Sfoglia il codice sorgente

Make get_user_session break properly

This change will intentionally throw a RecordNotFound-error to prevent a
nil-error later on. The intended behaviour is to log the user out and
redirect to login, but this is currently impossible because helpers
can't redirect in all cases.

The authentication helpers should probably be moved to a concern, but I
can't be bothered enough, so it remains fixme.
Maarten van den Berg 8 anni fa
parent
commit
f3e71a35d2
1 ha cambiato i file con 9 aggiunte e 3 eliminazioni
  1. 9 3
      app/helpers/authentication_helper.rb

+ 9 - 3
app/helpers/authentication_helper.rb

@@ -38,7 +38,7 @@ module AuthenticationHelper
38 38
 
39 39
   # Determine whether the user is logged in, and if so, disable the Session, then flush session cookies.
40 40
   def log_out
41
-    if is_logged_in?
41
+    if is_logged_in? and @user_session
42 42
       get_user_session
43 43
 
44 44
       @user_session.update!(active: false)
@@ -91,10 +91,16 @@ module AuthenticationHelper
91 91
     if @user_session
92 92
       @user_session
93 93
     else
94
-      @user_session ||= Session.find_by(
95
-        id: cookies.signed.permanent[:session_id]
94
+      @user_session ||= Session.find(
95
+        cookies.signed.permanent[:session_id]
96 96
       )
97 97
     end
98
+
99
+    # Edge case if a session no longer exists in the database
100
+    if not @user_session
101
+      log_out
102
+      redirect_to login_path # FIXME!
103
+    end
98 104
   end
99 105
 
100 106
   def current_user