Changeset 1144

Timestamp:

Nov 16, 2010, 2:57:22 PM (12 years ago)

Author:

robert@…

Message:

Added an expiry date to the confirmation email for the user and administrator. See ticket #189

Location:

trunk

Files:

• grails-app/controllers/dbnp/authentication/UserRegistrationController.groovy (modified) (10 diffs)
• grails-app/domain/dbnp/authentication/RegistrationCode.groovy (modified) (1 diff)
• grails-app/domain/dbnp/authentication/SecUser.groovy (modified) (1 diff)
• grails-app/i18n/messages.spring-security-ui.properties (modified) (2 diffs)
• grails-app/views/common/_login_panel.gsp (modified) (2 diffs)
• grails-app/views/email/_registrationConfirmationUser.gsp (modified) (1 diff)
• grails-app/views/userRegistration/index.gsp (modified) (1 diff)
• web-app/css/login_panel.css (modified) (1 diff)

trunk/grails-app/controllers/dbnp/authentication/UserRegistrationController.groovy

@@ -17 +17 @@
 
 class UserRegistrationController {
+        static int DAYS_BEFORE_EXPIRY = 3;
+        static int DAYS_BEFORE_EXPIRY_ADMIN = 365;
+
     def springSecurityService
         def authenticationService
@@ -30 +33 @@
      * for confirmation
      */
-    def add = {
-        if( !params.username || !params.email ) {
-            flash.message = "You must enter a username and provide an email address"
-            render(view: "index", model: [username: params.username, email: params.email])
-            return
-        }
-
-        // Check whether this username already exists
-        if( SecUser.findByUsername( params.username ) ) {
-            flash.message = "Username already exists"
-            render(view: "index", model: [username: params.username, email: params.email])
-            return
-        }
+    def add = { RegisterCommand command ->
+                
+                command.validate()
+
+                if (command.hasErrors()) {
+                        def addSendUserLink = false;
+
+                        // Check the errors and append a link if needed
+                        command.errors.allErrors.each {
+                                if( it.code == "registerCommand.username.notyetconfirmed" ) {
+                                        addSendUserLink = true;
+                                }
+                        }
+
+                        flash.message = "";
+            render(view: "index", model: [username: params.username, email: params.email, command: command, addSendUserLink: addSendUserLink])
+                        return
+                }
 
         // Generate a random password
@@ -48 +56 @@
 
         def user = new SecUser(
-           username: params.username,
+           username     : params.username,
            email: params.email,
            password: springSecurityService.encodePassword(password, params.username),
@@ -62 +70 @@
         flash.message = ""
 
-        // Create links for the user and administrator to click on. These codes are built from
-        // the username and encrypted password. They do not provide 100% security, since the codes
-        // could be broken, but it is enough for the confirmation step
-        def userCode = ( user.username + user.password + 'user' ).encodeAsMD5();
-        def adminCode = ( user.username + user.password + 'admin' ).encodeAsMD5();
-        def userLink = createLink( controller: 'userRegistration', action: 'confirmUser', params: [id: user.id, code: userCode], absolute: true )
-        def adminLink = createLink( controller: 'userRegistration', action: 'confirmAdmin', params: [id: user.id, code: adminCode], absolute: true )
+                sendUserConfirmationMail( user, password );
+                sendAdminConfirmationMail( user );
+
+        // Give the user a nice welcome page
+    }
+
+        def sendUserConfirmation = {
+                def user = SecUser.findByUsername( params.username );
+                if( !user ) {
+                        flash.message = "No user with this username is found in the database.";
+            render(view: "index", model: [username: params.username])
+                }
+                if( user.userConfirmed ) {
+                        flash.message = "This user has already been confirmed";
+            render(view: "index", model: [username: params.username])
+                }
+
+                // Remove old registration codes
+                RegistrationCode.deleteByUser(user);
+
+                // Create a new password
+        def password = this.generatePassword(8)
+                user.password = springSecurityService.encodePassword(password, user.username)
+
+                // Send a message
+                sendUserConfirmationMail(user, password);
+
+                flash.message = "A new confirmation email has been sent to your registered email address";
+                render(view: "index", model: [username: params.username])
+        }
+
+        private sendUserConfirmationMail( SecUser user, String password ) {
+                def userCode = new RegistrationCode(userId: user.id, expiryDate: new Date() + UserRegistrationController.DAYS_BEFORE_EXPIRY).save( flush: true );
+        def userLink = createLink( controller: 'userRegistration', action: 'confirmUser', params: [code: userCode.token], absolute: true )
 
         // Send an email to the user
         try {
             sendMail {
-                to      params.email
+                to      user.email
                 subject "Registration at GSCF"
-                html    g.render(template:'/email/registrationConfirmationUser', model:[username: user.username, password: password, link: userLink])
+                html    g.render(template:'/email/registrationConfirmationUser', model:[username: user.username, password: password, expiryDate: userCode.expiryDate, link: userLink])
             }
         } catch(Exception e) {
             log.error "Problem sending email $e.message", e
             flash.message = 'Email could not be sent'
-        }
+                        return false
+        }
+
+                return true
+        }
+
+        private sendAdminConfirmationMail( SecUser user ) {
+                def adminCode = new RegistrationCode(userId: user.id, expiryDate: new Date() + UserRegistrationController.DAYS_BEFORE_EXPIRY_ADMIN).save(flush: true)
+        def adminLink = createLink( controller: 'userRegistration', action: 'confirmAdmin', params: [code: adminCode.token], absolute: true )
 
         // Send an email to the administrators
         try {
+                        // Determine administrator email addresses
             sendMail {
                 to      "gscfproject@gmail.com"
@@ -92 +136 @@
             log.error "Problem sending email $e.message", e
             flash.message = "Email could not be sent to administrators"
-        }
-
-        // Give the user a nice welcome page
-        [username: user.username, password: password]
-    }
+                        return false
+        }
+                return true
+        }
+
 
     def confirmUser = {
-        def code = params.code
-        def id = params.id
-
-        def user = SecUser.findById(id)
-
-        def generatedCode = ( user.username + user.password + "user" ).encodeAsMD5()
-        if( !user || code != generatedCode ) {
+        def token = params.code
+
+                def registrationCode = token ? RegistrationCode.findByToken(token) : null
+                if (!registrationCode) {
             flash.message = "No user found with given parameters. Please make sure you have copied the URL correctly."
             return
-        }
+                }
+
+                if (registrationCode.expiryDate.before(new Date())) {
+            flash.message = "Your registration should have been confirmed within " + UserRegistrationController.DAYS_BEFORE_EXPIRY + " days. This confirmation link has expired. Please register again."
+            return
+                }
+
+                def user = SecUser.findById(registrationCode.userId)
 
         if( user.userConfirmed ) {
@@ -117 +165 @@
         user.userConfirmed = true
         user.save(flush: true)
+
+                // Remove the registrationCode
+                registrationCode.delete();
 
         if( user.adminConfirmed ) {
@@ -127 +178 @@
     @Secured(['ROLE_ADMIN', 'IS_AUTHENTICATED_FULLY'])
     def confirmAdmin = {
-        def code = params.code
-        def id = params.id
-
-        def user = SecUser.findById(id)
-
-        def generatedCode = ( user.username + user.password + "admin" ).encodeAsMD5();
-        if( !user || code != generatedCode ) {
+
+        def token = params.code
+
+                def registrationCode = token ? RegistrationCode.findByToken(token) : null
+                if (!registrationCode) {
             flash.message = "No user found with specified code. Please make sure you have copied the URL correctly."
-            return;
-        }
+            return
+                }
+
+                if (registrationCode.expiryDate.before(new Date())) {
+            flash.message = "You should have approved this registration within " + UserRegistrationController.DAYS_BEFORE_EXPIRY_ADMIN + " days. This confirmation link has expired."
+            return
+                }
+
+                def user = SecUser.findById(registrationCode.userId)
 
         if( user.adminConfirmed ) {
@@ -145 +201 @@
         user.adminConfirmed = true
         user.save(flush: true)
+
+                // Remove the registrationCode
+                registrationCode.delete();
 
         flash.message = "The registration of " + user.username + " is approved."
@@ -213 +272 @@
                 }
         }
+
+        static final usernameValidator = { value, command ->
+                def user = SecUser.findByUsername( command.username );
+                if( user ) {
+            if( user.enabled ) {
+                                return "registerCommand.username.unique"
+                        } else if( user.dateCreated.after( new Date() - DAYS_BEFORE_EXPIRY ) ) {
+                                return "registerCommand.username.notyetconfirmed"
+                        } else {
+                                RegistrationCode.deleteByUser(user);
+                                user.delete(flush:true);
+                        }
+        }
+        }
+
 }
 
@@ -231 +305 @@
 }
 
+class RegisterCommand {
+
+        String username
+        String email
+
+        static constraints = {
+                email(blank: false, email: true)
+                username(blank: false, validator: UserRegistrationController.usernameValidator)
+        }
+}

trunk/grails-app/domain/dbnp/authentication/RegistrationCode.groovy

@@ -19 +19 @@
  */
 class RegistrationCode {
-
-        String username
+        int userId
         String token = UUID.randomUUID().toString().replaceAll('-', '')
         Date dateCreated
+        Date expiryDate
 
         static mapping = {
                 version false
         }
+
+        public static boolean deleteByUser( SecUser user ) {
+                RegistrationCode.findByUserId(user.id)*.delete();
+                return true;
+        }
 }

trunk/grails-app/domain/dbnp/authentication/SecUser.groovy

@@ -6 +6 @@
         String password
         String email
+        Date dateCreated
         boolean enabled
         boolean accountExpired

trunk/grails-app/i18n/messages.spring-security-ui.properties

@@ -80 +80 @@
 
 registerCommand.username.blank Username is required
-registerCommand.username.unique The username is taken
+registerCommand.username.unique The username already exists
 registerCommand.email.blank Email is required
 registerCommand.email.email.invalid Please provide a valid email address
@@ -97 +97 @@
 profileCommand.password.maxSize.exceeded Password must be between 8 and 64 characters
 profileCommand.email.email.invalid Please provide a valid email address
+
+registerCommand.username.unique The username already exists
+registerCommand.username.notyetconfirmed This account already exists but has not yet been confirmed. If you are the owner, please check your email.
+registerCommand.email.email.invalid Please provide a valid email address
+registerCommand.email.blank Please provide a valid email address

trunk/grails-app/views/common/_login_panel.gsp

@@ -29 +29 @@
                         </div>
                         <div class="left right">
-                          <g:form url="[action:'add',controller:'userRegistration']" class="clearfix">
+                    <g:form url="[action:'add',controller:'userRegistration']" class="clearfix registration">
                                         <input type="hidden" name="targetUri" value="${targetUri}" />
                                         <h1>Not a member yet? Sign Up!</h1>
+                                          <g:hasErrors bean="${command}">
+                                                  <g:renderErrors bean="${command}" as="list" />
+                                                  <g:if test="${addSendUserLink}">
+                                                                <a class="resend_confirmation" href="<g:createLink url="[action:'sendUserConfirmation',controller:'userRegistration', params: [username: username]]" />">Resend confirmation message</a><br />
+                                                  </g:if>
+                                          </g:hasErrors>
+
                                         <label class="grey" for="signup">Username:</label>
                                         <input class="field" type="text" name="username" id="username" value="${username}" size="23" />
@@ -47 +54 @@
                         <li class="left">&nbsp;</li>
                         <li>Hello <sec:ifLoggedIn><sec:username/></sec:ifLoggedIn>
-                        <sec:ifNotLoggedIn>Guest</sec:ifNotLoggedIn>!</li>
+                                <sec:ifNotLoggedIn>Guest</sec:ifNotLoggedIn>!</li>
                         <sec:ifLoggedIn>
                         <li class="sep">|</li>

trunk/grails-app/views/email/_registrationConfirmationUser.gsp

@@ -16 +16 @@
       <p>If you can not click the link, copy this url to the browser:</p>
       <p>${link}</p>
+
+      <p>You should confirm your account before <g:formatDate format="dd-MM-yyyy hh:mm" date="${expiryDate}" />, otherwise your account will not be created.</p>
+
       <p>After you have confirmed your registration and the administrator has approved your account, you can login. Your password is:</p>
       <p><b>${password}</b></p>

trunk/grails-app/views/userRegistration/index.gsp

@@ -48 +48 @@
     </head>
     <body>
+
         <div class="body" id="register">
-          <div class="inner">
-            <g:if test="${flash.message}"> <div class='login_message'>${flash.message}</div></g:if>
+                <div class='inner' style="margin-top: 160px;">
 
-              <div class='fheader'>Please enter username and email address. </div>
-              <form action='/gscf/userRegistration/add' method='POST' id='loginForm' class='cssform' autocomplete='off'>
-                      <p>
-                              <label for='username'>Username</label>
-                              <g:textField name="username" value="${username}" />
-                      </p>
-                      <p>
-                              <label for='password'>Email address</label>
-                              <g:textField name="email" value="${email}" />
-                      </p>
-                      <p>
-                              <input type='submit' value='Register' />
-                      </p>
-              </form>
-          </div>
-        </div>
-  </body>
+                        <!-- Registration in is handled in the login panel -->
+                        <!-- That's why the registration form is removed here, and the data is moved down -->
+
+                          <div class='fheader'>Please resolve the errors and try again..</div>
+
+                </div>
+        </div>
+        <script type='text/javascript'>
+        <!--
+        (function(){
+                // Open login panel
+                $("div#panel").slideDown("slow");
+                $("#toggle a").toggle();
+
+        })();
+        // -->
+        </script>
+</body>
 </html>

trunk/web-app/css/login_panel.css

@@ -242 +242 @@
 }
 
+.registration ul { list-style-type: none; margin-left: 0; padding-left: 0; }
+.registration ul li { margin: 3px 0; }