5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
# File 'app/models/caboose/authenticator.rb', line 5
def authenticate(username, password, site = nil, request = nil)
resp = StdClass.new
pass = Digest::SHA1.hexdigest(Caboose::salt + password)
user = nil
if username == 'superadmin'
user = User.where(:username => username).first
else
user = User.where(:username => username, :site_id => site.id).first
user = User.where(:email => username, :site_id => site.id).first if user.nil?
end
ll = LoginLog.new
ll.username = username
ll.date_attempted = DateTime.now.utc
ll.user_id = user.id if user
ll.site_id = user.site_id if user
ll.ip = request.remote_ip if request
valid_credentials = false
if user && user.password == pass
valid_credentials = true
resp.user = user
ll.success = true
elsif user && user.password != pass
fail_count = Caboose::LoginLog.fail_count(user)
if (fail_count+1) >= user.site.login_fail_lock_count
user.locked = true
user.save
LoginMailer.configure_for_site(user.site.id).locked_account(user).deliver
resp.error = "Too many failed login attempts. Your account has been locked and the site administrator has been notified."
ll.success = false
else
attempts_left = user.site.login_fail_lock_count - fail_count - 1
resp.error = "Invalid password. You have #{attempts_left} attempt#{attempts_left == 1 ? '' : 's'} left before your account is locked."
ll.success = false
end
elsif site
mp = Setting.where(:site_id => site.id, :name => 'master_password').first
mp = mp ? mp.value : nil
if mp && mp.strip.length > 0 && mp == pass
resp.user = user
ll.success = true
else
resp.error = "Invalid credentials"
ll.success = false
end
else
resp.error = "Invalid credentials"
ll.success = false
end
ll.save
return resp
end
|