nonshy
/
website
1
0
Fork 1
Code Issues 21 Pull Requests Packages Projects Releases Wiki Activity

Various quick fixes 

* Signup: if entering an existing email, don't admit that the email
  exists. Instead, send a specialized email to its address.
* Search: no longer search for users by email address.
* Login: always hash the incoming password on user not found, to take
  constant time compared to when the user did exist.
* Fix a pagination bug when a private (shy account) views a non-friend's
  photo gallery.
face-detect
Noah Petherbridge 2023-08-15 17:33:33 -07:00
parent 868aef6fb0
commit 1ee8acf060
8 changed files with 82 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
pkg/controller/account/login.go
View File

@ -10,6 +10,7 @@ import (
"code.nonshy.com/nonshy/website/pkg/ratelimit"
"code.nonshy.com/nonshy/website/pkg/session"
"code.nonshy.com/nonshy/website/pkg/templates"
"golang.org/x/crypto/bcrypt"
)
// Login controller.
@ -29,6 +30,11 @@ func Login() http.HandlerFunc {
// Look up their account.
user, err := models.FindUser(username)
if err != nil {
// The user wasn't found, but still hash the incoming password to take time:
// so a mischievous user can't infer whether the username was valid based
// on the server response time.
bcrypt.GenerateFromPassword([]byte(password), config.BcryptCost)
session.FlashError(w, r, "Incorrect username or password.")
templates.Redirect(w, r.URL.Path)
return

4
pkg/controller/account/search.go
View File

@ -26,7 +26,7 @@ func Search() http.HandlerFunc {
// Search filters.
var (
isCertified = r.FormValue("certified")
username = r.FormValue("username") // email or username
username = r.FormValue("username") // username search
gender = r.FormValue("gender")
orientation = r.FormValue("orientation")
maritalStatus = r.FormValue("marital_status")
@ -73,7 +73,7 @@ func Search() http.HandlerFunc {
pager.ParsePage(r)
users, err := models.SearchUsers(currentUser, &models.UserSearch{
EmailOrUsername: username,
Username: username,
Gender: gender,
Orientation: orientation,
MaritalStatus: maritalStatus,

17
pkg/controller/account/signup.go
View File

@ -126,7 +126,22 @@ func Signup() http.HandlerFunc {
// Already an account?
if _, err := models.FindUser(email); err == nil {
session.FlashError(w, r, "There is already an account with that e-mail address.")
// We don't want to admit that the email already is registered, so send an email to the
// address in case the user legitimately forgot, but flash the regular success message.
err := mail.Send(mail.Message{
To: email,
Subject: "You already have a nonshy account",
Template: "email/already_signed_up.html",
Data: map[string]interface{}{
"Title": config.Title,
"URL": config.Current.BaseURL + "/forgot-password",
},
})
if err != nil {
session.FlashError(w, r, "Error sending an email: %s", err)
}
session.Flash(w, r, "We have sent an e-mail to %s with a link to continue signing up your account. Please go and check your e-mail.", email)
templates.Redirect(w, r.URL.Path)
return
}

2
pkg/controller/photo/user_gallery.go
View File

@ -61,7 +61,7 @@ func UserPhotos() http.HandlerFunc {
"User": user,
"Photos": []*models.Photo{},
"PhotoCount": models.CountPhotos(user.ID),
"Pager": models.Pagination{},
"Pager": &models.Pagination{},
}
if err := tmpl.Execute(w, r, vars); err != nil {

10
pkg/models/user.go
View File

@ -184,7 +184,7 @@ func (u *User) IsShyFrom(other *User) bool {
// UserSearch config.
type UserSearch struct {
EmailOrUsername string
Username string
Gender string
Orientation string
MaritalStatus string
@ -213,10 +213,10 @@ func SearchUsers(user *User, search *UserSearch, pager *Pagination) ([]*User, er
placeholders = append(placeholders, blockedUserIDs)
}
if search.EmailOrUsername != "" {
ilike := "%" + strings.TrimSpace(strings.ToLower(search.EmailOrUsername)) + "%"
wheres = append(wheres, "(email LIKE ? OR username LIKE ?)")
placeholders = append(placeholders, ilike, ilike)
if search.Username != "" {
ilike := "%" + strings.TrimSpace(strings.ToLower(search.Username)) + "%"
wheres = append(wheres, "username LIKE ?")
placeholders = append(placeholders, ilike)
}
if search.Gender != "" {

2
web/templates/account/search.html
View File

@ -57,7 +57,7 @@
<div class="column">
<div class="field">
<label class="label">Email or username:</label>
<label class="label">Partial username:</label>
<input type="text" class="input"
name="username"
autocomplete="off"

35
web/templates/email/already_signed_up.html Normal file
View File

@ -0,0 +1,35 @@
{{define "content"}}
<html>
<body bakground="#ffffff" color="#000000" link="#0000FF" vlink="#990099" alink="#FF0000">
<basefont face="Arial,Helvetica,sans-serif" size="3" color="#000000"></basefont>
<h1>You already have a {{.Data.Title}} account</h1>
<p>
Somebody (hopefully you) has tried to sign up a new account by entering your e-mail address.
We already have an account for this e-mail address, but we didn't admit that to whoever
just signed up.
</p>
<p>
If it was not you, then you can disregard this e-mail.
</p>
<p>
If you have forgotten your password, you can request a password reset at the link below:
</p>
<p>
<a href="{{.Data.URL}}" target="_blank">{{.Data.URL}}</a>
</p>
<p>
You may sign in to the website using your e-mail address and account password.
</p>
<p>
This is an automated e-mail; do not reply to this message.
</p>
</body>
</html>
{{end}}

2
web/templates/partials/simple_pager.html
View File

@ -10,6 +10,7 @@ added. Should be suitable for most pagers that don't need any specialized logic.
See also: template_funcs.go for the SimplePager wrapper function.
-->
{{define "SimplePager"}}
{{if .Pager.Pages}}
<nav class="pagination" role="navigation" aria-label="pagination">
<a class="pagination-previous{{if not .Pager.HasPrevious}} is-disabled{{end}}" title="Previous"
href="{{.Request.URL.Path}}?{{QueryPlus "page" .Pager.Previous}}">Previous</a>
@ -28,4 +29,5 @@ See also: template_funcs.go for the SimplePager wrapper function.
{{end}}
</ul>
</nav>
{{end}}
{{end}}