updated jwt and added share token invalidation

pkg/server/context.go

@@ -14,14 +14,15 @@ import (
 )
 
 const (
-	userClaim     = "user"
-	adminClaim    = "admin"
-	createdClaim  = "created"
-	sharedClaim   = "shared"
-	sectionClaim  = "section"
-	titleClaim    = "title"
-	totpClaim     = "totp"
-	rememberClaim = "remember"
+	userClaim        = "user"
+	adminClaim       = "admin"
+	userCreatedClaim = "user_created"
+	pageCreatedClaim = "page_created"
+	sharedClaim      = "shared"
+	sectionClaim     = "section"
+	titleClaim       = "title"
+	totpClaim        = "totp"
+	rememberClaim    = "remember"
 )
 
 func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Context) {
@@ -60,7 +61,7 @@ func newContext(w http.ResponseWriter, r *http.Request, s *HTTPServer) (ctx *Con
 			return nil
 
 		}
-		if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(createdClaim)) {
+		if !s.DB.LockedOut(t.Claims.GetString(userClaim), t.Claims.GetString(userCreatedClaim)) {
 			ctx.Token = *t
 			return
 		}
@@ -239,7 +240,7 @@ func (c *Context) Login(u core.User, remember string) {
 	if remember != "" {
 		d = day * 7
 	}
-	c.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin}, d)
+	c.SetCookie(jwt.Claims{userClaim: u.Username, userCreatedClaim: u.Created, adminClaim: u.Admin}, d)
 }
 
 func (c *Context) SetCookie(claims jwt.Claims, d time.Duration) {

pkg/server/handler.go

@@ -251,13 +251,15 @@ func pageNewHandler(ctx *Context) {
 }
 
 func pageHandler(ctx *Context) {
+	var pageCreated string
 	ctx.Data = webData{
 		Admin: ctx.Admin(),
 	}
 	section := ctx.Var("section")
 	title := ctx.Var("title")
 	user := ctx.User()
-	if key := ctx.Var("key"); key != "" {
+	key := ctx.Var("key")
+	if key != "" {
 		t, err := jwt.DecodeToken(key)
 		if err != nil {
 			log.Println("share: DecodeToken:", err)
@@ -270,7 +272,7 @@ func pageHandler(ctx *Context) {
 			return
 		}
 		user = t.Claims.GetString(sharedClaim)
-		if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(createdClaim)) {
+		if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(userCreatedClaim)) {
 			if err = ctx.Srv.JWT.Invalidate(t); err != nil {
 				log.Println("share: Invalidate:", err)
 			}
@@ -279,6 +281,7 @@ func pageHandler(ctx *Context) {
 		}
 		section = t.Claims.GetString(sectionClaim)
 		title = t.Claims.GetString(titleClaim)
+		pageCreated = t.Claims.GetString(pageCreatedClaim)
 		ctx.Data.Key = key
 		if ctx.T == nil {
 			ctx.Template("pageViewHandler")
@@ -294,6 +297,10 @@ func pageHandler(ctx *Context) {
 		ctx.NotFound()
 		return
 	}
+	if key != "" && page.Created != pageCreated {
+		ctx.NotFound()
+		return
+	}
 	ctx.Data.Data = page
 	ctx.Data.Title = page.Title
 	ctx.Data.BodyTitle = page.Title
@@ -339,11 +346,12 @@ func pageShareHandler(ctx *Context) {
 			return
 		}
 		t := jwt.NewToken(map[string]interface{}{
-			sharedClaim:  user,
-			createdClaim: ctx.Token.Claims.GetString(createdClaim),
-			sectionClaim: section,
-			titleClaim:   title,
-			jwt.ExpClaim: jwt.NewExp(d),
+			sharedClaim:      user,
+			userCreatedClaim: ctx.Token.Claims.GetString(userCreatedClaim),
+			pageCreatedClaim: page.Created,
+			sectionClaim:     section,
+			titleClaim:       title,
+			jwt.ExpClaim:     jwt.NewExp(d),
 		}, nil)
 
 		if err = ctx.Srv.JWT.Sign(t); err != nil {

pkg/server/templates.go

@@ -396,7 +396,7 @@ const (
                         <input type="hidden" name="token" value="{{.Token}}">
                         <div class="form-group">
                             <label class="col-form-label" for="duration">Lifetime</label>
-                            <input class="form-control input-sm" type="text" id="duration" name="duration" placeholder="min: 30s max: 90d" autocomplete="off" autofocus required>
+                            <input class="form-control input-sm" type="text" id="duration" name="duration" autocomplete="off" autofocus required>
                         </div>
                         <div class="form-group">
                             <div class="custom-control custom-radio">
@@ -405,7 +405,7 @@ const (
                             </div>
                             <div class="custom-control custom-radio">
                                 <input type="radio" id="mode2" name="mode" value="2" class="custom-control-input">
-                                <label class="custom-control-label" for="mode2">Day</label>
+                                <label class="custom-control-label" for="mode2">Day(s) (Numbers only)</label>
                             </div>
                         </div>
                         <button class="btn btn-sm btn-primary" type="submit">Share</button>

pkg/server/xsrf.go

@@ -22,11 +22,11 @@ func genKey(length int) (bytes []byte) {
 
 func newXsrf(secret []byte) string {
 	rnd := genKey(keySize)
-	return base64.StdEncoding.EncodeToString(append(rnd, xor(rnd, secret)...))
+	return base64.RawStdEncoding.EncodeToString(append(rnd, xor(rnd, secret)...))
 }
 
 func checkXsrf(xsrf string, secret []byte) bool {
-	t, err := base64.StdEncoding.DecodeString(xsrf)
+	t, err := base64.RawStdEncoding.DecodeString(xsrf)
 	if err != nil {
 		return false
 	}