fix security issue

[selectricity] / app / controllers / account_controller.rb

diff --git a/app/controllers/account_controller.rb b/app/controllers/account_controller.rb
index bb614dec3cc0d93f0aef84d82f0bc4c37c4d0f06..4b7fea9fc17451bdb11fde5be136ee7b022ccd1c 100644 (file)
--- a/app/controllers/account_controller.rb
+++ b/app/controllers/account_controller.rb
@@ -1,3 +1,10 @@
+# Selectricity: Voting Machinery for the Masses
+# Copyright (C) 2007, 2008 Benjamin Mako Hill <mako@atdot.cc>
+# Copyright (C) 2007 Massachusetts Institute of Technology
+#
+# This program is free software. Please see the COPYING file for
+# details.
+

 class AccountController < ApplicationController
   layout 'main'
   
 class AccountController < ApplicationController
   layout 'main'
   


@@ -10,8 +17,11 @@ class AccountController < ApplicationController
   def index
     redirect_to(:action => 'signup') unless logged_in? || User.count > 0
   end
   def index
     redirect_to(:action => 'signup') unless logged_in? || User.count > 0
   end

-
+  
+  #these methods provide basic functionality for the user login system
+  #===================================================================

   def login
   def login

+    

     return unless request.post?
     self.current_user = User.authenticate(params[:login], params[:password])
     if logged_in?
     return unless request.post?
     self.current_user = User.authenticate(params[:login], params[:password])
     if logged_in?


@@ -19,17 +29,21 @@ class AccountController < ApplicationController
         self.current_user.remember_me
         cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at }
       end
         self.current_user.remember_me
         cookies[:auth_token] = { :value => self.current_user.remember_token , :expires => self.current_user.remember_token_expires_at }
       end

-      redirect_back_or_default(:controller => '/site', :action => 'index')
+      redirect_back_or_default :controller => 'front'

       flash[:notice] = "Logged in successfully"
     end
   end
       flash[:notice] = "Logged in successfully"
     end
   end

+  
+  def forgot_password
+    raise "Not Implemented!"
+  end

 
   def signup
     @user = User.new(params[:user])
     return unless request.post?
     @user.save!
     self.current_user = @user
 
   def signup
     @user = User.new(params[:user])
     return unless request.post?
     @user.save!
     self.current_user = @user

-    redirect_back_or_default(:controller => '/site', :action => 'index')
+    redirect_back_or_default :controller => 'front'

     flash[:notice] = "Thanks for signing up!"
   rescue ActiveRecord::RecordInvalid
     render :action => 'signup'
     flash[:notice] = "Thanks for signing up!"
   rescue ActiveRecord::RecordInvalid
     render :action => 'signup'


@@ -40,6 +54,35 @@ class AccountController < ApplicationController
     cookies.delete :auth_token
     reset_session
     flash[:notice] = "You have been logged out."
     cookies.delete :auth_token
     reset_session
     flash[:notice] = "You have been logged out."

-    redirect_back_or_default(:controller => '/site', :action => 'index')
+    redirect_back_or_default :controller => 'front'
+  end
+  #======================================================================
+  
+  #The following methods are for selectricity specific uses
+  def summary
+    #@user = User.find(params[:id])
+    
+    #constrain the find command such that it only returns the user if it's the currently
+    #logged in user, otherwise, redirect to the front page
+    id = params[:id]
+    user_id = session[:user][:id]
+    @user = User.find(id, :conditions => ["id = ?", user_id])
+    
+    rescue
+      redirect_to :controller =>'front'
+    

   end
   end

+  
+  def change_contact
+    @user = User.find(params[:id])
+    return unless request.post?
+    @user.email=params[:email]
+    @user.save!
+    flash[:notice] = "Email successfully updated"
+    render :action => 'summary'
+  end
+  
+  

 end
 end

+
+