Skip to content

Commit

Permalink
slight modification to showing privacy notice updates
Browse files Browse the repository at this point in the history
  • Loading branch information
mwvolo committed Dec 1, 2023
1 parent e095142 commit d983315
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 7 deletions.
10 changes: 5 additions & 5 deletions app/controllers/newflow/login_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,13 @@ class LoginController < BaseController
GO_TO_STUDENT_SIGNUP = 'student_signup'
GO_TO_SIGNUP = 'signup'

prepend_before_action :did_sign_privacy_notice, if: -> { signed_in? }, only: :login_form
fine_print_skip :general_terms_of_use, :privacy_policy, except: :profile_newflow

before_action :cache_client_app, only: :login_form
before_action :known_signup_role_redirect, only: :login_form
before_action :cache_alternate_signup_url, only: :login_form
before_action :redirect_to_signup_if_go_param_present, only: :login_form
before_action :redirect_back, if: -> { signed_in? }, only: :login_form
before_action :redirect_back, if: -> { signed_in? && did_sign_recent_privacy_notice? }, only: :login_form

def login
handle_with(
Expand All @@ -37,7 +36,7 @@ def login
sign_in!(user, security_log_data: {'email': @handler_result.outputs.email})

if current_user.student? || !current_user.is_newflow? || (edu_newflow_activated? && decorated_user.can_do?('redirect_back_upon_login'))
redirect_back # back to `r`edirect parameter. See `before_action :save_redirect`.
redirect_back
else
redirect_to(decorated_user.next_step)
end
Expand Down Expand Up @@ -88,11 +87,12 @@ def cache_alternate_signup_url
set_alternate_signup_url(params[:signup_at])
end

def did_sign_privacy_notice
def did_sign_recent_privacy_notice?
contract = FinePrint.get_contract(:privacy_policy)
unless contract.signed_by?(current_user)
redirect_to pose_term_url(name: contract.name, params: request.params)
false
end
true
end
end
end
9 changes: 7 additions & 2 deletions app/controllers/terms_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,13 @@ def pose_by_name
def agree
handle_with(
TermsAgree, complete: -> do
params[:r].present? && Host.trusted?(params[:r]) ?
redirect_to(params[:r]) : fine_print_return
if params[:r].present? && Host.trusted?(params[:r])
redirect_to(params[:r])

Check warning

Code scanning / CodeQL

URL redirection from remote source Medium

Untrusted URL redirection depends on a
user-provided value
.
elsif !session[:return_to].nil? && Host.trusted?(session[:return_to])
redirect_to(session[:return_to])
else
fine_print_return
end
end
)
end
Expand Down

0 comments on commit d983315

Please sign in to comment.