diff --git a/go.mod b/go.mod
index 40aef54..ff547fb 100644
--- a/go.mod
+++ b/go.mod
@@ -2,7 +2,7 @@ module git.giftfish.de/ston1th/gowiki
require (
git.giftfish.de/ston1th/godrop/v2 v2.1.0
- git.giftfish.de/ston1th/jwt/v3 v3.1.0
+ git.giftfish.de/ston1th/jwt/v3 v3.2.0
github.com/RoaringBitmap/roaring v0.4.16 // indirect
github.com/Smerity/govarint v0.0.0-20150407073650-7265e41f48f1 // indirect
github.com/blevesearch/bleve v0.7.0
diff --git a/go.sum b/go.sum
index 51cae3d..3297e59 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
git.giftfish.de/ston1th/godrop/v2 v2.1.0 h1:vR4aWVeMGJ+tHQH0p44esZrSl5dYJzuCmZqhKWP/vwI=
git.giftfish.de/ston1th/godrop/v2 v2.1.0/go.mod h1:z8KA3HP/vB04wddLXZfYVKURYDxBGau9hlHtV61x9mM=
-git.giftfish.de/ston1th/jwt/v3 v3.1.0 h1:SaSpVyl98iqnsRIh9tA8/XJpU6nCYIGa4L85rLvQWC0=
-git.giftfish.de/ston1th/jwt/v3 v3.1.0/go.mod h1:jDALrW7OKeIaqYuMxs3GWyPRnQZmk/R+Lu9p/Em3Ziw=
+git.giftfish.de/ston1th/jwt/v3 v3.2.0 h1:V6Lh7OjXn4D3HPd/LoDf7w5N7cyiSXEPAQCIfSVZ05c=
+git.giftfish.de/ston1th/jwt/v3 v3.2.0/go.mod h1:jDALrW7OKeIaqYuMxs3GWyPRnQZmk/R+Lu9p/Em3Ziw=
github.com/RoaringBitmap/roaring v0.4.16 h1:NholfewybRLOwACgfqfzn/N5xa6keKNs4fP00t0cwLo=
github.com/RoaringBitmap/roaring v0.4.16/go.mod h1:8khRDP4HmeXns4xIj9oGrKSz7XTQiJx2zgh7AcNke4w=
github.com/Smerity/govarint v0.0.0-20150407073650-7265e41f48f1 h1:G/NOANWMQev0CftoyxQwtRakdyNNNMB3qxkt/tj1HGs=
diff --git a/pkg/server/context.go b/pkg/server/context.go
index f711b9e..deb264d 100644
--- a/pkg/server/context.go
+++ b/pkg/server/context.go
@@ -14,14 +14,15 @@ import (
)
const (
- userClaim = "user"
- adminClaim = "admin"
- createdClaim = "created"
- sharedClaim = "shared"
- sectionClaim = "section"
- titleClaim = "title"
- totpClaim = "totp"
- rememberClaim = "remember"
+ userClaim = "user"
+ adminClaim = "admin"
+ userCreatedClaim = "user_created"
+ pageCreatedClaim = "page_created"
+ sharedClaim = "shared"
+ sectionClaim = "section"
+ titleClaim = "title"
+ totpClaim = "totp"
+ rememberClaim = "remember"
)
func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Context) {
@@ -60,7 +61,7 @@ func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Con
return nil
}
- if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(createdClaim)) {
+ if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(userCreatedClaim)) {
ctx.Token = *t
return
}
@@ -239,7 +240,7 @@ func (c *Context) Login(u core.User, remember string) {
if remember != "" {
d = day * 7
}
- c.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin}, d)
+ c.SetCookie(jwt.Claims{userClaim: u.Username, userCreatedClaim: u.Created, adminClaim: u.Admin}, d)
}
func (c *Context) SetCookie(claims jwt.Claims, d time.Duration) {
diff --git a/pkg/server/handler.go b/pkg/server/handler.go
index 68d6bc4..f4718f5 100644
--- a/pkg/server/handler.go
+++ b/pkg/server/handler.go
@@ -251,13 +251,15 @@ func pageNewHandler(ctx *Context) {
}
func pageHandler(ctx *Context) {
+ var pageCreated string
ctx.Data = webData{
Admin: ctx.Admin(),
}
section := ctx.Var("section")
title := ctx.Var("title")
user := ctx.User()
- if key := ctx.Var("key"); key != "" {
+ key := ctx.Var("key")
+ if key != "" {
t, err := jwt.DecodeToken(key)
if err != nil {
log.Println("share: DecodeToken:", err)
@@ -270,7 +272,7 @@ func pageHandler(ctx *Context) {
return
}
user = t.Claims.GetString(sharedClaim)
- if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(createdClaim)) {
+ if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(userCreatedClaim)) {
if err = ctx.Srv.JWT.Invalidate(t); err != nil {
log.Println("share: Invalidate:", err)
}
@@ -279,6 +281,7 @@ func pageHandler(ctx *Context) {
}
section = t.Claims.GetString(sectionClaim)
title = t.Claims.GetString(titleClaim)
+ pageCreated = t.Claims.GetString(pageCreatedClaim)
ctx.Data.Key = key
if ctx.T == nil {
ctx.Template("pageViewHandler")
@@ -294,6 +297,10 @@ func pageHandler(ctx *Context) {
ctx.NotFound()
return
}
+ if key != "" && page.Created != pageCreated {
+ ctx.NotFound()
+ return
+ }
ctx.Data.Data = page
ctx.Data.Title = page.Title
ctx.Data.BodyTitle = page.Title
@@ -339,11 +346,12 @@ func pageShareHandler(ctx *Context) {
return
}
t := jwt.NewToken(map[string]interface{}{
- sharedClaim: user,
- createdClaim: ctx.Token.Claims.GetString(createdClaim),
- sectionClaim: section,
- titleClaim: title,
- jwt.ExpClaim: jwt.NewExp(d),
+ sharedClaim: user,
+ userCreatedClaim: ctx.Token.Claims.GetString(userCreatedClaim),
+ pageCreatedClaim: page.Created,
+ sectionClaim: section,
+ titleClaim: title,
+ jwt.ExpClaim: jwt.NewExp(d),
}, nil)
if err = ctx.Srv.JWT.Sign(t); err != nil {
diff --git a/pkg/server/templates.go b/pkg/server/templates.go
index 417cd81..972c6cd 100644
--- a/pkg/server/templates.go
+++ b/pkg/server/templates.go
@@ -396,7 +396,7 @@ const (
-
+
diff --git a/pkg/server/xsrf.go b/pkg/server/xsrf.go
index d795917..a3748ac 100644
--- a/pkg/server/xsrf.go
+++ b/pkg/server/xsrf.go
@@ -22,11 +22,11 @@ func genKey(length int) (bytes []byte) {
func newXsrf(secret []byte) string {
rnd := genKey(keySize)
- return base64.StdEncoding.EncodeToString(append(rnd, xor(rnd, secret)...))
+ return base64.RawStdEncoding.EncodeToString(append(rnd, xor(rnd, secret)...))
}
func checkXsrf(xsrf string, secret []byte) bool {
- t, err := base64.StdEncoding.DecodeString(xsrf)
+ t, err := base64.RawStdEncoding.DecodeString(xsrf)
if err != nil {
return false
}
diff --git a/templates/pageShare.html b/templates/pageShare.html
index 03e568f..4fe23ea 100644
--- a/templates/pageShare.html
+++ b/templates/pageShare.html
@@ -19,7 +19,7 @@
-
+
diff --git a/vendor/git.giftfish.de/ston1th/jwt/v3/encoding.go b/vendor/git.giftfish.de/ston1th/jwt/v3/encoding.go
new file mode 100644
index 0000000..73b81cf
--- /dev/null
+++ b/vendor/git.giftfish.de/ston1th/jwt/v3/encoding.go
@@ -0,0 +1,7 @@
+// Copyright (C) 2018 Marius Schellenberger
+
+package jwt
+
+import "encoding/base64"
+
+var enc = base64.RawURLEncoding
diff --git a/vendor/git.giftfish.de/ston1th/jwt/v3/jwt.go b/vendor/git.giftfish.de/ston1th/jwt/v3/jwt.go
index d77c7dd..44f82ec 100644
--- a/vendor/git.giftfish.de/ston1th/jwt/v3/jwt.go
+++ b/vendor/git.giftfish.de/ston1th/jwt/v3/jwt.go
@@ -6,7 +6,6 @@ package jwt
import (
"crypto/hmac"
"crypto/rand"
- "encoding/base64"
"encoding/json"
"errors"
"io"
@@ -210,9 +209,9 @@ func (jwt *JWT) Sign(t *Token) (err error) {
if err != nil {
return
}
- t.data = base64.URLEncoding.EncodeToString(head) + TokenSeparator + base64.URLEncoding.EncodeToString(claims)
+ t.data = enc.EncodeToString(head) + TokenSeparator + enc.EncodeToString(claims)
t.rawSignature = jwt.sum(t.data, h)
- t.signature = base64.URLEncoding.EncodeToString(t.rawSignature)
+ t.signature = enc.EncodeToString(t.rawSignature)
t.raw = t.data + TokenSeparator + t.signature
return
}
diff --git a/vendor/git.giftfish.de/ston1th/jwt/v3/token.go b/vendor/git.giftfish.de/ston1th/jwt/v3/token.go
index 83aee75..a1f1dd1 100644
--- a/vendor/git.giftfish.de/ston1th/jwt/v3/token.go
+++ b/vendor/git.giftfish.de/ston1th/jwt/v3/token.go
@@ -3,7 +3,6 @@
package jwt
import (
- "encoding/base64"
"encoding/json"
"strings"
)
@@ -75,7 +74,7 @@ func DecodeToken(token string) (t *Token, err error) {
}
}
t = new(Token)
- header, err := base64.URLEncoding.DecodeString(parts[0])
+ header, err := enc.DecodeString(parts[0])
if err != nil {
return
}
@@ -83,7 +82,7 @@ func DecodeToken(token string) (t *Token, err error) {
if err != nil {
return
}
- claims, err := base64.URLEncoding.DecodeString(parts[1])
+ claims, err := enc.DecodeString(parts[1])
if err != nil {
return
}
@@ -91,7 +90,7 @@ func DecodeToken(token string) (t *Token, err error) {
if err != nil {
return
}
- t.rawSignature, err = base64.URLEncoding.DecodeString(parts[2])
+ t.rawSignature, err = enc.DecodeString(parts[2])
t.signature = parts[2]
t.data = parts[0] + TokenSeparator + parts[1]
t.raw = token
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d9078ee..5e3c8ee 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,6 +1,6 @@
# git.giftfish.de/ston1th/godrop/v2 v2.1.0
git.giftfish.de/ston1th/godrop/v2
-# git.giftfish.de/ston1th/jwt/v3 v3.1.0
+# git.giftfish.de/ston1th/jwt/v3 v3.2.0
git.giftfish.de/ston1th/jwt/v3
# github.com/RoaringBitmap/roaring v0.4.16
github.com/RoaringBitmap/roaring