foreman/app/models/user.rb @ 1678e0e1
1678e0e1 | Dominic Cleal | # encoding: UTF-8
|
|
686cb440 | Ohad Levy | require 'digest/sha1'
|
|
1ba05a93 | Ohad Levy | class User < ActiveRecord::Base
|
|
acfbc458 | Marek Hulan | include Authorizable
|
|
475cdc84 | Ohad Levy | include Foreman::ThreadSession::UserModel
|
|
611f5bff | Amos Benari | include Taxonomix
|
|
9c864cb6 | Ohad Levy | audited :except => [:last_login_on, :password, :password_hash, :password_salt, :password_confirmation], :allow_mass_assignment => true
|
|
e4fde4e3 | Ivan Nečas | self.auditing_enabled = !Foreman.in_rake?('db:migrate')
|
|
475cdc84 | Ohad Levy | ||
7a4ec5cf | Paul Kelly | attr_protected :password_hash, :password_salt, :admin
|
|
355bce36 | Ohad Levy | attr_accessor :password, :password_confirmation
|
|
ff8cc704 | Joseph Mitchell Magen | before_destroy EnsureNotUsedBy.new(:direct_hosts, :hostgroups), :ensure_admin_is_not_deleted
|
|
355bce36 | Ohad Levy | after_commit :ensure_default_role
|
|
7a4ec5cf | Paul Kelly | ||
1ba05a93 | Ohad Levy | belongs_to :auth_source
|
|
7e1f0c79 | Daniel Lobato | belongs_to :default_organization, :class_name => 'Organization'
|
|
belongs_to :default_location, :class_name => 'Location'
|
|||
eec062e6 | Ohad Levy | has_many :auditable_changes, :class_name => '::Audit', :as => :user
|
|
7e1f0c79 | Daniel Lobato | has_many :direct_hosts, :class_name => 'Host', :as => :owner
|
|
has_many :usergroup_member, :dependent => :destroy, :as => :member
|
|||
has_many :user_roles, :dependent => :destroy, :foreign_key => 'owner_id', :conditions => {:owner_type => self.to_s}
|
|||
has_many :user_hostgroups, :dependent => :destroy
|
|||
has_many :user_facts, :dependent => :destroy
|
|||
acfbc458 | Marek Hulan | has_many :cached_user_roles, :dependent => :destroy
|
|
7e1f0c79 | Daniel Lobato | has_many :facts, :through => :user_facts, :source => :fact_name
|
|
has_many :cached_usergroups, :through => :cached_usergroup_members, :source => :usergroup
|
|||
has_many :cached_roles, :through => :cached_user_roles, :source => :role, :uniq => true
|
|||
has_many :hostgroups, :through => :user_hostgroups
|
|||
has_many :usergroups, :through => :usergroup_member
|
|||
has_many :roles, :through => :user_roles, :dependent => :destroy
|
|||
has_many :filters, :through => :cached_roles
|
|||
has_many :permissions, :through => :filters
|
|||
has_many :cached_usergroup_members
|
|||
has_and_belongs_to_many :notices, :join_table => 'user_notices'
|
|||
e170c321 | Olivier Favre | has_and_belongs_to_many :compute_resources, :join_table => "user_compute_resources"
|
|
has_and_belongs_to_many :domains, :join_table => "user_domains"
|
|||
3b656b8d | Joseph Mitchell Magen | attr_name :login
|
|
9fd7478e | Paul Kelly | ||
acfbc458 | Marek Hulan | scope :except_admin, lambda {
|
|
includes(:cached_usergroups).
|
|||
where(["(#{self.table_name}.admin = ? OR #{self.table_name}.admin IS NULL) AND " +
|
|||
"(#{Usergroup.table_name}.admin = ? OR #{Usergroup.table_name}.admin IS NULL)",
|
|||
false, false])
|
|||
}
|
|||
scope :only_admin, lambda {
|
|||
includes(:cached_usergroups).
|
|||
where(["#{self.table_name}.admin = ? OR #{Usergroup.table_name}.admin = ?", true, true])
|
|||
}
|
|||
611f5bff | Amos Benari | ||
9fd7478e | Paul Kelly | accepts_nested_attributes_for :user_facts, :reject_if => lambda { |a| a[:criteria].blank? }, :allow_destroy => true
|
|
6874bbd9 | Paul Kelly | ||
a6b0eeb0 | Joseph Magen | validates :mail, :format => { :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)*[a-z]{2,})\Z/i },
|
|
306ed25a | rbirnie | :length => { :maximum => 60 },
|
|
:allow_blank => true
|
|||
validates :mail, :presence => true, :on => :update
|
|||
a6b0eeb0 | Joseph Magen | validates :locale, :format => { :with => /\A\w{2}([_-]\w{2})?\Z/ }, :allow_blank => true, :if => Proc.new { |user| user.respond_to?(:locale) }
|
|
e2c2abfe | Lukas Zapletal | before_validation :normalize_locale
|
|
1678e0e1 | Dominic Cleal | def self.name_format
|
|
if RUBY_VERSION.start_with? '1.8'
|
|||
/\A[ёЁа-яА-Яa-zA-Zà-üÀ-Ü0-9\s'_\-\.()<>;=,]*\z/u
|
|||
else
|
|||
/\A[[:alnum:]\s'_\-\.()<>;=,]*\z/
|
|||
end
|
|||
end
|
|||
f2c78d4a | Joseph Magen | validates :login, :presence => true, :uniqueness => {:message => N_("already exists")},
|
|
a6b0eeb0 | Joseph Magen | :format => {:with => /\A[[:alnum:]_\-@\.]*\Z/}, :length => {:maximum => 100}
|
|
f2c78d4a | Joseph Magen | validates :auth_source_id, :presence => true
|
|
validates :password_hash, :presence => true, :if => Proc.new {|user| user.manage_password?}
|
|||
7a4ec5cf | Paul Kelly | validates_confirmation_of :password, :if => Proc.new {|user| user.manage_password?}, :unless => Proc.new {|user| user.password.empty?}
|
|
1678e0e1 | Dominic Cleal | validates :firstname, :lastname, :format => {:with => name_format}, :length => {:maximum => 50}, :allow_nil => true
|
|
bae665de | Marek Hulan | validate :name_used_in_a_usergroup, :ensure_admin_is_not_renamed, :ensure_admin_remains_admin,
|
|
7e1f0c79 | Daniel Lobato | :ensure_privileges_not_escalated, :default_organization_inclusion, :default_location_inclusion
|
|
fe728c74 | Ohad Levy | before_validation :prepare_password, :normalize_mail
|
|
e170c321 | Olivier Favre | after_destroy Proc.new {|user| user.compute_resources.clear; user.domains.clear; user.hostgroups.clear}
|
|
9fd7478e | Paul Kelly | ||
4a8190ef | Ohad Levy | scoped_search :on => :login, :complete_value => :true
|
|
scoped_search :on => :firstname, :complete_value => :true
|
|||
scoped_search :on => :lastname, :complete_value => :true
|
|||
scoped_search :on => :mail, :complete_value => :true
|
|||
acfbc458 | Marek Hulan | scoped_search :on => :admin, :complete_value => { :true => true, :false => false }, :ext_method => :search_by_admin
|
|
273b110a | Amos Benari | scoped_search :on => :last_login_on, :complete_value => :true, :only_explicit => true
|
|
57280886 | Greg Sutcliffe | scoped_search :in => :roles, :on => :name, :rename => :role, :complete_value => true
|
|
acfbc458 | Marek Hulan | scoped_search :in => :cached_usergroups, :on => :name, :rename => :usergroup, :complete_value => true
|
|
4a8190ef | Ohad Levy | ||
611f5bff | Amos Benari | default_scope lambda {
|
|
with_taxonomy_scope do
|
|||
order('firstname')
|
|||
end
|
|||
}
|
|||
acfbc458 | Marek Hulan | def can?(permission, subject = nil)
|
|
if self.admin?
|
|||
true
|
|||
else
|
|||
@authorizer ||= Authorizer.new(self)
|
|||
@authorizer.can?(permission, subject)
|
|||
end
|
|||
end
|
|||
def self.search_by_admin(key, operator, value)
|
|||
value = value == 'true'
|
|||
value = !value if operator == '<>'
|
|||
conditions = [self.table_name, Usergroup.table_name].map do |base|
|
|||
"(#{base}.admin = ?" + (value ? ')' : " OR #{base}.admin IS NULL)")
|
|||
end
|
|||
conditions = conditions.join(value ? ' OR ' : ' AND ')
|
|||
{
|
|||
:include => :cached_usergroups,
|
|||
:conditions => sanitize_sql_for_conditions([conditions, value, value])
|
|||
}
|
|||
end
|
|||
# note that if you assign user new usergroups which change the admin flag you must save
|
|||
# the record before #admin? will reflect this
|
|||
def admin?
|
|||
read_attribute(:admin) || cached_usergroups.any?(&:admin?)
|
|||
end
|
|||
1ba05a93 | Ohad Levy | def to_label
|
|
6f85b289 | Joseph Mitchell Magen | (firstname.present? || lastname.present?) ? "#{firstname} #{lastname}" : login
|
|
1ba05a93 | Ohad Levy | end
|
|
9c0e127b | Paul Kelly | alias_method :name, :to_label
|
|
01984fb7 | Amos Benari | def to_param
|
|
"#{id}-#{login.parameterize}"
|
|||
end
|
|||
9c0e127b | Paul Kelly | def <=>(other)
|
|
9fd7478e | Paul Kelly | self.name.downcase <=> other.name.downcase
|
|
9c0e127b | Paul Kelly | end
|
|
# The text item to see in a select dropdown menu
|
|||
def select_title
|
|||
6874bbd9 | Paul Kelly | to_label + " (#{login})"
|
|
9c0e127b | Paul Kelly | end
|
|
1ba05a93 | Ohad Levy | ||
f5df7d44 | Paul Kelly | def self.create_admin
|
|
76607ed5 | Ohad Levy | email = Setting[:administrator]
|
|
384005e7 | Martin Bačovský | user = User.new(:login => "admin", :firstname => "Admin", :lastname => "User",
|
|
9fd7478e | Paul Kelly | :mail => email, :auth_source => AuthSourceInternal.first, :password => "changeme")
|
|
f5df7d44 | Paul Kelly | user.update_attribute :admin, true
|
|
384005e7 | Martin Bačovský | old_current = User.current
|
|
User.current = user
|
|||
user.save!
|
|||
f5df7d44 | Paul Kelly | user
|
|
384005e7 | Martin Bačovský | ensure
|
|
User.current = old_current
|
|||
f5df7d44 | Paul Kelly | end
|
|
518d50bb | Petr Chalupa | def self.admin
|
|
82c35b15 | Ohad Levy | unscoped.find_by_login 'admin' or create_admin
|
|
518d50bb | Petr Chalupa | end
|
|
9fd7478e | Paul Kelly | # Tries to find the user in the DB and then authenticate against their authentication source
|
|
64ca11af | Ohad Levy | # If the user is not in the DB then try to login the user on each available authentication source
|
|
9fd7478e | Paul Kelly | # If this succeeds then copy the user's details from the authentication source into the User table
|
|
# Returns : User object OR nil
|
|||
1ba05a93 | Ohad Levy | def self.try_to_login(login, password)
|
|
# Make sure no one can sign in with an empty password
|
|||
return nil if password.to_s.empty?
|
|||
9fd7478e | Paul Kelly | ||
884c9b25 | Ohad Levy | # user is already in local database
|
|
9d0473aa | Ohad Levy | if (user = unscoped.find_by_login(login))
|
|
884c9b25 | Ohad Levy | # user has an authentication method and the authentication was successful
|
|
d424cab5 | Stephen Benjamin | if user.auth_source and attrs=user.auth_source.authenticate(login, password)
|
|
884c9b25 | Ohad Levy | logger.debug "Authenticated user #{user} against #{user.auth_source} authentication source"
|
|
d424cab5 | Stephen Benjamin | ||
# update with returned attrs, maybe some info changed in LDAP
|
|||
old_hash = user.avatar_hash
|
|||
User.as :admin do
|
|||
2fe12e2c | Stephen Benjamin | user.update_attributes(attrs.slice(:firstname, :lastname, :mail, :avatar_hash).delete_if { |k, v| v.blank? })
|
|
d424cab5 | Stephen Benjamin | end if attrs.is_a? Hash
|
|
# clean up old avatar if it exists and the image isn't in use by anyone else
|
|||
if old_hash.present? && user.avatar_hash != old_hash && !User.unscoped.where(:avatar_hash => old_hash).any?
|
|||
File.delete "#{Rails.public_path}/avatars/#{old_hash}.jpg" if File.exist? old_avatar
|
|||
end
|
|||
9fd7478e | Paul Kelly | else
|
|
64ca11af | Ohad Levy | logger.debug "Failed to authenticate #{user} against #{user.auth_source} authentication source"
|
|
884c9b25 | Ohad Levy | user = nil
|
|
1ba05a93 | Ohad Levy | end
|
|
else
|
|||
884c9b25 | Ohad Levy | user = try_to_auto_create_user(login, password)
|
|
end
|
|||
if user
|
|||
b7589c32 | Jan Pazdziora | user.post_successful_login
|
|
884c9b25 | Ohad Levy | else
|
|
logger.info "invalid user"
|
|||
User.current = nil
|
|||
1ba05a93 | Ohad Levy | end
|
|
884c9b25 | Ohad Levy | user
|
|
1ba05a93 | Ohad Levy | end
|
|
b7589c32 | Jan Pazdziora | def post_successful_login
|
|
User.as "admin" do
|
|||
self.update_attribute(:last_login_on, Time.now.utc)
|
|||
anonymous = Role.find_by_name("Anonymous")
|
|||
self.roles << anonymous unless self.roles.include?(anonymous)
|
|||
User.current = self
|
|||
end
|
|||
end
|
|||
8ffa0b9a | Jan Pazdziora | def self.find_or_create_external_user(attrs, auth_source_name)
|
|
1e8a5084 | Jan Pazdziora | external_groups = attrs.delete(:groups)
|
|
auth_source = AuthSource.find_by_name(auth_source_name)
|
|||
# existing user, we'll update them
|
|||
8ffa0b9a | Jan Pazdziora | if (user = unscoped.find_by_login(attrs[:login]))
|
|
1e8a5084 | Jan Pazdziora | # we know this auth source and it's user's auth source, we'll update user attributes
|
|
if auth_source && (user.auth_source_id == auth_source.id)
|
|||
auth_source_external_groups = auth_source.external_usergroups.pluck(:usergroup_id)
|
|||
new_usergroups = user.usergroups.includes(:external_usergroups).where('usergroups.id NOT IN (?)', auth_source_external_groups)
|
|||
new_usergroups += auth_source.external_usergroups.includes(:usergroup).where(:name => external_groups).map(&:usergroup)
|
|||
user.update_attributes(Hash[attrs.select { |k, v| v.present? }])
|
|||
user.usergroups = new_usergroups.uniq
|
|||
end
|
|||
b7589c32 | Jan Pazdziora | return true
|
|
1e8a5084 | Jan Pazdziora | # not existing user and creating is disabled by settings
|
|
b7589c32 | Jan Pazdziora | elsif auth_source_name.nil?
|
|
return false
|
|||
1e8a5084 | Jan Pazdziora | # not existing user and auth source is set, we'll create the user and auth source if needed
|
|
b7589c32 | Jan Pazdziora | else
|
|
User.as :admin do
|
|||
1e8a5084 | Jan Pazdziora | auth_source = AuthSourceExternal.create!(:name => auth_source_name) if auth_source.nil?
|
|
8ffa0b9a | Jan Pazdziora | user = User.create!(attrs.merge(:auth_source => auth_source))
|
|
fdc476db | Jan Pazdziora | if external_groups.present?
|
|
1e8a5084 | Jan Pazdziora | user.usergroups = auth_source.external_usergroups.where(:name => external_groups).map(&:usergroup).uniq
|
|
fdc476db | Jan Pazdziora | end
|
|
b7589c32 | Jan Pazdziora | user.post_successful_login
|
|
end
|
|||
return true
|
|||
end
|
|||
end
|
|||
7a4ec5cf | Paul Kelly | def matching_password?(pass)
|
|
self.password_hash == encrypt_password(pass)
|
|||
end
|
|||
9fd7478e | Paul Kelly | def my_usergroups
|
|
9c0e127b | Paul Kelly | all_groups = []
|
|
for usergroup in usergroups
|
|||
all_groups += usergroup.all_usergroups
|
|||
end
|
|||
9fd7478e | Paul Kelly | all_groups.uniq
|
|
end
|
|||
def indirect_hosts
|
|||
my_usergroups.map{|g| g.hosts}.flatten.uniq
|
|||
9c0e127b | Paul Kelly | end
|
|
def hosts
|
|||
direct_hosts + indirect_hosts
|
|||
end
|
|||
def recipients
|
|||
[mail]
|
|||
end
|
|||
7a4ec5cf | Paul Kelly | def manage_password?
|
|
auth_source and auth_source.can_set_password?
|
|||
end
|
|||
9fd7478e | Paul Kelly | # Return true if the user is allowed to do the specified action
|
|
# action can be:
|
|||
# * a parameter-like Hash (eg. :controller => 'projects', :action => 'edit')
|
|||
# * a permission Symbol (eg. :edit_project)
|
|||
355bce36 | Ohad Levy | def allowed_to?(action)
|
|
9fd7478e | Paul Kelly | return true if admin?
|
|
355bce36 | Ohad Levy | if action.is_a? Hash
|
|
# normalize controller name
|
|||
action[:controller] = action[:controller].to_s.gsub(/::/, "_").sub(/^\//,'').underscore
|
|||
return true if editing_self?(action)
|
|||
end
|
|||
acfbc458 | Marek Hulan | cached_roles.detect {|role| role.allowed_to?(action)}.present?
|
|
9fd7478e | Paul Kelly | end
|
|
def logged?
|
|||
true
|
|||
end
|
|||
# Indicates whether the user has host filtering enabled
|
|||
# Returns : Boolean
|
|||
def filtering?
|
|||
e170c321 | Olivier Favre | filter_on_owner or
|
|
compute_resources.any? or
|
|||
domains.any? or
|
|||
hostgroups.any? or
|
|||
611f5bff | Amos Benari | facts.any? or
|
|
locations.any? or
|
|||
organizations.any?
|
|||
9fd7478e | Paul Kelly | end
|
|
bae665de | Marek Hulan | # user must be assigned all given roles in order to delegate them
|
|
def can_assign?(roles)
|
|||
can_change_admin_flag? || roles.all? { |r| self.role_ids_was.include?(r) }
|
|||
end
|
|||
# only admin can change admin flag
|
|||
def can_change_admin_flag?
|
|||
self.admin?
|
|||
end
|
|||
def role_ids_with_change_detection=(roles)
|
|||
615ff085 | Marek Hulan | roles ||= [] # in API, role_ids is converted to nil if user sent empty array
|
|
bae665de | Marek Hulan | @role_ids_changed = roles.uniq.select(&:present?).map(&:to_i).sort != role_ids.sort
|
|
@role_ids_was = role_ids.clone
|
|||
self.role_ids_without_change_detection = roles
|
|||
end
|
|||
alias_method_chain(:role_ids=, :change_detection)
|
|||
def role_ids_changed?
|
|||
@role_ids_changed
|
|||
end
|
|||
def role_ids_was
|
|||
@role_ids_was ||= role_ids
|
|||
end
|
|||
355bce36 | Ohad Levy | def editing_self?(options = {})
|
|
options[:controller].to_s == 'users' &&
|
|||
options[:action] =~ /edit|update/ &&
|
|||
options[:id].to_i == self.id
|
|||
end
|
|||
1fa008a4 | Joseph Magen | def taxonomy_foreign_conditions
|
|
{ :owner_id => id }
|
|||
end
|
|||
7e1f0c79 | Daniel Lobato | def set_current_taxonomies
|
|
['location', 'organization'].each do |taxonomy|
|
|||
default_taxonomy = self.send "default_#{taxonomy}"
|
|||
if default_taxonomy.present?
|
|||
taxonomy.classify.constantize.send 'current=', default_taxonomy
|
|||
session["#{taxonomy}_id"] = default_taxonomy.id
|
|||
end
|
|||
end
|
|||
TopbarSweeper.expire_cache(self)
|
|||
end
|
|||
53516db7 | Joseph Magen | def taxonomy_and_child_ids(taxonomies)
|
|
ids = []
|
|||
send(taxonomies).each do |taxonomy|
|
|||
ids += taxonomy.subtree_ids
|
|||
end
|
|||
return ids.uniq
|
|||
end
|
|||
def location_and_child_ids
|
|||
taxonomy_and_child_ids(:locations)
|
|||
end
|
|||
def organization_and_child_ids
|
|||
taxonomy_and_child_ids(:organizations)
|
|||
end
|
|||
7a4ec5cf | Paul Kelly | private
|
|
def prepare_password
|
|||
unless password.blank?
|
|||
self.password_salt = Digest::SHA1.hexdigest([Time.now, rand].join)
|
|||
self.password_hash = encrypt_password(password)
|
|||
end
|
|||
end
|
|||
def encrypt_password(pass)
|
|||
Digest::SHA1.hexdigest([pass, password_salt].join)
|
|||
end
|
|||
9c0e127b | Paul Kelly | ||
884c9b25 | Ohad Levy | def self.try_to_auto_create_user(login, password)
|
|
return nil if login.blank? or password.blank?
|
|||
# user is not yet registered, try to authenticate with available sources
|
|||
67799065 | Ohad Levy | if (attrs = AuthSource.authenticate(login, password))
|
|
64ca11af | Ohad Levy | user = new(attrs)
|
|
884c9b25 | Ohad Levy | user.login = login
|
|
# The default user can't auto create users, we need to change to Admin for this to work
|
|||
User.as "admin" do
|
|||
if user.save
|
|||
logger.info "User '#{user.login}' auto-created from #{user.auth_source}"
|
|||
else
|
|||
logger.info "Failed to save User '#{user.login}' #{user.errors.full_messages}"
|
|||
user = nil
|
|||
end
|
|||
end
|
|||
017e1049 | Ohad Levy | user
|
|
884c9b25 | Ohad Levy | end
|
|
end
|
|||
e2c2abfe | Lukas Zapletal | def normalize_locale
|
|
a2a5a5fe | Greg Sutcliffe | if self.respond_to?(:locale)
|
|
self.locale = nil if locale.empty?
|
|||
end
|
|||
e2c2abfe | Lukas Zapletal | end
|
|
fe728c74 | Ohad Levy | def normalize_mail
|
|
self.mail.gsub!(/\s/,'') unless mail.blank?
|
|||
end
|
|||
9fd7478e | Paul Kelly | protected
|
|
7a4ec5cf | Paul Kelly | def name_used_in_a_usergroup
|
|
9c0e127b | Paul Kelly | if Usergroup.all.map(&:name).include?(self.login)
|
|
bfbf7ed8 | Lukas Zapletal | errors.add(:base, _("A user group already exists with this name"))
|
|
9c0e127b | Paul Kelly | end
|
|
end
|
|||
f5df7d44 | Paul Kelly | # The internal Admin Account is always available
|
|
# this is required as when not using external authentication, the systems logs you in with the
|
|||
# admin account automatically
|
|||
def ensure_admin_is_not_deleted
|
|||
if login == "admin"
|
|||
e52abb10 | Marek Hulan | errors.add :base, _("Can't delete internal admin account")
|
|
9fd7478e | Paul Kelly | logger.warn "Unable to delete internal admin account"
|
|
67799065 | Ohad Levy | false
|
|
f5df7d44 | Paul Kelly | end
|
|
end
|
|||
48be0b11 | Ohad Levy | ||
6a26fecd | Dominic Cleal | # The admin account must always retain the "Administrator" flag to function
|
|
def ensure_admin_remains_admin
|
|||
if login == "admin" and admin_changed? and admin == false
|
|||
e52abb10 | Marek Hulan | errors.add :admin, _("Can't remove Administrator flag from internal protected <b>admin</b> account").html_safe
|
|
6a26fecd | Dominic Cleal | end
|
|
end
|
|||
48be0b11 | Ohad Levy | def ensure_admin_is_not_renamed
|
|
if login_changed? and login_was == "admin"
|
|||
e52abb10 | Marek Hulan | errors.add :login, (_("Can't rename internal protected <b>admin</b> account to %s") % login).html_safe
|
|
48be0b11 | Ohad Levy | end
|
|
end
|
|||
bae665de | Marek Hulan | ||
def ensure_privileges_not_escalated
|
|||
ensure_admin_not_escalated
|
|||
ensure_roles_not_escalated
|
|||
end
|
|||
def ensure_roles_not_escalated
|
|||
roles_check = self.new_record? ? self.role_ids.present? : self.role_ids_changed?
|
|||
if roles_check && !User.current.can_assign?(self.role_ids)
|
|||
errors.add :role_ids, _("You can't assign some of roles you selected")
|
|||
end
|
|||
end
|
|||
def ensure_admin_not_escalated
|
|||
admin_check = self.new_record? ? self.admin? : self.admin_changed?
|
|||
if admin_check && !User.current.can_change_admin_flag?
|
|||
errors.add :admin, _("You can't change Administrator flag")
|
|||
end
|
|||
end
|
|||
355bce36 | Ohad Levy | ||
def ensure_default_role
|
|||
role = Role.find_by_name('Anonymous')
|
|||
self.roles << role unless self.role_ids.include?(role.id)
|
|||
end
|
|||
7e1f0c79 | Daniel Lobato | ||
def default_location_inclusion
|
|||
unless locations.include?(default_location) || default_location.blank? || self.admin?
|
|||
errors.add :default_location, _("Default locations need to be user locations first")
|
|||
end
|
|||
end
|
|||
def default_organization_inclusion
|
|||
unless organizations.include?(default_organization) || default_organization.blank? || self.admin?
|
|||
errors.add :default_organization, _("Default organizations need to be user organizations first")
|
|||
end
|
|||
end
|
|||
1ba05a93 | Ohad Levy | end
|