@@ -5,10 +5,11 @@ gem 'rails', '~> 3.2.11'

 # Bundle edge Rails instead:

 # gem 'rails', :git => 'git://github.com/rails/rails.git'

-gem "mongoid", "~> 3.0.20"

-gem "xmpp4r", "~> 0.5"

-gem "thin", "~> 1.5.0"

-gem "websocket-rails", "~> 0.4.3"

+gem 'mongoid', '~> 3.0.20'

+gem 'xmpp4r', '~> 0.5'

+gem 'thin', '~> 1.5.0'

+gem 'websocket-rails', '~> 0.4.3'

+gem 'bcrypt-ruby'

 # Gems used only for assets and not required

 # in production environments by default.

@@ -17,7 +18,7 @@ group :assets do

   gem 'coffee-rails', '~> 3.2.1'

   gem 'normalize-rails'

   gem 'compass-rails'

-  gem "rails-backbone"

+  gem 'rails-backbone'

   gem 'haml_coffee_assets'

   #gem "marionette-rails", "~> 0.10.2"

@@ -37,28 +38,25 @@ group :development do

 end

 group :test do

-	gem "minitest"

+	gem 'minitest'

 	gem 'minitest-reporters', '>= 0.5.0'

 	gem 'test-unit'

 	gem 'timecop'

-	gem "rspec-rails"

-	gem "capybara"

-	gem "launchy"

-	gem "factory_girl_rails"

+	gem 'rspec-rails'

+	gem 'capybara'

+	gem 'launchy'

+	gem 'factory_girl_rails'

     gem 'guard-spork'

     gem 'spork'

-    gem "phantomjs-binaries"

-    gem "casperjs"

+    gem 'phantomjs-binaries'

+    gem 'casperjs'

 end

 gem 'jquery-rails'

-gem "haml", "~> 3.1.7"

-gem "haml-rails", "~> 0.3.5"

+gem 'haml', '~> 3.1.7'

+gem 'haml-rails', '~> 0.3.5'

 gem 'i18n-js'

-# To use ActiveModel has_secure_password

-# gem 'bcrypt-ruby', '~> 3.0.0'

-

 # To use Jbuilder templates for JSON

 # gem 'jbuilder'

@@ -31,6 +31,7 @@ GEM

     addressable (2.3.3)

     ansi (1.4.3)

     arel (3.0.2)

+    bcrypt-ruby (3.0.1)

     better_errors (0.7.2)

       coderay (>= 1.0.0)

       erubis (>= 2.6.6)

@@ -262,6 +263,7 @@ PLATFORMS

   ruby

 DEPENDENCIES

+  bcrypt-ruby

   better_errors

   binding_of_caller

   capistrano

@@ -35,6 +35,8 @@ class ApplicationController < ActionController::Base

         save_session(user_id, user_credentials)

     end

+    private

+

     def save_session(user_id, user_credentials)

         session[:token]      = Token.generate_token()

         session[:created_at] = Time.now

@@ -42,7 +44,12 @@ class ApplicationController < ActionController::Base

         if user_credentials

             session[:users] = {} unless session[:users]

-            session[:users][user_credentials[:jid]] = user_credentials[:password]

+

+            encrypted_pass = Security::encrypt(user_credentials[:password])

+            cookies[:key] = Security::cipher_key

+            cookies[:iv]  = Security::cipher_iv

+

+            session[:users][user_credentials[:jid]] = encrypted_pass

         end

         @token.save_session(session, user_id)

@@ -27,11 +27,18 @@ class WsRosterController < WebsocketRails::BaseController

         # TODO: Pouzit najprv:

         # clients = Token.fing_user_accounts_having_to_token(session[:token])

         # ale toto, az ked budem mat dokonceny multiaccount (settings a popup)

-        clients = session[:users]

+        cookies = env['rack.request.cookie_hash']

+        cipher_key = cookies['key']

+        cipher_iv = cookies['iv']

-        clients.each do |jid, pass|

+        clients = session[:users].map do |jid, encrypted_pass|

+            decrypted_pass = Security::decrypt(encrypted_pass, cipher_key, cipher_iv)

+            {jid: jid, pass: decrypted_pass}

+        end

+

+        clients.each do |client|

             begin

-                client = Signin.try_login(jid, pass)

+                client = Signin.try_login(client[:jid], client[:pass])

                 connection_store[:clients] << client

             rescue Signin::LoginError

                 send_message 'app.client.cannot_connect', true

new file mode 100644

@@ -0,0 +1,37 @@

+require 'bcrypt'

+

+module Security

+    mattr_reader :cipher_iv, :cipher_key

+

+    def self.encrypt(unencrypted_message, password = nil)

+        cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')

+        cipher.encrypt()

+

+        pass = password ? password : generate_token()

+        cipher.key = @@cipher_key = Digest::SHA1.hexdigest(pass)

+        cipher.iv  = @@cipher_iv  = cipher.random_iv

+

+        encrypted = cipher.update(unencrypted_message)

+        encrypted << cipher.final

+    end

+

+    def self.decrypt(encrypted_message, key, iv)

+        cipher = OpenSSL::Cipher::Cipher.new('aes-256-cbc')

+        cipher.decrypt()

+

+        cipher.key = @@cipher_key = key

+        cipher.iv  = @@cipher_iv = iv

+

+        decrypted = cipher.update(encrypted_message)

+        decrypted << cipher.final

+    end

+

+    def self.generate_token()

+        BCrypt::Engine.generate_salt()

+    end

+

+    def self.save_cookies

+        cookies[:key] = @@cipher_key

+        cookies[:iv]  = @@cipher_iv

+    end

+end

\ No newline at end of file