Refactor settings controllers (#14767)

- Disallow suspended accounts from revoking sessions and apps - Allow suspended accounts to access exports
2020-09-11 20:56:35 +02:00 · 2020-09-11 20:56:35 +02:00 · 4e4b3a0c8e
commit 4e4b3a0c8e
parent e6b272e5c9
31 changed files with 65 additions and 118 deletions
--- a/app/controllers/settings/aliases_controller.rb
+++ b/app/controllers/settings/aliases_controller.rb
@ -1,9 +1,9 @@
 # frozen_string_literal: true

 class Settings::AliasesController < Settings::BaseController
-  layout 'admin'
+  skip_before_action :require_functional!

-  before_action :authenticate_user!
+  before_action :require_not_suspended!
  before_action :set_aliases, except: :destroy
  before_action :set_alias, only: :destroy

--- a/app/controllers/settings/applications_controller.rb
+++ b/app/controllers/settings/applications_controller.rb
@ -1,9 +1,6 @@
 # frozen_string_literal: true

 class Settings::ApplicationsController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
  before_action :set_application, only: [:show, :update, :destroy, :regenerate]
  before_action :prepare_scopes, only: [:create, :update]

--- a/app/controllers/settings/base_controller.rb
+++ b/app/controllers/settings/base_controller.rb
@ -1,6 +1,9 @@
 # frozen_string_literal: true

 class Settings::BaseController < ApplicationController
+  layout 'admin'
+
+  before_action :authenticate_user!
  before_action :set_body_classes
  before_action :set_cache_headers

@ -13,4 +16,8 @@ class Settings::BaseController < ApplicationController
  def set_cache_headers
    response.headers['Cache-Control'] = 'no-cache, no-store, max-age=0, must-revalidate'
  end
+
+  def require_not_suspended!
+    forbidden if current_account.suspended?
+  end
 end
--- a/app/controllers/settings/deletes_controller.rb
+++ b/app/controllers/settings/deletes_controller.rb
@ -1,14 +1,11 @@
 # frozen_string_literal: true

 class Settings::DeletesController < Settings::BaseController
-  layout 'admin'
-
-  before_action :check_enabled_deletion
-  before_action :authenticate_user!
-  before_action :require_not_suspended!
-
  skip_before_action :require_functional!

+  before_action :require_not_suspended!
+  before_action :check_enabled_deletion
+
  def show
    @confirmation = Form::DeleteConfirmation.new
  end
--- a/app/controllers/settings/exports/blocked_accounts_controller.rb
+++ b/app/controllers/settings/exports/blocked_accounts_controller.rb
@ -2,7 +2,7 @@

 module Settings
  module Exports
-    class BlockedAccountsController < ApplicationController
+    class BlockedAccountsController < BaseController
      include ExportControllerConcern

      def index
--- a/app/controllers/settings/exports/blocked_domains_controller.rb
+++ b/app/controllers/settings/exports/blocked_domains_controller.rb
@ -2,7 +2,7 @@

 module Settings
  module Exports
-    class BlockedDomainsController < ApplicationController
+    class BlockedDomainsController < BaseController
      include ExportControllerConcern

      def index
--- a/app/controllers/settings/exports/following_accounts_controller.rb
+++ b/app/controllers/settings/exports/following_accounts_controller.rb
@ -2,7 +2,7 @@

 module Settings
  module Exports
-    class FollowingAccountsController < ApplicationController
+    class FollowingAccountsController < BaseController
      include ExportControllerConcern

      def index
--- a/app/controllers/settings/exports/lists_controller.rb
+++ b/app/controllers/settings/exports/lists_controller.rb
@ -2,7 +2,7 @@

 module Settings
  module Exports
-    class ListsController < ApplicationController
+    class ListsController < BaseController
      include ExportControllerConcern

      def index
--- a/app/controllers/settings/exports/muted_accounts_controller.rb
+++ b/app/controllers/settings/exports/muted_accounts_controller.rb
@ -2,7 +2,7 @@

 module Settings
  module Exports
-    class MutedAccountsController < ApplicationController
+    class MutedAccountsController < BaseController
      include ExportControllerConcern

      def index
--- a/app/controllers/settings/exports_controller.rb
+++ b/app/controllers/settings/exports_controller.rb
@ -3,11 +3,6 @@
 class Settings::ExportsController < Settings::BaseController
  include Authorization

-  layout 'admin'
-
-  before_action :authenticate_user!
-  before_action :require_not_suspended!
-
  skip_before_action :require_functional!

  def show
@ -16,8 +11,6 @@ class Settings::ExportsController < Settings::BaseController
  end

  def create
-    raise Mastodon::NotPermittedError unless user_signed_in?
-
    backup = nil

    RedisLock.acquire(lock_options) do |lock|
@ -37,8 +30,4 @@ class Settings::ExportsController < Settings::BaseController
  def lock_options
    { redis: Redis.current, key: "backup:#{current_user.id}" }
  end
-
-  def require_not_suspended!
-    forbidden if current_account.suspended?
-  end
 end
--- a/app/controllers/settings/featured_tags_controller.rb
+++ b/app/controllers/settings/featured_tags_controller.rb
@ -1,9 +1,6 @@
 # frozen_string_literal: true

 class Settings::FeaturedTagsController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
  before_action :set_featured_tags, only: :index
  before_action :set_featured_tag, except: [:index, :create]
  before_action :set_recently_used_tags, only: :index
--- a/app/controllers/settings/identity_proofs_controller.rb
+++ b/app/controllers/settings/identity_proofs_controller.rb
@ -1,9 +1,6 @@
 # frozen_string_literal: true

 class Settings::IdentityProofsController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
  before_action :check_required_params, only: :new

  def index
--- a/app/controllers/settings/imports_controller.rb
+++ b/app/controllers/settings/imports_controller.rb
@ -1,9 +1,6 @@
 # frozen_string_literal: true

 class Settings::ImportsController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
  before_action :set_account

  def show
--- a/app/controllers/settings/migration/redirects_controller.rb
+++ b/app/controllers/settings/migration/redirects_controller.rb
@ -1,13 +1,10 @@
 # frozen_string_literal: true

 class Settings::Migration::RedirectsController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
-  before_action :require_not_suspended!
-
  skip_before_action :require_functional!

+  before_action :require_not_suspended!
+
  def new
    @redirect = Form::Redirect.new
  end
@ -38,8 +35,4 @@ class Settings::Migration::RedirectsController < Settings::BaseController
  def resource_params
    params.require(:form_redirect).permit(:acct, :current_password, :current_username)
  end
-
-  def require_not_suspended!
-    forbidden if current_account.suspended?
-  end
 end
--- a/app/controllers/settings/migrations_controller.rb
+++ b/app/controllers/settings/migrations_controller.rb
@ -1,15 +1,12 @@
 # frozen_string_literal: true

 class Settings::MigrationsController < Settings::BaseController
-  layout 'admin'
+  skip_before_action :require_functional!

-  before_action :authenticate_user!
  before_action :require_not_suspended!
  before_action :set_migrations
  before_action :set_cooldown

-  skip_before_action :require_functional!
-
  def show
    @migration = current_account.migrations.build
  end
@ -44,8 +41,4 @@ class Settings::MigrationsController < Settings::BaseController
  def on_cooldown?
    @cooldown.present?
  end
-
-  def require_not_suspended!
-    forbidden if current_account.suspended?
-  end
 end
--- a/app/controllers/settings/pictures_controller.rb
+++ b/app/controllers/settings/pictures_controller.rb
@ -2,7 +2,6 @@

 module Settings
  class PicturesController < BaseController
-    before_action :authenticate_user!
    before_action :set_account
    before_action :set_picture

--- a/app/controllers/settings/preferences_controller.rb
+++ b/app/controllers/settings/preferences_controller.rb
@ -1,10 +1,6 @@
 # frozen_string_literal: true

 class Settings::PreferencesController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
-
  def show; end

  def update
--- a/app/controllers/settings/profiles_controller.rb
+++ b/app/controllers/settings/profiles_controller.rb
@ -1,9 +1,6 @@
 # frozen_string_literal: true

 class Settings::ProfilesController < Settings::BaseController
-  layout 'admin'
-
-  before_action :authenticate_user!
  before_action :set_account

  def show
--- a/app/controllers/settings/sessions_controller.rb
+++ b/app/controllers/settings/sessions_controller.rb
@ -1,11 +1,11 @@
 # frozen_string_literal: true

 class Settings::SessionsController < Settings::BaseController
-  before_action :authenticate_user!
-  before_action :set_session, only: :destroy
-
  skip_before_action :require_functional!

+  before_action :require_not_suspended!
+  before_action :set_session, only: :destroy
+
  def destroy
    @session.destroy!
    flash[:notice] = I18n.t('sessions.revoke_success')
--- a/app/controllers/settings/two_factor_authentication/confirmations_controller.rb
+++ b/app/controllers/settings/two_factor_authentication/confirmations_controller.rb
@ -5,14 +5,11 @@ module Settings
    class ConfirmationsController < BaseController
      include ChallengableConcern

-      layout 'admin'
+      skip_before_action :require_functional!

-      before_action :authenticate_user!
      before_action :require_challenge!
      before_action :ensure_otp_secret

-      skip_before_action :require_functional!
-
      def new
        prepare_two_factor_form
      end
--- a/app/controllers/settings/two_factor_authentication/otp_authentication_controller.rb
+++ b/app/controllers/settings/two_factor_authentication/otp_authentication_controller.rb
@ -5,14 +5,11 @@ module Settings
    class OtpAuthenticationController < BaseController
      include ChallengableConcern

-      layout 'admin'
+      skip_before_action :require_functional!

-      before_action :authenticate_user!
      before_action :verify_otp_not_enabled, only: [:show]
      before_action :require_challenge!, only: [:create]

-      skip_before_action :require_functional!
-
      def show
        @confirmation = Form::TwoFactorConfirmation.new
      end
--- a/app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb
+++ b/app/controllers/settings/two_factor_authentication/recovery_codes_controller.rb
@ -5,13 +5,10 @@ module Settings
    class RecoveryCodesController < BaseController
      include ChallengableConcern

-      layout 'admin'
-
-      before_action :authenticate_user!
-      before_action :require_challenge!, on: :create
-
      skip_before_action :require_functional!

+      before_action :require_challenge!, on: :create
+
      def create
        @recovery_codes = current_user.generate_otp_backup_codes!
        current_user.save!
--- a/app/controllers/settings/two_factor_authentication/webauthn_credentials_controller.rb
+++ b/app/controllers/settings/two_factor_authentication/webauthn_credentials_controller.rb
@ -3,9 +3,8 @@
 module Settings
  module TwoFactorAuthentication
    class WebauthnCredentialsController < BaseController
-      layout 'admin'
+      skip_before_action :require_functional!

-      before_action :authenticate_user!
      before_action :require_otp_enabled
      before_action :require_webauthn_enabled, only: [:index, :destroy]

--- a/app/controllers/settings/two_factor_authentication_methods_controller.rb
+++ b/app/controllers/settings/two_factor_authentication_methods_controller.rb
@ -4,14 +4,11 @@ module Settings
  class TwoFactorAuthenticationMethodsController < BaseController
    include ChallengableConcern

-    layout 'admin'
+    skip_before_action :require_functional!

-    before_action :authenticate_user!
    before_action :require_challenge!, only: :disable
    before_action :require_otp_enabled

-    skip_before_action :require_functional!
-
    def index; end

    def disable