From 848777481dccfc611f20ad246cd1715a5ee60551 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20B=C3=B6hm?= Date: Tue, 17 Sep 2024 12:42:59 +0200 Subject: [PATCH] Only users with verified emails are allowed to create new jobs --- app/controllers/application_controller.rb | 10 ++++++++++ .../identity/email_verifications_controller.rb | 2 ++ app/controllers/identity/emails_controller.rb | 3 +++ .../identity/password_resets_controller.rb | 1 + app/controllers/jobs_controller.rb | 1 + app/controllers/passwords_controller.rb | 1 + app/controllers/profiles_controller.rb | 1 + app/controllers/sessions_controller.rb | 1 + app/policies/application_policy.rb | 7 ++++++- app/views/profiles/show.html.erb | 11 +++++++++++ 10 files changed, 37 insertions(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 500a7cd..cce9a78 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base before_action :set_current_request_details before_action :authenticate_user! + before_action :verified_user! verify_authorized @@ -29,6 +30,15 @@ class ApplicationController < ActionController::Base end end + def verified_user! + if user_signed_in? + unless current_user.verified? + flash[:notice] = "Please verify your email!" + redirect_to profile_path + end + end + end + def set_current_request_details Current.user_agent = request.user_agent Current.ip_address = request.ip diff --git a/app/controllers/identity/email_verifications_controller.rb b/app/controllers/identity/email_verifications_controller.rb index c2ce605..a3462c4 100644 --- a/app/controllers/identity/email_verifications_controller.rb +++ b/app/controllers/identity/email_verifications_controller.rb @@ -1,5 +1,7 @@ class Identity::EmailVerificationsController < ApplicationController skip_before_action :authenticate_user!, only: :show + skip_before_action :verified_user! + skip_verify_authorized before_action :set_user, only: :show diff --git a/app/controllers/identity/emails_controller.rb b/app/controllers/identity/emails_controller.rb index 407e388..4e8c563 100644 --- a/app/controllers/identity/emails_controller.rb +++ b/app/controllers/identity/emails_controller.rb @@ -1,4 +1,7 @@ class Identity::EmailsController < ApplicationController + skip_before_action :verified_user! + skip_verify_authorized + before_action :set_user def edit diff --git a/app/controllers/identity/password_resets_controller.rb b/app/controllers/identity/password_resets_controller.rb index 23ad9dc..e497a76 100644 --- a/app/controllers/identity/password_resets_controller.rb +++ b/app/controllers/identity/password_resets_controller.rb @@ -1,5 +1,6 @@ class Identity::PasswordResetsController < ApplicationController skip_before_action :authenticate_user! + skip_verify_authorized before_action :set_user, only: %i[ edit update ] diff --git a/app/controllers/jobs_controller.rb b/app/controllers/jobs_controller.rb index eefaff2..f000260 100644 --- a/app/controllers/jobs_controller.rb +++ b/app/controllers/jobs_controller.rb @@ -1,5 +1,6 @@ class JobsController < ApplicationController skip_before_action :authenticate_user!, only: [ :index, :cancel_button ] + skip_before_action :verified_user!, only: [ :index ] skip_verify_authorized only: [ :index, :new, :create, :cancel_button ] # GET /jobs or /jobs.json diff --git a/app/controllers/passwords_controller.rb b/app/controllers/passwords_controller.rb index d9caf5f..8159182 100644 --- a/app/controllers/passwords_controller.rb +++ b/app/controllers/passwords_controller.rb @@ -1,5 +1,6 @@ class PasswordsController < ApplicationController skip_verify_authorized only: [ :edit, :update ] + skip_before_action :verified_user! before_action :set_user def edit diff --git a/app/controllers/profiles_controller.rb b/app/controllers/profiles_controller.rb index 6bca1f0..d569e85 100644 --- a/app/controllers/profiles_controller.rb +++ b/app/controllers/profiles_controller.rb @@ -1,5 +1,6 @@ class ProfilesController < ApplicationController skip_verify_authorized only: [ :show, :edit, :destroy ] + skip_before_action :verified_user! def show end diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index 0ca4fae..8fa6423 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -1,5 +1,6 @@ class SessionsController < ApplicationController skip_before_action :authenticate_user!, only: %i[ new create ] + skip_before_action :verified_user! skip_verify_authorized only: [ :index, :new, :create, :destroy ] before_action :set_session, only: :destroy diff --git a/app/policies/application_policy.rb b/app/policies/application_policy.rb index 8317d54..216b0f0 100644 --- a/app/policies/application_policy.rb +++ b/app/policies/application_policy.rb @@ -1,12 +1,17 @@ # Base class for application policies class ApplicationPolicy < ActionPolicy::Base - pre_check :allow_admins + pre_check :allow_admins, :only_verified_users # admin is good! :) def allow_admins allow! if user.admin? end + # no email verification no rights + def only_verified_users + deny! unless user.verified? + end + # Configure additional authorization contexts here # (`user` is added by default). # diff --git a/app/views/profiles/show.html.erb b/app/views/profiles/show.html.erb index 946c138..432fb09 100644 --- a/app/views/profiles/show.html.erb +++ b/app/views/profiles/show.html.erb @@ -7,6 +7,17 @@ <% end %>
  • E-Mail: <%= current_user.email %>
    • + <% if current_user.verified? %> +

    + E-Mail is verified +

    + <% else %> +

    +

    + Please validate your E-mail-adress (<%= button_to 'Re-send verification email', identity_email_verification_path, form_class: "inline" %>) +
    +

    + <% end %>

    Aufgegebene Druckaufträge