1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
# controllers/application.rb:
# Parent class of all controllers in FOI site. Filters added to this controller
# apply to all controllers in the application. Likewise, all the methods added
# will be available for all controllers.
#
# Copyright (c) 2007 UK Citizens Online Democracy. All rights reserved.
# Email: francis@mysociety.org; WWW: http://www.mysociety.org/
#
# $Id: application.rb,v 1.28 2008-01-29 03:05:46 francis Exp $
class ApplicationController < ActionController::Base
# Standard hearders, footers and navigation for whole site
layout "default"
# Pick a unique cookie name to distinguish our session data from others'
session :session_key => '_foi_session_id'
# Override default error handler
def rescue_action_in_public(exception)
# do something based on exception
@exception_backtrace = exception.backtrace.join("\n")
@exception_class = exception.class.to_s
render :template => "general/exception_caught.rhtml", :status => 404
end
def local_request?
false
end
private
# Check the user is logged in
def authenticated?(reason_params)
unless session[:user_id]
post_redirect = PostRedirect.new(:uri => request.request_uri, :post_params => params,
:reason_params => reason_params)
post_redirect.save!
redirect_to signin_url(:token => post_redirect.token)
return false
end
return true
end
def authenticated_as_user?(user, reason_params)
reason_params[:user_name] = user.name
reason_params[:user_url] = show_user_url(:simple_name => simplify_url_part(user.name))
if session[:user_id]
if session[:user_id] == user.id
# They are logged in as the right user
return true
else
# They are already logged in, but as the wrong user
@reason_params = reason_params
render :template => 'user/wrong_user'
return
end
end
# They are not logged in at all
return authenticated?(reason_params)
end
# Return logged in user
def authenticated_user
if session[:user_id].nil?
return nil
else
return User.find(session[:user_id])
end
end
# Do a POST redirect. This is a nasty hack - we store the posted values in
# the session, and when the GET redirect with "?post_redirect=1" happens,
# load them in.
def do_post_redirect(uri, params)
session[:post_redirect_params] = params
# XXX what is the built in Ruby URI munging function that can do this
# choice of & vs. ? more elegantly than this dumb if statement?
if uri.include?("?")
uri += "&post_redirect=1"
else
uri += "?post_redirect=1"
end
redirect_to uri
end
# If we are in a faked redirect to POST request, then set post params.
before_filter :check_in_post_redirect
def check_in_post_redirect
if params[:post_redirect] and session[:post_redirect_params]
params.update(session[:post_redirect_params])
end
end
# Default layout shows user in corner, so needs access to it
before_filter :authentication_check
def authentication_check
if session[:user_id]
@user = authenticated_user
end
end
# For administration interface, return display name of authenticated user
def admin_http_auth_user
if not request.env["REMOTE_USER"]
return "*unknown*";
else
return request.env["REMOTE_USER"]
end
end
# URL generating functions are needed by all controllers (for redirects)
# and views (for links), so include them into all of both.
include LinkToHelper
end
|
