From c87011ff8484435fde115d08ea1a6e3efbf8d077 Mon Sep 17 00:00:00 2001 From: Christoph Haas Date: Sun, 14 Jun 2015 12:33:18 +0200 Subject: [PATCH] Session token/IP based user authentication added --- app/controllers/application_controller.rb | 1 + app/controllers/packages_controller.rb | 12 ++++++++---- app/views/packages/details.slim | 2 ++ 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 64acd72..10b8733 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -9,6 +9,7 @@ class ApplicationController < ActionController::Base # and show them even before moderation. def create_user_token session[:token] ||= SecureRandom.hex + session[:ip] ||= request.remote_ip end end diff --git a/app/controllers/packages_controller.rb b/app/controllers/packages_controller.rb index 738d23d..f8eebd4 100644 --- a/app/controllers/packages_controller.rb +++ b/app/controllers/packages_controller.rb @@ -24,6 +24,8 @@ class PackagesController < ApplicationController @package = Package.find_by(name: params[:name]) end + # POST target of the screenshots upload form. + # Checks upload images and creates a new Screenshot record for it. def upload_image @package = Package.find_by(name: params[:name]) @@ -33,13 +35,15 @@ class PackagesController < ApplicationController new_screenshot = @package.screenshots.new(image: img) # Check if the image was valid - unless new_screenshot.valid? - errors = new_screenshot.errors[:image].join(' and ') - flash['alert'] = "Sorry - the image #{errors}" - else + if new_screenshot.valid? + new_screenshot.uploaderhash = session[:token] + new_screenshot.uploaderip = session[:ip] new_screenshot.save successful_upload_count += 1 Log.log "Screenshot #{new_screenshot.id} uploaded successfully." + else + errors = new_screenshot.errors[:image].join(' and ') + flash['alert'] = "Sorry - the image #{errors}" end if successful_upload_count > 0 diff --git a/app/views/packages/details.slim b/app/views/packages/details.slim index c773bbc..3f13948 100644 --- a/app/views/packages/details.slim +++ b/app/views/packages/details.slim @@ -11,6 +11,8 @@ a.black.fancybox href=screenshot.image.url(:large, timestamp: false) rel='fancybox-thumb' title=screenshot.caption = image_tag(screenshot.image.url(:large, timestamp: false), alt: screenshot.caption) .imgcaption =screenshot.caption + // TODO: Show information only if admin + p Uploader IP=#{screenshot.uploaderip} / Token=#{screenshot.uploaderhash} // TODO: Enable button only if admin or uploader a.button.tiny.alert[ href=delete_screenshot_path(@package.name, screenshot.id)