diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 7590751..56ad260 100755
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -9,7 +9,10 @@ class ApplicationController < ActionController::Base
private
def current_user
- @current_user ||= User.find_by_user_id(session[:user_id].to_s)
+ @current_user ||= (
+ User.find_by_auth_token(cookies[:auth_token].to_s) ||
+ User.find_by_user_id(session[:user_id].to_s)
+ )
end
def authenticated
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 3f84173..a13bbc7 100755
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -8,7 +8,6 @@ class SessionsController < ApplicationController
redirect_to home_dashboard_index_path if current_user
end
-
def create
path = params[:url].present? ? params[:url] : home_dashboard_index_path
begin
@@ -19,7 +18,11 @@ class SessionsController < ApplicationController
end
if user
- session[:user_id] = user.user_id if User.where(:user_id => user.user_id).exists?
+ if params[:remember_me]
+ cookies.permanent[:auth_token] = user.auth_token if User.where(:user_id => user.user_id).exists?
+ else
+ session[:user_id] = user.user_id if User.where(:user_id => user.user_id).exists?
+ end
redirect_to path
else
# Removed this code, just doesn't seem specific enough!
@@ -30,6 +33,7 @@ class SessionsController < ApplicationController
end
def destroy
+ cookies.delete(:auth_token)
reset_session
redirect_to root_path
end
diff --git a/app/models/key_management.rb b/app/models/key_management.rb
index 80bf527..174b80c 100644
--- a/app/models/key_management.rb
+++ b/app/models/key_management.rb
@@ -1,5 +1,6 @@
class KeyManagement < ActiveRecord::Base
attr_accessible :iv, :user_id
belongs_to :work_info
+ belongs_to :user
end
diff --git a/app/models/user.rb b/app/models/user.rb
index 7705a10..05eb101 100755
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,4 +1,7 @@
+require 'encryption'
+
class User < ActiveRecord::Base
+
attr_accessible :email, :admin, :first_name, :last_name, :user_id, :password, :password_confirmation
validates :password, :presence => true,
:confirmation => true,
@@ -23,7 +26,7 @@ class User < ActiveRecord::Base
has_one :work_info, :foreign_key => :user_id, :primary_key => :user_id, :dependent => :destroy
has_many :performance, :foreign_key => :user_id, :primary_key => :user_id, :dependent => :destroy
has_many :messages, :foreign_key => :receiver_id, :primary_key => :user_id, :dependent => :destroy
-
+ before_create { generate_token(:auth_token) }
def build_benefits_data
build_retirement(POPULATE_RETIREMENTS.shuffle.first)
@@ -71,8 +74,6 @@ private
end
=end
-
-
def assign_user_id
unless @skip_user_id_assign.present? || self.user_id.present?
user = User.order("user_id").last
@@ -88,5 +89,11 @@ private
end
end
end
+
+ def generate_token(column)
+ begin
+ self[column] = Encryption.encrypt_sensitive_value(self.user_id)
+ end while User.exists?(column => self[column])
+ end
end
diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index f559a6e..816e2c3 100755
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -20,11 +20,17 @@
-
- <%= link_to "Forgot Password", forgot_password_path, {:class=>"pull-left"}%>
-
- <%= submit_tag "Login", {:class => "btn btn-info btn-large pull-right"} %>
-
+
+ <%= link_to "Forgot Password", forgot_password_path, {:class=>"pull-left"}%>
+ <%= submit_tag "Login", {:class => "btn btn-info btn-large pull-right"} %>
+
+ <%= check_box_tag :remember_me, 1, params[:remember_me], {:id => "form-terms", :class => "checkbox", :type => "checkbox"} %>
+ Remember
+
+
+
+
+
<% end %>
diff --git a/config/initializers/constants.rb b/config/initializers/constants.rb
index 7fdcd8f..086522f 100644
--- a/config/initializers/constants.rb
+++ b/config/initializers/constants.rb
@@ -1 +1,3 @@
-ACCESS_TOKEN_SALT = "S4828341189aefiasd#ASDF"
\ No newline at end of file
+ACCESS_TOKEN_SALT = "S4828341189aefiasd#ASDF"
+
+RG_IV = "PPKLKAJDKGHALDJL482823458028"
\ No newline at end of file
diff --git a/config/initializers/key.rb b/config/initializers/key.rb
index 5f43875..89022ee 100644
--- a/config/initializers/key.rb
+++ b/config/initializers/key.rb
@@ -1,5 +1,5 @@
if Rails.env.production?
# Specify env variable/location/etc. to retrieve key from
-elsif Rails.env.development?
+else
KEY = "123456789101112123456789101112123456789101112"
-end
\ No newline at end of file
+end
diff --git a/db/migrate/20140312002642_add_auth_token_to_users.rb b/db/migrate/20140312002642_add_auth_token_to_users.rb
new file mode 100644
index 0000000..2c83ac1
--- /dev/null
+++ b/db/migrate/20140312002642_add_auth_token_to_users.rb
@@ -0,0 +1,5 @@
+class AddAuthTokenToUsers < ActiveRecord::Migration
+ def change
+ add_column :users, :auth_token, :string
+ end
+end
diff --git a/db/schema.rb b/db/schema.rb
index b7ded3a..2ec1d36 100755
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -11,7 +11,7 @@
#
# It's strongly recommended to check this file into your version control system.
-ActiveRecord::Schema.define(:version => 20131113200708) do
+ActiveRecord::Schema.define(:version => 20140312002642) do
create_table "benefits", :force => true do |t|
t.datetime "created_at", :null => false
@@ -83,6 +83,7 @@ ActiveRecord::Schema.define(:version => 20131113200708) do
t.integer "user_id"
t.datetime "created_at", :null => false
t.datetime "updated_at", :null => false
+ t.string "auth_token"
end
create_table "work_infos", :force => true do |t|
diff --git a/lib/encryption.rb b/lib/encryption.rb
new file mode 100644
index 0000000..defa525
--- /dev/null
+++ b/lib/encryption.rb
@@ -0,0 +1,36 @@
+module Encryption
+
+ # Added a re-usable encryption routine, shouldn't be an issue!
+ def self.encrypt_sensitive_value(val="")
+ aes = OpenSSL::Cipher::Cipher.new(cipher_type)
+ aes.encrypt
+ aes.key = key
+ aes.iv = iv if iv != nil
+ new_val = aes.update("#{val}") + aes.final
+ Base64.strict_encode64(new_val).encode('utf-8')
+ end
+
+ def self.decrypt_sensitive_value(val="")
+ aes = OpenSSL::Cipher::Cipher.new(cipher_type)
+ aes.decrypt
+ aes.key = key
+ aes.iv = iv if iv != nil
+ decoded = Base64.strict_decode64("#{val}")
+ aes.update("#{decoded}") + aes.final
+ end
+
+ # Should be able to just re-use the same key we already have!
+ def self.key
+ raise "Key Missing" if !(KEY)
+ KEY
+ end
+
+ def self.iv
+ RG_IV
+ end
+
+ def self.cipher_type
+ 'aes-256-cbc'
+ end
+
+end
\ No newline at end of file
diff --git a/spec/controllers/api/v1/users_controller_spec.rb b/spec/controllers/api/v1/users_controller_spec.rb
index 184b048..9b5309e 100644
--- a/spec/controllers/api/v1/users_controller_spec.rb
+++ b/spec/controllers/api/v1/users_controller_spec.rb
@@ -1,5 +1,6 @@
-require 'spec_helper'
+=begin require 'spec_helper'
describe Api::V1::UsersController do
end
+=end
\ No newline at end of file
diff --git a/spec/helpers/api/v1/users_helper_spec.rb b/spec/helpers/api/v1/users_helper_spec.rb
index 13a6067..9619df0 100644
--- a/spec/helpers/api/v1/users_helper_spec.rb
+++ b/spec/helpers/api/v1/users_helper_spec.rb
@@ -1,4 +1,4 @@
-require 'spec_helper'
+=begin require 'spec_helper'
# Specs in this file have access to a helper object that includes
# the Api::V1::UsersHelper. For example:
@@ -13,3 +13,4 @@ require 'spec_helper'
describe Api::V1::UsersHelper do
pending "add some examples to (or delete) #{__FILE__}"
end
+=end
\ No newline at end of file
diff --git a/spec/helpers/password_resets_helper_spec.rb b/spec/helpers/password_resets_helper_spec.rb
index a0df3dd..b87346e 100644
--- a/spec/helpers/password_resets_helper_spec.rb
+++ b/spec/helpers/password_resets_helper_spec.rb
@@ -1,4 +1,4 @@
-require 'spec_helper'
+=begin require 'spec_helper'
# Specs in this file have access to a helper object that includes
# the PasswordResetsHelper. For example:
@@ -13,3 +13,4 @@ require 'spec_helper'
describe PasswordResetsHelper do
pending "add some examples to (or delete) #{__FILE__}"
end
+=end
\ No newline at end of file
diff --git a/spec/views/password_resets/new.html.erb_spec.rb b/spec/views/password_resets/new.html.erb_spec.rb
index 38c6853..fcb6721 100644
--- a/spec/views/password_resets/new.html.erb_spec.rb
+++ b/spec/views/password_resets/new.html.erb_spec.rb
@@ -1,5 +1,6 @@
-require 'spec_helper'
+=begin require 'spec_helper'
describe "password_resets/new.html.erb" do
pending "add some examples to (or delete) #{__FILE__}"
end
+=end
\ No newline at end of file