app/controllers/sessions_controller.rb
# Be sure to include AuthenticationSystem in Application Controller instead
Be sure to include AuthenticationSystem in Application Controller instead
Be sure to include AuthenticationSystem in Application Controller instead
def create
    logout_keeping_session!
    user = User.authenticate(params[:login], params[:password])
    if user
      self.current_user = user
      new_cookie_flag = (params[:remember_me] == "1")
      handle_remember_cookie! new_cookie_flag
      redirect_back_or_default(fresh_tickets_url)
      flash[:notice] = "Logged in successfully"
    else
      note_failed_signin
      @login       = params[:login]
      @remember_me = params[:remember_me]
      render :action => 'new'
    end
  end
def create logout_keeping_session! user = User . authenticate ( params [ :login ] , params [ :password ] ) if user self . current_user = user new_cookie_flag = ( params [ :remember_me ] == "1" ) handle_remember_cookie! new_cookie_flag redirect_back_or_default ( fresh_tickets_url ) flash [ :notice ] = "Logged in successfully" else note_failed_signin @login = params [ :login ] @remember_me = params [ :remember_me ] render :action => 'new' end end
Be sure to include AuthenticationSystem in Application Controller instead
Be sure to include AuthenticationSystem in Application Controller instead
# Protects against session fixation attacks, causes request forgery # protection if user resubmits an earlier form using back # button. Uncomment if you understand the tradeoffs. # reset_session