jaculabilis/danbooru
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

sessions: raise exception on failed login attempts.

Browse Source 
* Allow both xml and json authentication in sessions controller.

* Raise an exception if a login attempt fails so that a) we return a
  proper error for json/xml requests and b) failed login attempts get
  reported to NewRelic (for monitoring abuse).
This commit is contained in:
evazion
2019-10-07 22:27:38 -05:00
parent a5ab25d0ba
commit cc4e39b88b
2 changed files with 4 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/application_controller.rb
View File

@@ -51,7 +51,7 @@ class ApplicationController < ActionController::Base
when ActionController::BadRequest when ActionController::BadRequest
render_error_page(400, exception) render_error_page(400, exception)
when SessionLoader::AuthenticationFailure when SessionLoader::AuthenticationFailure
render_error_page(401, exception) render_error_page(401, exception, template: "sessions/new")
when ActionController::InvalidAuthenticityToken, ActionController::UnpermittedParameters, ActionController::InvalidCrossOriginRequest when ActionController::InvalidAuthenticityToken, ActionController::UnpermittedParameters, ActionController::InvalidCrossOriginRequest
render_error_page(403, exception) render_error_page(403, exception)
when User::PrivilegeError when User::PrivilegeError

13
app/controllers/sessions_controller.rb
View File

@@ -1,6 +1,6 @@
class SessionsController < ApplicationController class SessionsController < ApplicationController
respond_to :html, :json respond_to :html, :json
skip_forgery_protection only: :create, if: -> { request.format.json? } skip_forgery_protection only: :create, if: -> { !request.format.html? }
def new def new
@user = User.new @user = User.new
@@ -14,15 +14,8 @@ class SessionsController < ApplicationController
url = posts_path if url.nil? url = posts_path if url.nil?
respond_with(session_creator.user, location: url, methods: [:api_token]) respond_with(session_creator.user, location: url, methods: [:api_token])
else else
respond_with("password was incorrect", location: new_session_path) do |fmt| flash.now[:notice] = "Password was incorrect"
fmt.json do raise SessionLoader::AuthenticationFailure
render json: { error: true, message: "password was incorrect"}.to_json, status: 401
end
fmt.html do
flash[:notice] = "Password was incorrect"
end
end
end end
end end