updated jwt and added share token invalidation

pkg/server/handler.go

@@ -251,13 +251,15 @@ func pageNewHandler(ctx *Context) {
 }
 
 func pageHandler(ctx *Context) {
+	var pageCreated string
 	ctx.Data = webData{
 		Admin: ctx.Admin(),
 	}
 	section := ctx.Var("section")
 	title := ctx.Var("title")
 	user := ctx.User()
-	if key := ctx.Var("key"); key != "" {
+	key := ctx.Var("key")
+	if key != "" {
 		t, err := jwt.DecodeToken(key)
 		if err != nil {
 			log.Println("share: DecodeToken:", err)
@@ -270,7 +272,7 @@ func pageHandler(ctx *Context) {
 			return
 		}
 		user = t.Claims.GetString(sharedClaim)
-		if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(createdClaim)) {
+		if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(userCreatedClaim)) {
 			if err = ctx.Srv.JWT.Invalidate(t); err != nil {
 				log.Println("share: Invalidate:", err)
 			}
@@ -279,6 +281,7 @@ func pageHandler(ctx *Context) {
 		}
 		section = t.Claims.GetString(sectionClaim)
 		title = t.Claims.GetString(titleClaim)
+		pageCreated = t.Claims.GetString(pageCreatedClaim)
 		ctx.Data.Key = key
 		if ctx.T == nil {
 			ctx.Template("pageViewHandler")
@@ -294,6 +297,10 @@ func pageHandler(ctx *Context) {
 		ctx.NotFound()
 		return
 	}
+	if key != "" && page.Created != pageCreated {
+		ctx.NotFound()
+		return
+	}
 	ctx.Data.Data = page
 	ctx.Data.Title = page.Title
 	ctx.Data.BodyTitle = page.Title
@@ -339,11 +346,12 @@ func pageShareHandler(ctx *Context) {
 			return
 		}
 		t := jwt.NewToken(map[string]interface{}{
-			sharedClaim:  user,
-			createdClaim: ctx.Token.Claims.GetString(createdClaim),
-			sectionClaim: section,
-			titleClaim:   title,
-			jwt.ExpClaim: jwt.NewExp(d),
+			sharedClaim:      user,
+			userCreatedClaim: ctx.Token.Claims.GetString(userCreatedClaim),
+			pageCreatedClaim: page.Created,
+			sectionClaim:     section,
+			titleClaim:       title,
+			jwt.ExpClaim:     jwt.NewExp(d),
 		}, nil)
 
 		if err = ctx.Srv.JWT.Sign(t); err != nil {