Class: Plugins::VisibilityPost::FrontController

Inherits:
CamaleonCms::Apps::PluginsFrontController show all
Defined in:
app/apps/plugins/visibility_post/front_controller.rb

Constant Summary

Constants included from CamaleonCms::FrontendVisitedStateConcern

CamaleonCms::FrontendVisitedStateConcern::LEGACY_VISITED_IVAR_BY_ATTR

Instance Method Summary collapse

Methods inherited from CamaleonCms::FrontendController

#ajax, #category, #index, #post, #post_tag, #post_type, #profile, #render_page_not_found, #search

Methods included from CamaleonCms::Frontend::ApplicationHelper

#cama_url_to_fixed, #verify_front_visibility

Methods included from CamaleonCms::Frontend::ContentSelectHelper

#each_category_of, #each_post_of, #process_in_block, #the_comments, #the_content, #the_excerpt, #the_field, #the_post, #the_post_type, #the_posts, #the_slug, #the_thumbnail, #the_title, #the_url

Methods included from CamaleonCms::Frontend::SeoHelper

#cama_seo_settings, #cama_the_seo

Methods included from CamaleonCms::Frontend::NavMenuHelper

#breadcrumb_add, #breadcrumb_draw, #cama_menu_draw_items, #cama_menu_parse_items, #cama_parse_menu_item, #draw_menu, #get_nav_menu

Methods included from CamaleonCms::Frontend::SiteHelper

#is_ajax?, #is_category?, #is_home?, #is_page?, #is_post_tag?, #is_post_type?, #is_profile?, #is_search?, #site_current_path, #site_current_url, #the_head

Methods included from CamaleonCms::FrontendConcern

#robots, #rss, #save_comment, #sitemap

Instance Method Details

#unlock ⇒ Object

Security (audit M2): unlocks a password-protected post for the current session. Replaces the old GET post_password parameter flow, which put the password in URLs, logs and referrers and compared it with ==. The password travels in a POST body, is compared in constant time, and the unlocked state is a session-side marker -- never the password.



8
9
10
11
12
13
14
15
16
17
18
19
20
 
# File 'app/apps/plugins/visibility_post/front_controller.rb', line 8

def unlock
  post = current_site.the_posts.where(id: params[:post_id]).first
  return page_not_found if post.blank? || post.visibility != 'password'

  submitted = params[:post_password].to_s
  if submitted.present? && ActiveSupport::SecurityUtils.secure_compare(submitted, post.visibility_value.to_s)
    session[VisibilityPostHelper::SESSION_UNLOCKED_KEY] =
      Array(session[VisibilityPostHelper::SESSION_UNLOCKED_KEY]) | [post.id]
  else
    flash[:cama_visibility_post_error] = true
  end
  redirect_to post.decorate.the_url(as_path: true)
end