1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
|
# frozen_string_literal: true
# == VerifiesWithEmail
#
# Controller concern to handle verification by email
module VerifiesWithEmail
extend ActiveSupport::Concern
include ActionView::Helpers::DateHelper
TOKEN_LENGTH = 6
TOKEN_VALID_FOR_MINUTES = 60
included do
prepend_before_action :verify_with_email, only: :create, unless: -> { two_factor_enabled? }
end
def verify_with_email
return unless user = find_user || find_verification_user
if session[:verification_user_id] && token = verification_params[:verification_token].presence
# The verification token is submitted, verify it
verify_token(user, token)
elsif require_email_verification_enabled?(user)
# Limit the amount of password guesses, since we now display the email verification page
# when the password is correct, which could be a giveaway when brute-forced.
return render_sign_in_rate_limited if check_rate_limit!(:user_sign_in, scope: user) { true }
if user.valid_password?(user_params[:password])
# The user has logged in successfully.
if user.unlock_token
# Prompt for the token if it already has been set
prompt_for_email_verification(user)
elsif user.access_locked? || !AuthenticationEvent.initial_login_or_known_ip_address?(user, request.ip)
# require email verification if:
# - their account has been locked because of too many failed login attempts, or
# - they have logged in before, but never from the current ip address
send_verification_instructions(user)
prompt_for_email_verification(user)
end
end
end
end
def resend_verification_code
return unless user = find_verification_user
send_verification_instructions(user)
prompt_for_email_verification(user)
end
def successful_verification
session.delete(:verification_user_id)
@redirect_url = after_sign_in_path_for(current_user) # rubocop:disable Gitlab/ModuleWithInstanceVariables
render layout: 'minimal'
end
private
def find_verification_user
return unless session[:verification_user_id]
User.find_by_id(session[:verification_user_id])
end
# After successful verification and calling sign_in, devise redirects the
# user to this path. Override it to show the successful verified page.
def after_sign_in_path_for(resource)
if action_name == 'create' && session[:verification_user_id]
return users_successful_verification_path
end
super
end
def send_verification_instructions(user)
return if send_rate_limited?(user)
raw_token, encrypted_token = generate_token
user.unlock_token = encrypted_token
user.lock_access!({ send_instructions: false })
send_verification_instructions_email(user, raw_token)
end
def send_verification_instructions_email(user, token)
return unless user.can?(:receive_notifications)
Notify.verification_instructions_email(
user.id,
token: token,
expires_in: TOKEN_VALID_FOR_MINUTES).deliver_later
log_verification(user, :instructions_sent)
end
def verify_token(user, token)
return handle_verification_failure(user, :rate_limited) if verification_rate_limited?(user)
return handle_verification_failure(user, :invalid) unless valid_token?(user, token)
return handle_verification_failure(user, :expired) if expired_token?(user)
handle_verification_success(user)
end
def generate_token
raw_token = SecureRandom.random_number(10**TOKEN_LENGTH).to_s.rjust(TOKEN_LENGTH, '0')
encrypted_token = digest_token(raw_token)
[raw_token, encrypted_token]
end
def digest_token(token)
Devise.token_generator.digest(User, :unlock_token, token)
end
def render_sign_in_rate_limited
message = s_('IdentityVerification|Maximum login attempts exceeded. '\
'Wait %{interval} and try again.') % { interval: user_sign_in_interval }
redirect_to new_user_session_path, alert: message
end
def user_sign_in_interval
interval_in_seconds = Gitlab::ApplicationRateLimiter.rate_limits[:user_sign_in][:interval]
distance_of_time_in_words(interval_in_seconds)
end
def verification_rate_limited?(user)
Gitlab::ApplicationRateLimiter.throttled?(:email_verification, scope: user.unlock_token)
end
def send_rate_limited?(user)
Gitlab::ApplicationRateLimiter.throttled?(:email_verification_code_send, scope: user)
end
def expired_token?(user)
user.locked_at < (Time.current - TOKEN_VALID_FOR_MINUTES.minutes)
end
def valid_token?(user, token)
user.unlock_token == digest_token(token)
end
def handle_verification_failure(user, reason)
message = case reason
when :rate_limited
s_("IdentityVerification|You've reached the maximum amount of tries. "\
'Wait %{interval} or resend a new code and try again.') % { interval: email_verification_interval }
when :expired
s_('IdentityVerification|The code has expired. Resend a new code and try again.')
when :invalid
s_('IdentityVerification|The code is incorrect. Enter it again, or resend a new code.')
end
user.errors.add(:base, message)
log_verification(user, :failed_attempt, reason)
prompt_for_email_verification(user)
end
def email_verification_interval
interval_in_seconds = Gitlab::ApplicationRateLimiter.rate_limits[:email_verification][:interval]
distance_of_time_in_words(interval_in_seconds)
end
def handle_verification_success(user)
user.unlock_access!
log_verification(user, :successful)
sign_in(user)
end
def prompt_for_email_verification(user)
session[:verification_user_id] = user.id
self.resource = user
render 'devise/sessions/email_verification'
end
def verification_params
params.require(:user).permit(:verification_token)
end
def log_verification(user, event, reason = nil)
Gitlab::AppLogger.info(
message: 'Email Verification',
event: event.to_s.titlecase,
username: user.username,
ip: request.ip,
reason: reason.to_s
)
end
def require_email_verification_enabled?(user)
Feature.enabled?(:require_email_verification, user)
end
end
|