Freshrss: Login user automatically after creation

[marienfressinaud]

When a user creates a new account, he's redirected to the login page.

It's expected to be logged in at the same time and to be redirected to the main interface.

A solution would be to change app/Controllers/userController.php, createAction method with something like that line 232:

Minz_Session::_param('currentUser', $username);
Minz_Session::_param('passwordHash', $password_hash);
FreshRSS_Auth::giveAccess();

What do you think?

[Alkarex]

I had almost forgotten that FreshRSS has the possibility for users to create accounts themselves, if the admin allows it :-)

https://github.com/FreshRSS/FreshRSS/blob/da025ed35650ba49b9aede5e92c33ea9118a6a69/app/Controllers/userController.php#L219-L245

I can see advantages with both approaches, so I do not really mind.
Probably should only be executed is $ok === true. And of course, $password_hash should be computed.

@marienfressinaud You are welcome to make a little PR; it's been a while ;-)

Related notes:

• Maybe we should re-introduce the e-mail field (e.g. for password recovery)
• Maybe we could have GDPR guidelines for people in EU hosting several users. There is already a number of measures in FreshRSS to avoid leaking too much what what users reads what.

[marienfressinaud]

Sure, I can work on this!

I may open more tickets in next few days, I conducted a test with two users, in collaboration with a UX designer and I had a lot of feedback :) I still have to analyze a bit the results to avoid to open too much tickets.

[Alkarex]

Ah yes, probably https://social.tcit.fr/@Gavy/100169683750698495
Many PRs are not a problem ;-)

[marienfressinaud]

Indeed :)

[marienfressinaud]

I started to work on this tonight but I'm facing a strange behaviour, maybe you'll have an idea of what's going on.

I added the lines that I thought would work (didn't forget to hash the plain password) but it looked like it wasn't working. I added logs to understand and it seems that currentUser doesn't change :/

The patch: https://github.com/FreshRSS/FreshRSS/compare/dev...marienfressinaud:1928-login-user-automatically-after-creation
Result:

[Mon, 11 Jun 2018 21:10:37 +0000] [error] --- key=currentUser
[Mon, 11 Jun 2018 21:10:37 +0000] [error] --- value=Marien
[Mon, 11 Jun 2018 21:10:37 +0000] [error] --- session=demo

Note that demo is my default user.

[Alkarex]

Are you actually entering the $ok block?

https://github.com/marienfressinaud/FreshRSS/blob/c5c1cb26b93699204258e0c19a1fd85b3b12a0ae/app/Controllers/userController.php#L233-L238

[marienfressinaud]

I do! But I realized this morning that probably the logs appear in the file of the other user then! I'll try by forcing to write in a specific file tonight

[marienfressinaud]

Ok, this is it: the rest of the logs appear in another file. The problem is that currentUser seems to be reset to demo value somewhere. Still investigating!

[marienfressinaud]

It took me some time to understand that hashPassword returns a different hash at each call :upside_down_face: It should work now!

[marienfressinaud]

Btw, the auth system is really hard to understand (and yes, I know it is me that developed it :D)

[Alkarex]

Implemented in https://github.com/FreshRSS/FreshRSS/pull/1941