ston1th/gowiki
0
0
Fork 0
Code Issues 2 Releases Activity

general improvements

Browse source
This commit is contained in:
ston1th 2018-10-27 21:28:19 +02:00
commit ddb11f0619
25 changed files with 305 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

118
pkg/server/handler.go
View file

@ -26,7 +26,7 @@ func totpAuthHandler(h ctxHandler) ctxHandler {
h(ctx)
return
}
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
}
}
@ -36,7 +36,7 @@ func adminAuthHandler(h ctxHandler) ctxHandler {
h(ctx)
return
}
ctx.NotFound()
ctx.Forbidden()
}
}
@ -50,7 +50,7 @@ func userAuthHandler(h ctxHandler) ctxHandler {
h(ctx)
return
}
ctx.NotFound()
ctx.Forbidden()
}
}
@ -60,7 +60,7 @@ func authHandler(h ctxHandler) ctxHandler {
h(ctx)
return
}
ctx.NotFound()
ctx.Forbidden()
}
}
@ -80,12 +80,12 @@ func staticHandler(ctx *Context) {
}
func indexHandler(ctx *Context) {
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
}
func loginHandler(ctx *Context) {
if ctx.LoggedOn() {
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
return
}
ctx.Template("loginHandler")
@ -93,17 +93,20 @@ func loginHandler(ctx *Context) {
Title: "Login",
BodyTitle: "Login",
}
var user string
switch ctx.Method() {
case "GET":
ctx.Data.Data = user
ctx.Exec()
case "POST":
if !ctx.CheckXsrf() {
return
}
user := ctx.Form("user")
user = ctx.Form("user")
ctx.Data.Data = user
password := ctx.Form("password")
if user == "" || password == "" {
ctx.Error("wrong inputs")
ctx.Error("empty user or password")
return
}
u, err := ctx.Srv.DB.Login(user, password)
@ -112,21 +115,22 @@ func loginHandler(ctx *Context) {
return
}
if u.Secret == "" {
log.Println("login:", u.Username)
ctx.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin})
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
return
}
ctx.SetCookieToken(jwt.NewToken(map[string]interface{}{
totpClaim: u.Username,
jwt.ExpClaim: jwt.NewExp(time.Minute),
}, nil))
ctx.Redirect(core.TotpURI, 302)
ctx.Redirect(core.TotpURI, http.StatusFound)
}
}
func loginTotpHandler(ctx *Context) {
if ctx.LoggedOn() {
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
return
}
ctx.Template("loginTotpHandler")
@ -143,7 +147,7 @@ func loginTotpHandler(ctx *Context) {
}
pin := ctx.Form("pin")
if pin == "" {
ctx.Error("wrong inputs")
ctx.Error("empty pin")
return
}
u, err := ctx.Srv.DB.Totp(ctx.Totp(), pin)
@ -151,8 +155,9 @@ func loginTotpHandler(ctx *Context) {
ctx.Error(err)
return
}
log.Println("login:", u.Username)
ctx.SetCookie(jwt.Claims{userClaim: u.Username, createdClaim: u.Created, adminClaim: u.Admin})
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
}
}
@ -214,6 +219,14 @@ func pageNewHandler(ctx *Context) {
Perm: perm,
}
ctx.Data.Data = p
if title == "" {
ctx.Error("empty title")
return
}
if perm == core.Invalid {
ctx.Error("invalid permission")
return
}
if section != core.WikiSection {
section = ctx.User()
@ -223,7 +236,7 @@ func pageNewHandler(ctx *Context) {
ctx.Error(err)
return
}
ctx.Redirect(page.StoreTitle, 302)
ctx.Redirect(page.StoreTitle, http.StatusFound)
}
}
@ -237,19 +250,19 @@ func pageHandler(ctx *Context) {
if key := ctx.Var("key"); key != "" {
t, err := jwt.DecodeToken(key)
if err != nil {
log.Println("DecodeToken:", err)
log.Println("share: DecodeToken:", err)
ctx.NotFound()
return
}
if err = ctx.Srv.JWT.Verify(t); err != nil {
log.Println("VerifyToken:", err)
log.Println("share: VerifyToken:", err)
ctx.NotFound()
return
}
user = t.Claims.GetString(sharedClaim)
if ctx.Srv.DB.LockedOut(user, t.Claims.GetString(createdClaim)) {
if err = ctx.Srv.JWT.Invalidate(t); err != nil {
log.Println("Invalidate:", err)
log.Println("share: Invalidate:", err)
}
ctx.NotFound()
return
@ -310,7 +323,7 @@ func pageShareHandler(ctx *Context) {
return
}
d, err := time.ParseDuration(ctx.Form("duration"))
d, err := duration(ctx.Form("duration"), ctx.Form("mode"))
if err != nil {
ctx.Error(err)
return
@ -324,7 +337,7 @@ func pageShareHandler(ctx *Context) {
}, nil)
if err = ctx.Srv.JWT.Sign(t); err != nil {
log.Println("SignToken:", err)
log.Println("share: SignToken:", err)
ctx.NotFound()
return
}
@ -404,7 +417,7 @@ func pageEditHandler(ctx *Context) {
ctx.Error(err)
return
}
ctx.Redirect(page.StoreTitle, 302)
ctx.Redirect(page.StoreTitle, http.StatusFound)
}
}
@ -426,7 +439,7 @@ func pageDelHandler(ctx *Context) {
ctx.Error(err)
return
}
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
}
}
@ -471,15 +484,20 @@ func userNewHandler(ctx *Context) {
adm = true
}
if user == "" || password == "" || password != repeat {
ctx.Error("wrong inputs")
if user == "" || password == "" {
ctx.Error("empty user or password")
return
}
if password != repeat {
ctx.Error("passwords do not match")
return
}
if err := ctx.Srv.DB.CreateUser(user, password, adm); err != nil {
ctx.Error(err)
return
}
ctx.Redirect("/user", 302)
log.Printf("create: %s created by %s\n", user, ctx.User())
ctx.Redirect("/user", http.StatusFound)
}
}
@ -511,8 +529,8 @@ func userEditHandler(ctx *Context) {
adm = true
}
if user == "" || password != repeat {
ctx.Error("wrong inputs")
if password != repeat {
ctx.Error("passwords do not match")
return
}
if ctx.Admin() {
@ -520,17 +538,16 @@ func userEditHandler(ctx *Context) {
ctx.Error(err)
return
}
} else {
if user == ctx.User() {
if err := ctx.Srv.DB.UpdateUserPassword(user, password); err != nil {
ctx.Error(err)
return
}
ctx.Redirect(core.IndexURI, 302)
return
}
log.Printf("update: %s updated by %s\n", user, ctx.User())
ctx.Redirect("/user", http.StatusFound)
return
}
ctx.Redirect("/user", 302)
if err := ctx.Srv.DB.UpdateUserPassword(user, password); err != nil {
ctx.Error(err)
return
}
log.Printf("update: %s updated by %s\n", user, ctx.User())
ctx.Redirect(core.IndexURI, http.StatusFound)
}
}
@ -558,7 +575,7 @@ func userTotpHandler(ctx *Context) {
req.URL = ctx.Form("url")
req.Image, req.Secret, err = otp.ImageSecretFromURL(req.URL)
if err != nil {
ctx.Error("wrong inputs")
ctx.Error(err)
return
}
}
@ -582,7 +599,8 @@ func userTotpHandler(ctx *Context) {
secret = u.Secret
}
valid := otp.Validate(pin, secret)
if ctx.User() != req.Username && ctx.Admin() {
user := ctx.User()
if user != req.Username && ctx.Admin() {
valid = true
}
@ -594,7 +612,12 @@ func userTotpHandler(ctx *Context) {
ctx.Error(err)
return
}
ctx.Redirect("/user/edit/"+req.Username, 302)
if req.Secret == "" {
log.Printf("totp: disabled by %s for %s\n", user, req.Username)
} else {
log.Printf("totp: enabled by %s for %s\n", user, req.Username)
}
ctx.Redirect("/user/edit/"+req.Username, http.StatusFound)
}
}
@ -603,7 +626,8 @@ func userUnlockHandler(ctx *Context) {
if err := ctx.Srv.DB.UnlockUser(user); err != nil {
log.Println("unlock:", err)
}
ctx.Redirect("/user", 302)
log.Printf("unlock: %s unlocked by %s\n", user, ctx.User())
ctx.Redirect("/user", http.StatusFound)
}
func userDelHandler(ctx *Context) {
@ -625,15 +649,23 @@ func userDelHandler(ctx *Context) {
if !ctx.CheckXsrf() {
return
}
if err := ctx.Srv.DB.DeleteUser(ctx.Var("user")); err != nil {
self := ctx.User()
user := ctx.Var("user")
if err := ctx.Srv.DB.DeleteUser(user); err != nil {
log.Println("delete:", err)
}
ctx.Redirect("/user", 302)
log.Printf("delete: %s deleted by %s\n", user, self)
if user == self {
ctx.Redirect("/logout", http.StatusFound)
return
}
ctx.Redirect("/user", http.StatusFound)
}
}
func logoutHandler(ctx *Context) {
log.Println("logout:", ctx.User())
ctx.Srv.JWT.Invalidate(&ctx.Token)
ctx.SetCookie(nil)
ctx.Redirect(core.IndexURI, 302)
ctx.Redirect(core.IndexURI, http.StatusFound)
}