bugfixes and updated go.mod

pkg/server/context.go

@@ -27,53 +27,19 @@ const (
 	refererClaim     = "referer"
 )
 
-func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Context) {
+func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) *Context {
 	h := w.Header()
 	h.Set("X-Frame-Options", "DENY")
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("X-XSS-Protection", "1; mode=block")
 	h.Set("Content-Security-Policy", "default-src 'none';style-src 'self';img-src 'self' https: data:;connect-src 'self';frame-ancestors 'none'")
 	h.Set("Referrer-Policy", "same-origin")
-	ctx = &Context{
+	return &Context{
 		Request:  r,
 		Response: w,
 		Srv:      s,
 		Time:     time.Now(),
 	}
-	path := ctx.Path()
-	if path == "/bootstrap.css" || path == "/custom.css" {
-		return
-	}
-
-	if c, err := r.Cookie(cookieName); err == nil {
-		t, err := jwt.DecodeToken(c.Value)
-		if err != nil {
-			ctx.LogSetCookie("DecodeToken:", err)
-			return
-		}
-		if err = s.JWT.Verify(t); err != nil {
-			ctx.LogSetCookie("VerifyToken:", err)
-			return
-		}
-		if t.Claims.GetString(totpClaim) != "" {
-			if path == core.TotpURI || path == core.LoginURI || path == core.LogoutURI {
-				ctx.Token = *t
-				return
-			}
-			ctx.Redirect(core.TotpURI, http.StatusFound)
-			return nil
-
-		}
-		if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(userCreatedClaim)) {
-			ctx.Token = *t
-			return
-		}
-		if err = s.JWT.Invalidate(t); err != nil {
-			log.Println("Invalidate:", err)
-		}
-	}
-	ctx.SetCookie(nil, 0)
-	return
 }
 
 type Context struct {
@@ -132,7 +98,10 @@ func (c *Context) Exec() {
 		c.Err = errors.New("template is nil")
 		return
 	}
-	c.Data.Token = newXsrf(c.Token.RawSig()[:keySize])
+	sig := c.Token.RawSig()
+	if len(sig) >= keySize {
+		c.Data.Token = newXsrf(sig[:keySize])
+	}
 
 	c.Data.Version = c.Srv.Config.Version
 	if c.Data.BodyTitle == "" {