... | ... |
@@ -5,10 +5,11 @@ gem 'rails', '~> 3.2.11' |
5 | 5 |
# Bundle edge Rails instead: |
6 | 6 |
# gem 'rails', :git => 'git://github.com/rails/rails.git' |
7 | 7 |
|
8 |
-gem "mongoid", "~> 3.0.20" |
|
9 |
-gem "xmpp4r", "~> 0.5" |
|
10 |
-gem "thin", "~> 1.5.0" |
|
11 |
-gem "websocket-rails", "~> 0.4.3" |
|
8 |
+gem 'mongoid', '~> 3.0.20' |
|
9 |
+gem 'xmpp4r', '~> 0.5' |
|
10 |
+gem 'thin', '~> 1.5.0' |
|
11 |
+gem 'websocket-rails', '~> 0.4.3' |
|
12 |
+gem 'bcrypt-ruby' |
|
12 | 13 |
|
13 | 14 |
# Gems used only for assets and not required |
14 | 15 |
# in production environments by default. |
... | ... |
@@ -17,7 +18,7 @@ group :assets do |
17 | 17 |
gem 'coffee-rails', '~> 3.2.1' |
18 | 18 |
gem 'normalize-rails' |
19 | 19 |
gem 'compass-rails' |
20 |
- gem "rails-backbone" |
|
20 |
+ gem 'rails-backbone' |
|
21 | 21 |
gem 'haml_coffee_assets' |
22 | 22 |
#gem "marionette-rails", "~> 0.10.2" |
23 | 23 |
|
... | ... |
@@ -37,28 +38,25 @@ group :development do |
37 | 37 |
end |
38 | 38 |
|
39 | 39 |
group :test do |
40 |
- gem "minitest" |
|
40 |
+ gem 'minitest' |
|
41 | 41 |
gem 'minitest-reporters', '>= 0.5.0' |
42 | 42 |
gem 'test-unit' |
43 | 43 |
gem 'timecop' |
44 |
- gem "rspec-rails" |
|
45 |
- gem "capybara" |
|
46 |
- gem "launchy" |
|
47 |
- gem "factory_girl_rails" |
|
44 |
+ gem 'rspec-rails' |
|
45 |
+ gem 'capybara' |
|
46 |
+ gem 'launchy' |
|
47 |
+ gem 'factory_girl_rails' |
|
48 | 48 |
gem 'guard-spork' |
49 | 49 |
gem 'spork' |
50 |
- gem "phantomjs-binaries" |
|
51 |
- gem "casperjs" |
|
50 |
+ gem 'phantomjs-binaries' |
|
51 |
+ gem 'casperjs' |
|
52 | 52 |
end |
53 | 53 |
|
54 | 54 |
gem 'jquery-rails' |
55 |
-gem "haml", "~> 3.1.7" |
|
56 |
-gem "haml-rails", "~> 0.3.5" |
|
55 |
+gem 'haml', '~> 3.1.7' |
|
56 |
+gem 'haml-rails', '~> 0.3.5' |
|
57 | 57 |
gem 'i18n-js' |
58 | 58 |
|
59 |
-# To use ActiveModel has_secure_password |
|
60 |
-# gem 'bcrypt-ruby', '~> 3.0.0' |
|
61 |
- |
|
62 | 59 |
# To use Jbuilder templates for JSON |
63 | 60 |
# gem 'jbuilder' |
64 | 61 |
|
... | ... |
@@ -31,6 +31,7 @@ GEM |
31 | 31 |
addressable (2.3.3) |
32 | 32 |
ansi (1.4.3) |
33 | 33 |
arel (3.0.2) |
34 |
+ bcrypt-ruby (3.0.1) |
|
34 | 35 |
better_errors (0.7.2) |
35 | 36 |
coderay (>= 1.0.0) |
36 | 37 |
erubis (>= 2.6.6) |
... | ... |
@@ -262,6 +263,7 @@ PLATFORMS |
262 | 262 |
ruby |
263 | 263 |
|
264 | 264 |
DEPENDENCIES |
265 |
+ bcrypt-ruby |
|
265 | 266 |
better_errors |
266 | 267 |
binding_of_caller |
267 | 268 |
capistrano |
... | ... |
@@ -35,6 +35,8 @@ class ApplicationController < ActionController::Base |
35 | 35 |
save_session(user_id, user_credentials) |
36 | 36 |
end |
37 | 37 |
|
38 |
+ private |
|
39 |
+ |
|
38 | 40 |
def save_session(user_id, user_credentials) |
39 | 41 |
session[:token] = Token.generate_token() |
40 | 42 |
session[:created_at] = Time.now |
... | ... |
@@ -42,7 +44,12 @@ class ApplicationController < ActionController::Base |
42 | 42 |
|
43 | 43 |
if user_credentials |
44 | 44 |
session[:users] = {} unless session[:users] |
45 |
- session[:users][user_credentials[:jid]] = user_credentials[:password] |
|
45 |
+ |
|
46 |
+ encrypted_pass = Security::encrypt(user_credentials[:password]) |
|
47 |
+ cookies[:key] = Security::cipher_key |
|
48 |
+ cookies[:iv] = Security::cipher_iv |
|
49 |
+ |
|
50 |
+ session[:users][user_credentials[:jid]] = encrypted_pass |
|
46 | 51 |
end |
47 | 52 |
|
48 | 53 |
@token.save_session(session, user_id) |
... | ... |
@@ -27,11 +27,18 @@ class WsRosterController < WebsocketRails::BaseController |
27 | 27 |
# TODO: Pouzit najprv: |
28 | 28 |
# clients = Token.fing_user_accounts_having_to_token(session[:token]) |
29 | 29 |
# ale toto, az ked budem mat dokonceny multiaccount (settings a popup) |
30 |
- clients = session[:users] |
|
30 |
+ cookies = env['rack.request.cookie_hash'] |
|
31 |
+ cipher_key = cookies['key'] |
|
32 |
+ cipher_iv = cookies['iv'] |
|
31 | 33 |
|
32 |
- clients.each do |jid, pass| |
|
34 |
+ clients = session[:users].map do |jid, encrypted_pass| |
|
35 |
+ decrypted_pass = Security::decrypt(encrypted_pass, cipher_key, cipher_iv) |
|
36 |
+ {jid: jid, pass: decrypted_pass} |
|
37 |
+ end |
|
38 |
+ |
|
39 |
+ clients.each do |client| |
|
33 | 40 |
begin |
34 |
- client = Signin.try_login(jid, pass) |
|
41 |
+ client = Signin.try_login(client[:jid], client[:pass]) |
|
35 | 42 |
connection_store[:clients] << client |
36 | 43 |
rescue Signin::LoginError |
37 | 44 |
send_message 'app.client.cannot_connect', true |
38 | 45 |
new file mode 100644 |
... | ... |
@@ -0,0 +1,37 @@ |
0 |
+require 'bcrypt' |
|
1 |
+ |
|
2 |
+module Security |
|
3 |
+ mattr_reader :cipher_iv, :cipher_key |
|
4 |
+ |
|
5 |
+ def self.encrypt(unencrypted_message, password = nil) |
|
6 |
+ cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc') |
|
7 |
+ cipher.encrypt() |
|
8 |
+ |
|
9 |
+ pass = password ? password : generate_token() |
|
10 |
+ cipher.key = @@cipher_key = Digest::SHA1.hexdigest(pass) |
|
11 |
+ cipher.iv = @@cipher_iv = cipher.random_iv |
|
12 |
+ |
|
13 |
+ encrypted = cipher.update(unencrypted_message) |
|
14 |
+ encrypted << cipher.final |
|
15 |
+ end |
|
16 |
+ |
|
17 |
+ def self.decrypt(encrypted_message, key, iv) |
|
18 |
+ cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc') |
|
19 |
+ cipher.decrypt() |
|
20 |
+ |
|
21 |
+ cipher.key = @@cipher_key = key |
|
22 |
+ cipher.iv = @@cipher_iv = iv |
|
23 |
+ |
|
24 |
+ decrypted = cipher.update(encrypted_message) |
|
25 |
+ decrypted << cipher.final |
|
26 |
+ end |
|
27 |
+ |
|
28 |
+ def self.generate_token() |
|
29 |
+ BCrypt::Engine.generate_salt() |
|
30 |
+ end |
|
31 |
+ |
|
32 |
+ def self.save_cookies |
|
33 |
+ cookies[:key] = @@cipher_key |
|
34 |
+ cookies[:iv] = @@cipher_iv |
|
35 |
+ end |
|
36 |
+end |
|
0 | 37 |
\ No newline at end of file |