320ff01e07
Remove the "Remember" checkbox from the login page. Make session cookies permanent instead. Phase out legacy `user_name` and `password_hash` cookies. Previously a user's session cookies would be cleared whenever they closed their browser window, which would log them out of the site. To work around this, when the "Remember" box was checked on the login page (which it was by default), the user's name and password hash (!) would be stored in separate permanent cookies, which would be used to automatically log the user back in when their session cookies were cleared. We can avoid all of this just by making the session cookies themselves permanent.
24 lines
487 B
Ruby
24 lines
487 B
Ruby
class SessionCreator
|
|
attr_reader :session, :name, :password, :ip_addr
|
|
attr_reader :user
|
|
|
|
def initialize(session, name, password, ip_addr)
|
|
@session = session
|
|
@name = name
|
|
@password = password
|
|
@ip_addr = ip_addr
|
|
end
|
|
|
|
def authenticate
|
|
if User.authenticate(name, password)
|
|
@user = User.find_by_name(name)
|
|
|
|
session[:user_id] = @user.id
|
|
@user.update_column(:last_ip_addr, ip_addr)
|
|
return true
|
|
else
|
|
return false
|
|
end
|
|
end
|
|
end
|