oauth_client: ensure that the signup email is the same provided by oauth

Victor Costa
1 parent 2d1fb53a
Showing 3 changed files with 12 additions and 4 deletions Show diff stats
plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb
plugins/oauth_client/lib/oauth_client_plugin.rb
plugins/oauth_client/views/account/_oauth_signup.html.erb
@@ -9,6 +9,7 @@ class OauthClientPluginPublicController &lt; PublicController
       session[:user] = user
       redirect_to :controller => :account, :action => :login
     else
+      session[:oauth_email] = auth.info.email
       name = auth.info.name
       name ||= auth.extra && auth.extra.raw_info ? auth.extra.raw_info.name : ''
       redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email, :oauth_providers => [{:provider => auth.provider, :uid => auth.uid}]}, :profile_data => {:name => name}
@@ -69,4 +69,8 @@ class OauthClientPlugin &lt; Noosfero::Plugin
     end
   end
+  def account_controller_filters
+    {:type => 'before_filter', :method_name => 'signup', :block => proc { raise "Wrong email for oauth signup" if request.post? && session[:oauth_email].present? && session[:oauth_email] != params[:user][:email] } }
+  end
+
 end
@@ -2,10 +2,13 @@
 <%= hidden_field_tag 'user[oauth_providers][][uid]', @user.oauth_providers.first[:uid] %>
 <style>
-  #signup-password {
-    display: none;
-  }
-  #signup-password-confirmation {
+  #signup-password,
+  #signup-password-confirmation,
+  #signup-email {
     display: none;
   }
 </style>
+
+<div id='signup-email-readonly'>
+  <%= labelled_form_field(_('Email'), text_field(:user, :email, :class => "disabled", :readonly => true)) %>
+</div>
	@@ -69,4 +69,8 @@ class OauthClientPlugin < Noosfero::Plugin		@@ -69,4 +69,8 @@ class OauthClientPlugin < Noosfero::Plugin
69	end	69	end
70	end	70	end
71		71
		72	+ def account_controller_filters
		73	+ {:type => 'before_filter', :method_name => 'signup', :block => proc { raise "Wrong email for oauth signup" if request.post? && session[:oauth_email].present? && session[:oauth_email] != params[:user][:email] } }
		74	+ end
		75	+
72	end	76	end