refinerycms 0.9.6.34 → 0.9.7

data/vendor/plugins/authentication/app/controllers/sessions_controller.rb

@@ -1,12 +1,17 @@
 class SessionsController < ApplicationController
   layout 'admin'
   filter_parameter_logging 'password', 'password_confirmation'
+  before_filter :redirect?, :only => [:new, :create]
+  before_filter :redirect_to_new, :only => [:index, :show]
+
+  def new
+    @session = UserSession.new
+  end
 
   def create
-    @session = UserSession.new(params[:session])
-    if @session.save
+    if (@session = UserSession.create(params[:session])).valid?
+      flash[:notice] = t('sessions.login_successful') if refinery_user?
       redirect_back_or_default(admin_root_url)
-      flash[:notice] = "Logged in successfully"
     else
       render :action => 'new'
     end
@@ -14,12 +19,22 @@ class SessionsController < ApplicationController
 
   def destroy
     current_user_session.destroy if logged_in?
-    flash[:notice] = "You have been logged out."
-    redirect_back_or_default(new_session_url)
+
+    redirect_to(root_url)
   end
 
 protected
 
-  def take_down_for_maintenance?;end
+  def redirect?
+    if refinery_user?
+      redirect_to admin_root_url
+    elsif logged_in?
+      redirect_to root_url
+    end
+  end
+
+  def redirect_to_new
+    redirect_to :action => "new"
+  end
 
 end

data/vendor/plugins/authentication/app/controllers/users_controller.rb

@@ -1,6 +1,7 @@
 class UsersController < ApplicationController
 
   # Protect these actions behind an admin login
+  before_filter :redirect?, :only => [:new, :create, :index]
   before_filter :find_user, :only => [:suspend, :unsuspend, :destroy, :purge]
 
   # authlogic default
@@ -13,62 +14,65 @@ class UsersController < ApplicationController
 
   def new
     @user = User.new
-    render :text => "User signup is disabled", :layout => true unless can_create_public_user
   end
 
+  # This method should only be used to create the first Refinery user.
   def create
-    unless can_create_public_user
-      render :text => "User signup is disabled", :layout => true
-    else
-      begin
-        # protects against session fixation attacks, wreaks havoc with
-        # request forgery protection.
-        # uncomment at your own risk
-        # reset_session
-        @user = User.create(params[:user])
-        @selected_plugin_titles = params[:user][:plugins] || []
-
-        @user.save if @user.valid?
-
-        if @user.errors.empty?
-          @user.plugins = @selected_plugin_titles
-          @user.save
-          UserSession.create!(@user)
-          if User.count == 1
-            # this is the superuser if this user is the only user.
-            current_user.update_attribute(:superuser, true)
-
-            # set this user as the recipient of inquiry notifications
-            if (notification_recipients = InquirySetting.find_or_create_by_name("Notification Recipients")).present?
-              notification_recipients.update_attributes({
-                :value => current_user.email,
-                :destroyable => false
-              })
-            end
+    begin
+      # protects against session fixation attacks, wreaks havoc with request forgery protection.
+      # uncomment at your own risk:
+      # reset_session
+      @user = User.new(params[:user])
+      @selected_plugin_titles = params[:user][:plugins] || []
+
+      @user.save if @user.valid?
+
+      if @user.errors.empty?
+        @user.add_role(:refinery)
+        @user.plugins = @selected_plugin_titles
+        @user.save
+        UserSession.create!(@user)
+        if Role[:refinery].users.count == 1
+          # this is the superuser if this user is the only user.
+          current_user.add_role(:superuser)
+          current_user.save
+
+          # set this user as the recipient of inquiry notifications
+          if (notification_recipients = InquirySetting.find_or_create_by_name("Notification Recipients")).present?
+            notification_recipients.update_attributes({
+              :value => current_user.email,
+              :destroyable => false
+            })
           end
+        end
 
-          redirect_back_or_default(admin_root_url)
-          flash[:notice] = "Welcome to Refinery, #{current_user.login}."
+        redirect_back_or_default(admin_root_url)
+        flash[:message] = "<h2>#{t('users.create.welcome', :who => current_user.login).gsub(/\.$/, '')}.</h2>"
 
-          if User.count == 1 or RefinerySetting[:site_name] == "Company Name"
-            refinery_setting = RefinerySetting.find_by_name("site_name")
-            flash[:notice] << "<br/>First let's give the site a name. <a href='#{edit_admin_refinery_setting_url(refinery_setting)}'>Go here</a> to edit your website's name"
-          end
+        if Role[:refinery].users.count == 1 or RefinerySetting[:site_name].to_s =~ /^(|Company\ Name)$/
+          flash[:message] << "<p>#{t('users.setup_website_name', :link => edit_admin_refinery_setting_url(RefinerySetting.find_by_name("site_name")))}</p>"
         else
           render :action => 'new'
         end
+      else
+        render :action => 'new'
       end
     end
   end
 
   def forgot
     if request.post?
-      if (user = User.find_by_email(params[:user][:email])).present?
+      if (params[:user].present? and params[:user][:email].present? and user = User.find_by_email(params[:user][:email])).present?
         user.deliver_password_reset_instructions!(request)
-        flash[:notice] = "An email has been sent to #{user.email} with a link to reset your password."
-        redirect_back_or_default forgot_url
+        flash[:notice] = t('users.forgot.email_reset_sent')
+        redirect_back_or_default new_session_url
       else
-        flash[:notice] = "Sorry, #{params[:user][:email]} isn't associated with any accounts. Are you sure you typed the correct email address?"
+        @user = User.new(params[:user])
+        if (email = params[:user][:email]).blank?
+          flash.now[:error] = t('users.forgot.blank_email')
+        else
+          flash.now[:error] = t('users.forgot.email_not_associated_with_account', :email => params[:user][:email])
+        end
       end
     end
   end
@@ -77,26 +81,30 @@ class UsersController < ApplicationController
     if params[:reset_code] and @user = User.find_using_perishable_token(params[:reset_code])
       if request.post?
         UserSession.create(@user)
-        if @user.update_attributes(:password => params[:user][:password], :password_confirmation => params[:user][:password_confirmation])
-          flash[:notice] = "Password reset successfully for #{@user.email}"
+        if @user.update_attributes(:password => params[:user][:password],
+                                   :password_confirmation => params[:user][:password_confirmation])
+
+          flash[:notice] = t('users.reset.successful', :email => @user.email)
           redirect_back_or_default admin_root_url
         end
       end
     else
-      flash[:notice] = "We're sorry, but this reset code has expired or is invalid." +
-        "If you are having issues try copying and pasting the URL " +
-        "from your email into your browser or restarting the " +
-        "reset password process."
-      redirect_to forgot_url
+      redirect_to(forgot_users_url, :error => t('users.reset.code_invalid'))
     end
   end
 
 protected
 
-  def take_down_for_maintenance?;end
+  def redirect?
+    if refinery_user?
+      redirect_to admin_users_url
+    elsif refinery_users_exist?
+      redirect_to root_url
+    end
+  end
 
-  def can_create_public_user
-    User.count == 0
+  def refinery_users_exist?
+    Role[:refinery].users.any?
   end
 
 end

data/vendor/plugins/authentication/app/models/role.rb

@@ -0,0 +1,16 @@
+class Role < ActiveRecord::Base
+
+  has_and_belongs_to_many :users
+
+  before_validation :camelize_title
+  validates_uniqueness_of :title
+
+  def camelize_title(role_title = self.title)
+    self.title = role_title.to_s.camelize
+  end
+
+  def self.[](title)
+    find_or_create_by_title(title.to_s.camelize)
+  end
+
+end

data/vendor/plugins/authentication/app/models/user.rb

@@ -33,26 +33,39 @@ class User < ActiveRecord::Base
 
   #-------------------------------------------------------------------------------------------------
 
-  serialize :plugins_column # Array # this is seriously deprecated and will be removed later.
-
+  has_and_belongs_to_many :roles
   has_many :plugins, :class_name => "UserPlugin", :order => "position ASC"
+  has_friendly_id :login, :use_slug => false
 
-  def plugins=(plugin_titles)
+  def plugins=(plugin_names)
     unless self.new_record? # don't add plugins when the user_id is NULL.
       self.plugins.delete_all
 
-      plugin_titles.each_with_index do |plugin_title, index|
-        self.plugins.create(:title => plugin_title, :position => index) if plugin_title.is_a?(String)
+      plugin_names.each_with_index do |plugin_name, index|
+        self.plugins.create(:name => plugin_name, :position => index) if plugin_name.is_a?(String)
       end
     end
   end
 
   def authorized_plugins
-    self.plugins.collect {|p| p.title} | Refinery::Plugins.always_allowed.titles
+    self.plugins.collect { |p| p.name } | Refinery::Plugins.always_allowed.names
+  end
+
+  def can_delete?(user_to_delete = self)
+    !user_to_delete.new_record? and
+      !user_to_delete.has_role?(:superuser) and
+      Role[:refinery].users.count > 1 and
+      self.id != user_to_delete.id
+  end
+
+  def add_role(title)
+    unless self.has_role?(role = Role[title.to_s])
+      self.roles << role
+    end
   end
 
-  def can_delete?(other_user = self)
-    !other_user.superuser and User.count > 1 and (other_user.nil? or self.id != other_user.id)
+  def has_role?(role)
+    self.roles.include?(role.is_a?(Role) ? role : Role[role.to_s])
   end
 
 end

data/vendor/plugins/authentication/app/models/user_mailer.rb

@@ -2,8 +2,9 @@ class UserMailer < ActionMailer::Base
 
   def reset_notification(user, request)
     setup_email(user)
-    subject         'Link to reset your password'
-    @body[:url]  =  url_prefix(request) + "/reset/#{user.perishable_token}"
+    subject         I18n.translate('.link_to_reset_your_password')
+    @body[:url]  =  reset_users_url(:host => request.host_with_port,
+                                    :reset_code => user.perishable_token)
   end
 
 protected

data/vendor/plugins/authentication/app/models/user_session.rb

@@ -5,5 +5,5 @@ class UserSession < Authlogic::Session::Base
 
   find_by_login_method :find_by_login_or_email
 
-  generalize_credentials_error_messages "Sorry, your #{Refinery.authentication_login_field} or password was incorrect."
+  generalize_credentials_error_messages I18n.translate('authlogic.attributes.user_session.incorrect', :login_field => I18n.translate("authlogic.attributes.user_session.#{Refinery.authentication_login_field.downcase}").downcase)
 end

data/vendor/plugins/authentication/app/views/admin/users/_form.html.erb

@@ -1,5 +1,5 @@
-<%= error_messages_for :user %>
 <% form_for [:admin, @user] do |f| %>
+  <%= f.error_messages %>
   <div class='field'>
     <%= f.label :login %>
     <%= f.text_field :login %>
@@ -11,28 +11,47 @@
   <div class='field'>
     <%= f.label :password %>
     <%= f.password_field :password %>
-    <%= "<br /><span class='preview'>Leaving password blank keeps the current password</span>" unless @user.new_record? %>
+    <%= "<br /><span class='preview'>#{t('.blank_password_keeps_current')}</span>" unless @user.new_record? %>
   </div>
   <div class='field'>
     <%= f.label :password_confirmation %>
     <%= f.password_field :password_confirmation %>
   </div>
-  <div class='field'>
-    <%= f.label :plugin_access %>
+  <div class='field plugin_access'>
+    <span class='label_with_help'>
+      <%= f.label :plugin_access, nil, :class => "title_label" %>
+      <%= link_to "(#{t('.enable_all')})", "", :id => "user_plugins_enable_all" %>
+    </span>
     <ul id='plugins'>
       <% @available_plugins.each do |plugin| -%>
-        <%# Since the dashboard is always included by the framework, this will maintain the user's order %>
-        <% if Refinery::Plugins.always_allowed.titles.include?(plugin) or (plugin == 'Users' and @user.id == current_user.id) %>
-          <%= hidden_field_tag 'user[plugins][]', plugin %>
+        <% if Refinery::Plugins.always_allowed.names.include?(plugin[:name]) or
+              (plugin[:name] == 'refinery_users' and @user.id == current_user.id) %>
+          <%= hidden_field_tag 'user[plugins][]', plugin[:name] %>
         <% else %>
           <li>
-            <%= check_box_tag 'user[plugins][]', plugin, @selected_plugin_titles.include?(plugin), :id => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
-            <%= f.label 'user[plugins][]', plugin, :class => "stripped", :for => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
+            <%= check_box_tag 'user[plugins][]',
+                              plugin[:name],
+                              @selected_plugin_names.include?(plugin[:name]),
+                              :id => "plugins_#{plugin[:name]}" %>
+            <%= f.label 'user[plugins][]',
+                        t("plugins.#{plugin[:name].downcase}.title", :default => plugin[:title]),
+                        :class => "stripped",
+                        :for => "plugins_#{plugin[:name]}" %>
           </li>
         <% end %>
       <% end %>
     </ul>
   </div>
-  <%= render :partial => "/shared/admin/form_actions", :locals => {:f => f, :continue_editing => false} %>
+  <%= render :partial => "/shared/admin/form_actions", :locals => {:f => f, :continue_editing => false, :hide_delete => !current_user.can_delete?(@user)} %>
+<% end %>
 
+<% content_for :head do %>
+  <script type='text/javascript'>
+    $(document).ready(function() {
+      $('#user_plugins_enable_all').click(function(e, a) {
+        $('div.field.plugin_access ul#plugins li input:checkbox').attr('checked', true);
+        e.preventDefault();
+      });
+    });
+  </script>
 <% end %>

data/vendor/plugins/authentication/app/views/admin/users/_user.html.erb

@@ -1,16 +1,17 @@
 <li id="sortable_<%= user.id %>" class='clearfix record <%= cycle("on", "on-hover") %>'>
   <span class='title'>
     <strong><%= user.login %></strong>
-    <span class="preview">(<%= user.email %>) created <%= user.created_at.strftime("%b %d, %Y") %></span>
-
-    <span class='actions'>
-      <%= link_to refinery_icon_tag('delete.png'), admin_user_path(user),
-                  :class => "cancel confirm-delete",
-                  :title => "Remove this user forever" if current_user.can_delete?(user) %>
-      <%= link_to refinery_icon_tag('application_edit.png'), edit_admin_user_path(user),
-                  :title => 'Edit this user' %>
-      <%= mail_to user.email, refinery_icon_tag('email_go.png'),
-                  :title => 'Email this user' %>
+    <span class="preview">
+      <%= t('.preview', :who => user.email, :created_at => l(user.created_at, :format => :short)) %>
     </span>
   </span>
+  <span class='actions'>
+    <%= link_to refinery_icon_tag('delete.png'), admin_user_path(user),
+                :class => "cancel confirm-delete",
+                :title => t('.confirm_delete_title') if current_user.can_delete?(user) %>
+    <%= link_to refinery_icon_tag('application_edit.png'), edit_admin_user_path(user),
+                :title => t('.edit_user')%>
+    <%= mail_to user.email, refinery_icon_tag('email_go.png'),
+                :title => t('.email_user') %>
+  </span>
 </li>

data/vendor/plugins/authentication/app/views/admin/users/index.html.erb

@@ -1,7 +1,7 @@
 <div id='actions'>
   <ul>
     <li>
-      <%= link_to "Create New User", new_admin_user_url, :class => "add_icon" %>
+      <%= link_to t('.create_new_user'), new_admin_user_url, :class => "add_icon" %>
     </li>
   </ul>
 </div>
@@ -15,8 +15,7 @@
   <% else %>
     <p>
       <strong>
-        There are no users yet.
-        Click "Create New User" to add your first user.
+        <%= t('.no_users_yet') %>
       </strong>
     </p>
   <% end %>

data/vendor/plugins/authentication/app/views/sessions/new.html.erb

@@ -1,25 +1,22 @@
 <% form_for :session, @session, :url => session_path do |f| -%>
   <%= f.error_messages %>
+  <div class='field session_username clearfix'>
+    <%= f.label Refinery.authentication_login_field %>
+    <%= f.text_field Refinery.authentication_login_field, :class => 'larger widest' %>
+  </div>
+  <div class='field session_password clearfix'>
+    <%= f.label :password %>
+    <%= f.password_field :password, :autocomplete => 'off', :class => 'larger widest' %>
+  </div>
   <div class='clearfix'>
-    <div class='field session_username'>
-      <%= f.label Refinery.authentication_login_field %>
-      <%= f.text_field Refinery.authentication_login_field %>
+    <div class='field remember_me'>
+      <%= f.check_box :remember_me %>
+      <%= f.label :remember_me %>
     </div>
-    <div class='field session_password'>
-      <%= f.label :password %>
-      <%= f.password_field :password, :autocomplete => 'off' %>
+    <div class='field forgot_password'>
+      <%= link_to t('.forgot_password'), forgot_users_url %>
     </div>
   </div>
-  <div class='field forgot_password'>
-    <%= link_to "I forgot my password", forgot_url %>
-  </div>
-  <div class='field remember_me'>
-    <%= f.label :remember_me, nil %>
-    <%= f.check_box :remember_me %>
-  </div>
-  <div class='form-actions'>
-    <%= submit_tag 'Log in' %>
-    or
-    <%= link_to "Cancel", root_url %>
-  </div>
+  <%= render :partial => "/shared/admin/form_actions", :locals => {:f => f, :submit_button_text => t('.sign_in'), :hide_cancel => true} %>
 <% end -%>
+<% content_for :header, t('.hello_please_sign_in') %>

data/vendor/plugins/authentication/app/views/users/forgot.html.erb

@@ -1,13 +1,18 @@
-<%= error_messages_for :user %>
+<% content_for :header, "Please enter the email address for your account." %>
+
 <% form_for :user do |f| -%>
-  <p>Enter the email address for your account.</p>
+  <%= f.error_messages %>
+
   <div class='field'>
-    <%= f.label :email %>
-    <%= f.text_field :email %>
-  </div>
-  <div class='form-actions'>
-    <%= submit_tag 'Reset password' %>
-    or
-    <%= link_to "Cancel", login_url %>
+    <%= f.text_field :email, :class => "larger widest",
+                     :placeholder => "Email Address" %>
   </div>
+
+  <%= render :partial => "/shared/admin/form_actions",
+             :locals => {
+               :f => f,
+               :continue_editing => false,
+               :submit_button_text => "Reset password",
+               :cancel_url => login_url
+             } -%>
 <% end -%>