.remember_token_expires_at}
+      end
+      redirect_back_or_default(admin_root_url)
+      flash[:notice] = "Logged in successfully"
+    else
+      flash[:error] = "Sorry, your password or username was incorrect."
+      render :action => 'new'
+    end
+  end
+
+  def destroy
+    self.current_user.forget_me if logged_in?
+    cookies.delete :auth_token
+    reset_session
+    flash[:notice] = "You have been logged out."
+    redirect_back_or_default(new_session_url)
+  end
+  
+end

data/vendor/plugins/authentication/app/controllers/users_controller.rb

@@ -0,0 +1,86 @@
+class UsersController < ApplicationController
+
+  # Protect these actions behind an admin login
+  # before_filter :admin_required, :only => [:suspend, :unsuspend, :destroy, :purge]
+  before_filter :find_user, :only => [:suspend, :unsuspend, :destroy, :purge]
+
+  filter_parameter_logging 'password', 'password_confirmation'
+
+  layout 'admin'
+
+  def new
+    render :text => "User signup is disabled", :layout => true unless can_create_public_user
+  end
+
+  def create
+    unless can_create_public_user
+      render :text => "User signup is disabled", :layout => true 
+    else
+      begin
+          cookies.delete :auth_token
+          # protects against session fixation attacks, wreaks havoc with 
+          # request forgery protection.
+          # uncomment at your own risk
+          # reset_session
+          @user = User.new(params[:user])
+					@selected_plugin_titles = params[:user][:plugins] || []
+
+          @user.register! if @user.valid?
+          if @user.errors.empty?
+						@user.plugins = @selected_plugin_titles
+            self.current_user = @user
+            current_user.activate!
+            redirect_back_or_default(admin_root_url)
+
+            flash[:notice] = "Welcome to Refinery, #{current_user.login}."
+            if User.count == 1 or RefinerySetting[:site_name] == "Company Name"
+              refinery_setting = RefinerySetting.find_by_name("site_name")
+              flash[:notice] << " First let's give the site a name. <a href='#{edit_admin_refinery_setting_url(refinery_setting)}'>Go here</a> to edit your website's name"
+            end
+          else
+            render :action => 'new'
+          end
+      end
+    end
+  end
+
+  def activate
+    self.current_user = params[:activation_code].blank? ? false : User.find_by_activation_code(params[:activation_code])
+    if logged_in? && !current_user.active?
+      current_user.activate!
+      flash[:notice] = "Signup complete!"
+    end
+    redirect_back_or_default('/')
+  end
+
+  def suspend
+    @user.suspend! 
+    redirect_to users_path
+  end
+
+  def unsuspend
+    @user.unsuspend! 
+    redirect_to users_path
+  end
+
+  def destroy
+    @user.delete!
+    redirect_to users_path
+  end
+
+  def purge
+    @user.destroy
+    redirect_to users_path
+  end
+
+protected
+
+  def find_user
+    @user = User.find(params[:id])
+  end
+
+  def can_create_public_user
+    User.count == 0
+  end
+
+end

data/vendor/plugins/authentication/app/helpers/sessions_helper.rb

@@ -0,0 +1,2 @@
+module SessionsHelper
+end

data/vendor/plugins/authentication/app/helpers/users_helper.rb

@@ -0,0 +1,2 @@
+module UsersHelper
+end

data/vendor/plugins/authentication/app/models/user.rb

@@ -0,0 +1,146 @@
+require 'digest/sha1'
+class User < ActiveRecord::Base	
+	# Hack: Allow "rake gems:install" to run when this class is missing its gem dependency.
+	# For further clarification on why, refer to:
+	# https://rails.lighthouseapp.com/projects/8994/tickets/780-rake-gems-install-doesn-t-work-if-plugins-are-missing-gem-dependencies
+	if defined? AASM
+		include AASM # include the library which will give us state machine functionality.
+		aasm_column :state
+	  aasm_initial_state :pending
+	  aasm_state :passive
+	  aasm_state :pending, :enter => :make_activation_code
+	  aasm_state :active,  :enter => :do_activate
+	  aasm_state :suspended
+	  aasm_state :deleted, :enter => :do_delete
+
+	  aasm_event :register do
+	    transitions :from => :passive, :to => :pending, :guard => Proc.new {|u| !(u.crypted_password.blank? && u.password.blank?) }
+	  end
+  
+	  aasm_event :activate do
+	    transitions :from => :pending, :to => :active 
+	  end
+  
+	  aasm_event :suspend do
+	    transitions :from => [:passive, :pending, :active], :to => :suspended
+	  end
+  
+	  aasm_event :delete do
+	    transitions :from => [:passive, :pending, :active, :suspended], :to => :deleted
+	  end
+
+	  aasm_event :unsuspend do
+	    transitions :from => :suspended, :to => :active,  :guard => Proc.new {|u| !u.activated_at.blank? }
+	    transitions :from => :suspended, :to => :pending, :guard => Proc.new {|u| !u.activation_code.blank? }
+	    transitions :from => :suspended, :to => :passive
+	  end
+	end	
+	
+  # Virtual attribute for the unencrypted password
+  attr_accessor :password
+
+  #validates_presence_of     :login, :email # handled by other checks
+  #validates_presence_of     :password,                   :if => :password_required? # handled by other checks
+  validates_presence_of     :password_confirmation,      :if => :password_required?
+  validates_length_of       :password, :within => 4..40, :if => :password_required?
+  validates_confirmation_of :password,                   :if => :password_required?
+  validates_length_of       :login,    :within => 3..40
+  validates_length_of       :email,    :within => 3..100
+  validates_uniqueness_of   :login, :email, :case_sensitive => false
+  before_save :encrypt_password
+  
+	serialize :plugins_column#, Array
+
+	has_many :plugins, :class_name => "UserPlugin", :order => "position ASC"
+  
+  # prevents a user from submitting a crafted form that bypasses activation
+  # anything else you want your user to change should be added here.
+  attr_accessible :login, :email, :password, :password_confirmation, :plugins
+
+  # Authenticates a user by their login name and unencrypted password.  Returns the user or nil.
+  def self.authenticate(login, password)
+    u = find_in_state :first, :active, :conditions => {:login => login} # need to get the salt
+    u && u.authenticated?(password) ? u : nil
+  end
+
+  # Encrypts some data with the salt.
+  def self.encrypt(password, salt)
+    Digest::SHA1.hexdigest("--#{salt}--#{password}--")
+  end
+
+  # Encrypts the password with the user salt
+  def encrypt(password)
+    self.class.encrypt(password, salt)
+  end
+
+  def authenticated?(password)
+    crypted_password == encrypt(password)
+  end
+
+	def plugins=(plugin_titles)
+		self.plugins.delete_all
+		
+		plugin_titles.each do |plugin_title|
+			if plugin_title.is_a?(String)
+				self.plugins.find_or_create_by_title(plugin_title)
+			end
+		end
+	end
+
+  def remember_token?
+    remember_token_expires_at && Time.now.utc < remember_token_expires_at 
+  end
+
+  # These create and unset the fields required for remembering users between browser closes
+  def remember_me
+    remember_me_for 2.weeks
+  end
+
+  def remember_me_for(time)
+    remember_me_until time.from_now.utc
+  end
+
+  def remember_me_until(time)
+    self.remember_token_expires_at = time
+    self.remember_token            = encrypt("#{email}--#{remember_token_expires_at}")
+    save(false)
+  end
+
+  def forget_me
+    self.remember_token_expires_at = nil
+    self.remember_token            = nil
+    save(false)
+  end
+
+  # Returns true if the user has just been activated.
+  def recently_activated?
+    @activated
+  end
+
+  protected
+    # before filter 
+    def encrypt_password
+      return if password.blank?
+      self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{login}--") if new_record?
+      self.crypted_password = encrypt(password)
+    end
+      
+    def password_required?
+      crypted_password.blank? || !password.blank?
+    end
+    
+    def make_activation_code
+      self.deleted_at = nil
+      self.activation_code = Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join )
+    end
+    
+    def do_delete
+      self.deleted_at = Time.now.utc
+    end
+
+    def do_activate
+      @activated = true
+      self.activated_at = Time.now.utc
+      self.deleted_at = self.activation_code = nil
+    end
+end

data/vendor/plugins/authentication/app/models/user_mailer.rb

@@ -0,0 +1,25 @@
+class UserMailer < ActionMailer::Base
+  
+  def signup_notification(user)
+    setup_email(user)
+    @subject    += 'Please activate your new account'
+    @body[:url]  = "http://YOURSITE/activate/#{user.activation_code}"
+  end
+  
+  def activation(user)
+    setup_email(user)
+    @subject    += 'Your account has been activated!'
+    @body[:url]  = "http://YOURSITE/"
+  end
+  
+protected
+  
+  def setup_email(user)
+    @recipients  = "#{user.email}"
+    @from        = "ADMINEMAIL"
+    @subject     = "[YOURSITE] "
+    @sent_on     = Time.now
+    @body[:user] = user
+  end
+  
+end

data/vendor/plugins/authentication/app/models/user_observer.rb

@@ -0,0 +1,11 @@
+class UserObserver < ActiveRecord::Observer
+  def after_create(user)
+    UserMailer.deliver_signup_notification(user)
+  end
+
+  def after_save(user)
+  
+    UserMailer.deliver_activation(user) if user.recently_activated?
+  
+  end
+end

data/vendor/plugins/authentication/app/models/user_plugin.rb

@@ -0,0 +1,5 @@
+class UserPlugin < ActiveRecord::Base
+	
+	belongs_to :user
+	
+end

data/vendor/plugins/authentication/app/views/admin/users/_form.html.erb

@@ -0,0 +1,42 @@
+<%= error_messages_for :user %>
+<% form_for [:admin, @user] do |f| %>
+	<div class='field'>
+		<%= f.label :login %>
+		<%= f.text_field :login %>
+	</div>
+	<div class='field'>
+		<%= f.label :email %>
+		<%= f.text_field :email %>
+	</div>
+	<div class='field'>
+		<%= f.label :password %>
+		<%= f.password_field :password %><br />
+		<span class="preview">Leaving password blank keeps the current password</span>
+	</div>
+	<div class='field'>
+		<%= f.label :password_confirmation %>
+		<%= f.password_field :password_confirmation %>
+	</div>
+	<div class='field'>
+		<%= f.label :plugin_access %>
+		<ul id='plugins'>
+			<% @available_plugins.each do |plugin| -%>
+			  <%# Since the dashboard is always included by the framework, this will maintain the user's order %>
+			  <% if Refinery::Plugins.always_allowed.titles.include?(plugin) or (plugin == 'Users' and @user.id == current_user.id) %>
+			    <%= hidden_field_tag 'user[plugins][]', plugin %>
+			  <% else %>
+					<li>
+				    <%= check_box_tag 'user[plugins][]', plugin, @selected_plugin_titles.include?(plugin), :id => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
+						<%= f.label 'user[plugins][]', plugin, :class => "stripped", :for => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
+					</li>
+			  <% end %>
+			<% end %>
+		</ul>
+	</div>
+	<div class='form-actions'>
+		<%= f.submit 'Save' %> 
+		or 
+		<%= link_to "Cancel", admin_users_url, :title => "Cancelling will lose all changes you've made to this news item" %>
+	</div>
+	
+<% end %>

data/vendor/plugins/authentication/app/views/admin/users/edit.html.erb

@@ -0,0 +1 @@
+<%= render :partial => 'form' %>

data/vendor/plugins/authentication/app/views/admin/users/index.html.erb

@@ -0,0 +1,41 @@
+<div id='actions'>
+  <ul>
+    <li>
+      <%= link_to "Create New User", new_admin_user_url, :class => "add_icon" %>
+    </li>
+  </ul>
+</div>
+<div id='records'>
+  <% if @users.size > 0 %>
+    <%= will_paginate @users, :previous_label => '&laquo;', :next_label => '&raquo;' %>
+    <ul>
+      <% @users.each do |user| -%>
+        <li id="sortable_<%= user.id %>" class='clearfix record <%= cycle("on", "on-hover") %>'>
+          <span class='title'>
+            <span class='actions'>
+              <%= link_to refinery_icon_tag('delete.png'), admin_user_path(user),
+                :confirm => "Are you sure you want to delete '#{user.login}'?",
+                :class => "cancel", :method => :delete,
+                :title => "Remove this user forever" if @users.size > 1 and user.id != current_user.id %>
+              <%= link_to refinery_icon_tag('application_edit.png'), edit_admin_user_path(user),
+                :title => 'Edit this user' %>
+              <%= mail_to user.email, refinery_icon_tag('email_go.png'), :title => 'Email this user' %>
+            </span>
+            <strong><%= user.login %></strong>
+            <span class="preview">
+              (<%= user.email %>) created <%= user.created_at.strftime("%b %d, %Y") %>
+            </span>
+          </span>
+        </li>
+      <% end -%>
+    </ul>
+    <%= will_paginate @users, :previous_label => '&laquo;', :next_label => '&raquo;' %>
+  <% else %>
+    <p>
+      <strong>
+        There are no users yet.
+        Click "Create New User" to add your first user.
+      </strong>
+    </p>
+  <% end %>
+</div>

data/vendor/plugins/authentication/app/views/admin/users/new.html.erb

@@ -0,0 +1 @@
+<%= render :partial => "form" %>

data/vendor/plugins/authentication/app/views/sessions/new.html.erb

@@ -0,0 +1,21 @@
+<% form_for :session, :url => session_path do |f| -%>
+	<div class='clearfix'>
+		<div class='field session_username'>
+			<%= f.label :login %>
+			<%= f.text_field :login, {:style => 'width: 255px'} %>
+		</div>
+		<div class='field session_password'>
+			<%= f.label :password %>
+			<%= f.password_field :password, {:style => 'width: 255px'} %>
+		</div>
+	</div>
+	<div class='field'>
+		<%= f.label :remember_me, nil, :style => "display: inline;" %>
+		<%= f.check_box :remember_me %>
+	</div>
+	<div class='form-actions'>
+		<%= submit_tag 'Log in' %>
+		or
+		<%= link_to "Cancel", root_url %>
+	</div>
+<% end -%>

data/vendor/plugins/authentication/app/views/user_mailer/activation.html.erb

@@ -0,0 +1,3 @@
+<%= @user.login %>, your account has been activated.  You may now start adding your plugins:
+
+  <%= @url %>

data/vendor/plugins/authentication/app/views/user_mailer/signup_notification.html.erb

@@ -0,0 +1,8 @@
+Your account has been created.
+
+  Username: <%= @user.login %>
+  Password: <%= @user.password %>
+
+Visit this url to activate your account:
+
+  <%= @url %>