Commit 02d95abe authored by Nihad Abbasov's avatar Nihad Abbasov
Browse files

allow login via private token only for atom feeds

parent 4a1ade6c2648
class ApplicationController < ActionController::Base
before_filter :authenticate_user!
before_filter :reject_blocked!
before_filter :set_current_user_for_mailer
before_filter :set_current_user_for_mailer, :check_token_auth
protect_from_forgery
helper_method :abilities, :can?
......@@ -17,5 +17,12 @@
protected
def check_token_auth
# Redirect to login page if not atom feed
if params[:private_token].present? && params[:format] != 'atom'
redirect_to new_user_session_path
end
end
def reject_blocked!
if current_user && current_user.blocked
......@@ -20,6 +27,6 @@
def reject_blocked!
if current_user && current_user.blocked
sign_out current_user
sign_out current_user
flash[:alert] = "Your account was blocked"
redirect_to new_user_session_path
end
......
......@@ -28,6 +28,13 @@
visit projects_path(:atom, :private_token => @user.private_token)
page.body.should have_selector("feed title")
end
it "should not render projects page via private token" do
logout
visit projects_path(:private_token => @user.private_token)
current_path.should == new_user_session_path
end
end
describe "GET /projects/new" do
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment