<commit_before>class LoginController < ApplicationController
  include CountryStateDistrict
  skip_before_filter :authenticate, :authorize, :verify_authenticity_token

  #There is a potential for csrf attacks for logout which would be annoying for the user, but not really harmful
  #same for login, but there really would be no reason to trick a user into logging in as someone else.   The tradeoff here is for usability
  #There are often errors from a logout form that get invalidated by a server restart showing an error to the user.   This should eliminate those errors
  layout 'main'
  def login
    dropdowns
    @user=User.new(:username=>params[:username])
    session[:user_id] = nil
    
    if request.post? and current_district
      @user=current_district.users.authenticate(params[:username], params[:password]) || @user
      session[:user_id] = @user.id
      if @user.new_record?
        logger.info "Failed login of #{params[:username]} at #{current_district.name}"
        current_district.logs.create(:body => "Failed login of #{params[:username]}")
        if @user.token
          flash[:notice] = 'An email has been sent, follow the link to change your password.'
        else
          flash[:notice] = 'Authentication Failure'
        end
      else
        current_district.logs.create(:body => "Successful login of #{@user.fullname}")
        logger.info "Successful login of #{@user.fullname} at #{current_district.name}"
        session[:district_id]=current_district.id
        flash[:notice] = nil if flash[:notice] == 'Authentication Failure'
        redirect_to successful_login_destination and return
      end
    end

  end

  def logout
    oldflash = flash[:notice]
    reset_session_and_district
    dropdowns
    render :action=>:login #the redirect wasn't properly clearing the cookie via the reset_session
  end

  def index
    login
    render :action=>"login"
  end

  def choose_state
    @state=State.find(params[:state][:id])
    if request.subdomains.last.to_s.match(SUBDOMAIN_MATCH) && @state
     state_and_country=[@state.abbrev]

      redirect_to "#{request.protocol}#{state_and_country.join(".")}.#{request.host_with_port}" and return
    end
    @user=User.new
    dropdowns
    render :action => "login"
  end

  def change_password
    reset_session_and_district if params['token'].present?
    @user = current_user

    if @user.new_record? 
      id=params[:id] || (params[:user] && params[:user][:id])
      token = params['token'] || (params[:user] && params['user'][:token])
      @user =  User.find(id, :conditions => ["(passwordhash ='' or passwordhash is null) and salt ='' and token = ?",token]) #and email_token
      redirect_to logout if @user.blank?
    end

    if request.put?
      if @user.change_password(params['user'])
        flash[:notice] = 'Your password has been changed'
        redirect_to root_url<commit_msg>fix change password for users with null salt<commit_after>class LoginController < ApplicationController
  include CountryStateDistrict
  skip_before_filter :authenticate, :authorize, :verify_authenticity_token

  #There is a potential for csrf attacks for logout which would be annoying for the user, but not really harmful
  #same for login, but there really would be no reason to trick a user into logging in as someone else.   The tradeoff here is for usability
  #There are often errors from a logout form that get invalidated by a server restart showing an error to the user.   This should eliminate those errors
  layout 'main'
  def login
    dropdowns
    @user=User.new(:username=>params[:username])
    session[:user_id] = nil
    
    if request.post? and current_district
      @user=current_district.users.authenticate(params[:username], params[:password]) || @user
      session[:user_id] = @user.id
      if @user.new_record?
        logger.info "Failed login of #{params[:username]} at #{current_district.name}"
        current_district.logs.create(:body => "Failed login of #{params[:username]}")
        if @user.token
          flash[:notice] = 'An email has been sent, follow the link to change your password.'
        else
          flash[:notice] = 'Authentication Failure'
        end
      else
        current_district.logs.create(:body => "Successful login of #{@user.fullname}")
        logger.info "Successful login of #{@user.fullname} at #{current_district.name}"
        session[:district_id]=current_district.id
        flash[:notice] = nil if flash[:notice] == 'Authentication Failure'
        redirect_to successful_login_destination and return
      end
    end

  end

  def logout
    oldflash = flash[:notice]
    reset_session_and_district
    dropdowns
    render :action=>:login #the redirect wasn't properly clearing the cookie via the reset_session
  end

  def index
    login
    render :action=>"login"
  end

  def choose_state
    @state=State.find(params[:state][:id])
    if request.subdomains.last.to_s.match(SUBDOMAIN_MATCH) && @state
     state_and_country=[@state.abbrev]

      redirect_to "#{request.protocol}#{state_and_country.join(".")}.#{request.host_with_port}" and return
    end
    @user=User.new
    dropdowns
    render :action => "login"
  end

  def change_password
    reset_session_and_district if params['token'].present?
    @user = current_user

    if @user.new_record? 
      id=params[:id] || (params[:user] && params[:user][:id])
      token = params['token'] || (params[:user] && params['user'][:token])
      @user =  User.find(id, :conditions => ["(passwordhash ='' or passwordhash is null) and (salt ='' or salt is null) and token = ?",token]) #and email_token
      redirect_to logout if @user.blank?
    end

    if request.put?
      if @user.change_password(params['user'])
        flash[:notice] = 'Your password has been changed'
        redirect_to root_url
{'fraction_non_alphanumeric': 0.1061462078411231, 'fraction_numerical': 0.0, 'mean_word_length': 3.5357142857142856, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 17, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '109736', 'n_tokens_mistral': 1695, 'n_tokens_neox': 1637, 'n_words': 510}