application_controller.rb 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150
  1. # frozen_string_literal: true
  2. class ApplicationController < ActionController::Base
  3. # Prevent CSRF attacks by raising an exception.
  4. # For APIs, you may want to use :null_session instead.
  5. protect_from_forgery with: :exception
  6. force_ssl if: :https_enabled?
  7. include Localized
  8. include UserTrackingConcern
  9. include SessionTrackingConcern
  10. include CacheConcern
  11. include DomainControlHelper
  12. helper_method :current_account
  13. helper_method :current_session
  14. helper_method :current_theme
  15. helper_method :single_user_mode?
  16. helper_method :use_seamless_external_login?
  17. helper_method :whitelist_mode?
  18. rescue_from ActionController::RoutingError, with: :not_found
  19. rescue_from ActionController::InvalidAuthenticityToken, with: :unprocessable_entity
  20. rescue_from ActionController::UnknownFormat, with: :not_acceptable
  21. rescue_from ActionController::ParameterMissing, with: :bad_request
  22. rescue_from Paperclip::AdapterRegistry::NoHandlerError, with: :bad_request
  23. rescue_from ActiveRecord::RecordNotFound, with: :not_found
  24. rescue_from Mastodon::NotPermittedError, with: :forbidden
  25. rescue_from HTTP::Error, OpenSSL::SSL::SSLError, with: :internal_server_error
  26. rescue_from Mastodon::RaceConditionError, with: :service_unavailable
  27. rescue_from Mastodon::RateLimitExceededError, with: :too_many_requests
  28. before_action :store_current_location, except: :raise_not_found, unless: :devise_controller?
  29. before_action :require_functional!, if: :user_signed_in?
  30. skip_before_action :verify_authenticity_token, only: :raise_not_found
  31. def raise_not_found
  32. raise ActionController::RoutingError, "No route matches #{params[:unmatched_route]}"
  33. end
  34. private
  35. def https_enabled?
  36. Rails.env.production? && !request.path.start_with?('/health')
  37. end
  38. def authorized_fetch_mode?
  39. ENV['AUTHORIZED_FETCH'] == 'true' || Rails.configuration.x.whitelist_mode
  40. end
  41. def public_fetch_mode?
  42. !authorized_fetch_mode?
  43. end
  44. def store_current_location
  45. store_location_for(:user, request.url) unless [:json, :rss].include?(request.format&.to_sym)
  46. end
  47. def require_admin!
  48. forbidden unless current_user&.admin?
  49. end
  50. def require_staff!
  51. forbidden unless current_user&.staff?
  52. end
  53. def require_functional!
  54. redirect_to edit_user_registration_path unless current_user.functional?
  55. end
  56. def after_sign_out_path_for(_resource_or_scope)
  57. new_user_session_path
  58. end
  59. protected
  60. def truthy_param?(key)
  61. ActiveModel::Type::Boolean.new.cast(params[key])
  62. end
  63. def forbidden
  64. respond_with_error(403)
  65. end
  66. def not_found
  67. respond_with_error(404)
  68. end
  69. def gone
  70. respond_with_error(410)
  71. end
  72. def unprocessable_entity
  73. respond_with_error(422)
  74. end
  75. def not_acceptable
  76. respond_with_error(406)
  77. end
  78. def bad_request
  79. respond_with_error(400)
  80. end
  81. def internal_server_error
  82. respond_with_error(500)
  83. end
  84. def service_unavailable
  85. respond_with_error(503)
  86. end
  87. def too_many_requests
  88. respond_with_error(429)
  89. end
  90. def single_user_mode?
  91. @single_user_mode ||= Rails.configuration.x.single_user_mode && Account.where('id > 0').exists?
  92. end
  93. def use_seamless_external_login?
  94. Devise.pam_authentication || Devise.ldap_authentication
  95. end
  96. def current_account
  97. return @current_account if defined?(@current_account)
  98. @current_account = current_user&.account
  99. end
  100. def current_session
  101. return @current_session if defined?(@current_session)
  102. @current_session = SessionActivation.find_by(session_id: cookies.signed['_session_id']) if cookies.signed['_session_id'].present?
  103. end
  104. def current_theme
  105. return Setting.theme unless Themes.instance.names.include? current_user&.setting_theme
  106. current_user.setting_theme
  107. end
  108. def respond_with_error(code)
  109. respond_to do |format|
  110. format.any { render "errors/#{code}", layout: 'error', status: code, formats: [:html] }
  111. format.json { render json: { error: Rack::Utils::HTTP_STATUS_CODES[code] }, status: code }
  112. end
  113. end
  114. end