ston1th/gowiki
0
0
Fork 0
Code Issues 2 Releases Activity

added prefix scan and fixed logout issue

Browse source
This commit is contained in:
ston1th 2019-07-06 11:31:12 +02:00
commit 8143e484cd
12 changed files with 99 additions and 77 deletions
Download patch file Download diff file Expand all files Collapse all files

10
pkg/server/context.go
View file

@ -25,6 +25,8 @@ const (
totpClaim = "totp"
rememberClaim = "remember"
refererClaim = "referer"
empty = "(empty)"
)
func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) *Context {
@ -211,6 +213,14 @@ func (c *Context) Var(name string) (ret string) {
return
}
func (c *Context) Forwarded() (ret string) {
ret = c.Request.Header.Get("X-Forwarded-For")
if ret == "" {
ret = empty
}
return
}
// CheckXsrf validates the xsrf token
func (c *Context) CheckXsrf() (ok bool) {
ok = checkXsrf(c.Form("token"), c.Token.RawSig()[:keySize])

22
pkg/server/handler.go
View file

@ -26,10 +26,12 @@ func jwtHandler(h ctxHandler) ctxHandler {
t, err := jwt.DecodeToken(c.Value)
if err != nil {
ctx.LogSetCookie("DecodeToken:", err)
ctx.Redirect(core.IndexURI, http.StatusFound)
return
}
if err = ctx.Srv.JWT.Verify(t); err != nil {
ctx.LogSetCookie("VerifyToken:", err)
ctx.Redirect(core.IndexURI, http.StatusFound)
return
}
if t.Claims.GetString(totpClaim) != "" {
@ -156,7 +158,7 @@ func loginHandler(ctx *Context) {
}
u, err := ctx.Srv.DB.Login(data.User, password)
if err != nil {
log.Println("login:", data.User, err)
log.Printf("login: %s from: %s %s", data.User, ctx.Forwarded(), err)
ctx.Error("bad username or password")
return
}
@ -197,8 +199,10 @@ func loginTotpHandler(ctx *Context) {
ctx.Error("empty pin")
return
}
u, err := ctx.Srv.DB.Totp(ctx.Totp(), pin)
user := ctx.Totp()
u, err := ctx.Srv.DB.Totp(user, pin)
if err != nil {
log.Printf("totp: %s from: %s %s", user, ctx.Forwarded(), err)
ctx.Error(err)
return
}
@ -875,12 +879,20 @@ func userDelHandler(ctx *Context) {
}
func logoutHandler(ctx *Context) {
var totp string
user := ctx.User()
if user == "" {
user = ctx.Totp() + " (totp)"
user = ctx.Totp()
if user != "" {
totp = " (totp)"
}
}
log.Println("logout:", user)
ctx.Srv.JWT.Invalidate(&ctx.Token)
if user != "" {
ctx.Srv.JWT.Invalidate(&ctx.Token)
} else {
user = empty
}
log.Printf("logout: %s%s", user, totp)
ctx.SetCookie(nil, 0)
ctx.Redirect(core.IndexURI, http.StatusFound)
}