/
routes_common.go
570 lines (510 loc) · 17 KB
/
routes_common.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
package common
import (
"crypto/subtle"
"html"
"io"
"net"
"net/http"
"os"
"regexp"
"strconv"
"strings"
"time"
"github.com/Azareal/Gosora/common/phrases"
"github.com/Azareal/Gosora/uutils"
)
// nolint
var PreRoute func(http.ResponseWriter, *http.Request) (User, bool) = preRoute
// TODO: Come up with a better middleware solution
// nolint We need these types so people can tell what they are without scrolling to the bottom of the file
var PanelUserCheck func(http.ResponseWriter, *http.Request, *User) (*Header, PanelStats, RouteError) = panelUserCheck
var SimplePanelUserCheck func(http.ResponseWriter, *http.Request, *User) (*HeaderLite, RouteError) = simplePanelUserCheck
var SimpleForumUserCheck func(w http.ResponseWriter, r *http.Request, u *User, fid int) (headerLite *HeaderLite, err RouteError) = simpleForumUserCheck
var ForumUserCheck func(h *Header, w http.ResponseWriter, r *http.Request, u *User, fid int) (err RouteError) = forumUserCheck
var SimpleUserCheck func(w http.ResponseWriter, r *http.Request, u *User) (headerLite *HeaderLite, err RouteError) = simpleUserCheck
var UserCheck func(w http.ResponseWriter, r *http.Request, u *User) (h *Header, err RouteError) = userCheck
var UserCheckNano func(w http.ResponseWriter, r *http.Request, u *User, nano int64) (h *Header, err RouteError) = userCheck2
func simpleForumUserCheck(w http.ResponseWriter, r *http.Request, u *User, fid int) (h *HeaderLite, rerr RouteError) {
h, rerr = SimpleUserCheck(w, r, u)
if rerr != nil {
return h, rerr
}
if !Forums.Exists(fid) {
return nil, PreError("The target forum doesn't exist.", w, r)
}
// Is there a better way of doing the skip AND the success flag on this hook like multiple returns?
/*skip, rerr := h.Hooks.VhookSkippable("simple_forum_check_pre_perms", w, r, u, &fid, h)
if skip || rerr != nil {
return h, rerr
}*/
skip, rerr := H_simple_forum_check_pre_perms_hook(h.Hooks, w, r, u, &fid, h)
if skip || rerr != nil {
return h, rerr
}
fp, err := FPStore.Get(fid, u.Group)
if err == ErrNoRows {
fp = BlankForumPerms()
} else if err != nil {
return h, InternalError(err, w, r)
}
cascadeForumPerms(fp, u)
return h, nil
}
func forumUserCheck(h *Header, w http.ResponseWriter, r *http.Request, u *User, fid int) (rerr RouteError) {
if !Forums.Exists(fid) {
return NotFound(w, r, h)
}
/*skip, rerr := h.Hooks.VhookSkippable("forum_check_pre_perms", w, r, u, &fid, h)
if skip || rerr != nil {
return rerr
}*/
/*skip, rerr := VhookSkippableTest(h.Hooks, "forum_check_pre_perms", w, r, u, &fid, h)
if skip || rerr != nil {
return rerr
}*/
skip, rerr := H_forum_check_pre_perms_hook(h.Hooks, w, r, u, &fid, h)
if skip || rerr != nil {
return rerr
}
fp, err := FPStore.Get(fid, u.Group)
if err == ErrNoRows {
fp = BlankForumPerms()
} else if err != nil {
return InternalError(err, w, r)
}
cascadeForumPerms(fp, u)
h.CurrentUser = u // TODO: Use a pointer instead for CurrentUser, so we don't have to do this
return rerr
}
// TODO: Put this on the user instance? Do we really want forum specific logic in there? Maybe, a method which spits a new pointer with the same contents as user?
func cascadeForumPerms(fp *ForumPerms, u *User) {
if fp.Overrides && !u.IsSuperAdmin {
u.Perms.ViewTopic = fp.ViewTopic
u.Perms.LikeItem = fp.LikeItem
u.Perms.CreateTopic = fp.CreateTopic
u.Perms.EditTopic = fp.EditTopic
u.Perms.DeleteTopic = fp.DeleteTopic
u.Perms.CreateReply = fp.CreateReply
u.Perms.EditReply = fp.EditReply
u.Perms.DeleteReply = fp.DeleteReply
u.Perms.PinTopic = fp.PinTopic
u.Perms.CloseTopic = fp.CloseTopic
u.Perms.MoveTopic = fp.MoveTopic
if len(fp.ExtData) != 0 {
for name, perm := range fp.ExtData {
u.PluginPerms[name] = perm
}
}
}
}
// Even if they have the right permissions, the control panel is only open to supermods+. There are many areas without subpermissions which assume that the current user is a supermod+ and admins are extremely unlikely to give these permissions to someone who isn't at-least a supermod to begin with
// TODO: Do a panel specific theme?
func panelUserCheck(w http.ResponseWriter, r *http.Request, u *User) (h *Header, stats PanelStats, rerr RouteError) {
theme := GetThemeByReq(r)
h = &Header{
Site: Site,
Settings: SettingBox.Load().(SettingMap),
//Themes: Themes,
ThemesSlice: ThemesSlice,
Theme: theme,
CurrentUser: u,
Hooks: GetHookTable(),
Zone: "panel",
Writer: w,
IsoCode: phrases.GetLangPack().IsoCode,
//StartedAt: time.Now(),
StartedAt: uutils.Nanotime(),
}
// TODO: We should probably initialise header.ExtData
// ? - Should we only show this in debug mode? It might be useful for detecting issues in production, if we show it there as-well
//if user.IsAdmin {
//h.StartedAt = time.Now()
//}
h.AddSheet(theme.Name + "/main.css")
h.AddSheet(theme.Name + "/panel.css")
if len(theme.Resources) > 0 {
rlist := theme.Resources
for _, res := range rlist {
if res.LocID == LocGlobal || res.LocID == LocPanel {
if res.Type == ResTypeSheet {
h.AddSheet(res.Name)
} else if res.Type == ResTypeScript {
if res.Async {
h.AddScriptAsync(res.Name)
} else {
h.AddScript(res.Name)
}
}
}
}
}
//h := w.Header()
//h.Set("Content-Security-Policy", "default-src 'self'")
// TODO: GDPR. Add a global control panel notice warning the admins of staff members who don't have 2FA enabled
stats.Users = Users.Count()
stats.Groups = Groups.Count()
stats.Forums = Forums.Count()
stats.Pages = Pages.Count()
stats.Settings = len(h.Settings)
stats.WordFilters = WordFilters.EstCount()
stats.Themes = len(Themes)
stats.Reports = 0 // TODO: Do the report count. Only show open threads?
addPreScript := func(name string, i int) {
// TODO: Optimise this by removing a superfluous string alloc
if theme.OverridenMap != nil {
//fmt.Printf("name %+v\n", name)
//fmt.Printf("theme.OverridenMap %+v\n", theme.OverridenMap)
if _, ok := theme.OverridenMap[name]; ok {
tname := "_" + theme.Name
//fmt.Printf("tname %+v\n", tname)
h.AddPreScriptAsync("tmpl_" + name + tname + ".js")
return
}
}
//fmt.Printf("tname %+v\n", tname)
h.AddPreScriptAsync(ucstrs[i])
}
addPreScript("alert", 3)
addPreScript("notice", 4)
return h, stats, nil
}
func simplePanelUserCheck(w http.ResponseWriter, r *http.Request, u *User) (lite *HeaderLite, rerr RouteError) {
return SimpleUserCheck(w, r, u)
}
// SimpleUserCheck is back from the grave, yay :D
func simpleUserCheck(w http.ResponseWriter, r *http.Request, u *User) (lite *HeaderLite, rerr RouteError) {
return &HeaderLite{
Site: Site,
Settings: SettingBox.Load().(SettingMap),
Hooks: GetHookTable(),
}, nil
}
func GetThemeByReq(r *http.Request) *Theme {
theme := &Theme{Name: ""}
cookie, e := r.Cookie("current_theme")
if e == nil {
inTheme, ok := Themes[html.EscapeString(cookie.Value)]
if ok && !theme.HideFromThemes {
theme = inTheme
}
}
if theme.Name == "" {
theme = Themes[DefaultThemeBox.Load().(string)]
}
return theme
}
func userCheck(w http.ResponseWriter, r *http.Request, u *User) (h *Header, rerr RouteError) {
return userCheck2(w, r, u, uutils.Nanotime())
}
// TODO: Add the ability for admins to restrict certain themes to certain groups?
// ! Be careful about firing errors off here as CustomError uses this
func userCheck2(w http.ResponseWriter, r *http.Request, u *User, nano int64) (h *Header, rerr RouteError) {
theme := GetThemeByReq(r)
h = &Header{
Site: Site,
Settings: SettingBox.Load().(SettingMap),
//Themes: Themes,
ThemesSlice: ThemesSlice,
Theme: theme,
CurrentUser: u, // ! Some things rely on this being a pointer downstream from this function
Hooks: GetHookTable(),
Zone: ucstrs[0],
Writer: w,
IsoCode: phrases.GetLangPack().IsoCode,
StartedAt: nano,
}
// TODO: Optimise this by avoiding accessing a map string index
if !u.Loggedin {
h.GoogSiteVerify = h.Settings["google_site_verify"].(string)
}
if u.IsBanned {
h.AddNotice("account_banned")
}
if u.Loggedin && !u.Active {
h.AddNotice("account_inactive")
}
/*h.Scripts, _ = StrSlicePool.Get().([]string)
if h.Scripts != nil {
h.Scripts = h.Scripts[:0]
}
h.PreScriptsAsync, _ = StrSlicePool.Get().([]string)
if h.PreScriptsAsync != nil {
h.PreScriptsAsync = h.PreScriptsAsync[:0]
}*/
// An optimisation so we don't populate StartedAt for users who shouldn't see the stat anyway
// ? - Should we only show this in debug mode? It might be useful for detecting issues in production, if we show it there as-well
//if u.IsAdmin {
//h.StartedAt = time.Now()
//}
//PrepResources(u,h,theme)
return h, nil
}
func PrepResources(u *User, h *Header, theme *Theme) {
h.AddSheet(theme.Name + "/main.css")
if len(theme.Resources) > 0 {
rlist := theme.Resources
for _, res := range rlist {
if res.Loggedin && !u.Loggedin {
continue
}
if res.LocID == LocGlobal || res.LocID == LocFront {
if res.Type == ResTypeSheet {
h.AddSheet(res.Name)
} else if res.Type == ResTypeScript {
if res.Async {
h.AddScriptAsync(res.Name)
} else {
h.AddScript(res.Name)
}
}
}
}
}
addPreScript := func(name string, i int) {
// TODO: Optimise this by removing a superfluous string alloc
if theme.OverridenMap != nil {
//fmt.Printf("name %+v\n", name)
//fmt.Printf("theme.OverridenMap %+v\n", theme.OverridenMap)
if _, ok := theme.OverridenMap[name]; ok {
tname := "_" + theme.Name
//fmt.Printf("tname %+v\n", tname)
h.AddPreScriptAsync("tmpl_" + name + tname + ".js")
return
}
}
//fmt.Printf("tname %+v\n", tname)
h.AddPreScriptAsync(ucstrs[i])
}
addPreScript("topics_topic", 1)
addPreScript("paginator", 2)
addPreScript("alert", 3)
addPreScript("notice", 4)
if u.Loggedin {
addPreScript("topic_c_edit_post", 5)
addPreScript("topic_c_attach_item", 6)
addPreScript("topic_c_poll_input", 7)
}
}
func pstr(name string) string {
return "tmpl_" + name + ".js"
}
var ucstrs = [...]string{
"frontend",
pstr("topics_topic"),
pstr("paginator"),
pstr("alert"),
pstr("notice"),
pstr("topic_c_edit_post"),
pstr("topic_c_attach_item"),
pstr("topic_c_poll_input"),
}
func preRoute(w http.ResponseWriter, r *http.Request) (User, bool) {
userptr, halt := Auth.SessionCheck(w, r)
if halt {
return *userptr, false
}
var usercpy *User = BlankUser()
*usercpy = *userptr
usercpy.Init() // TODO: Can we reduce the amount of work we do here?
// TODO: Add a config setting to disable this header
// TODO: Have this header cover more things
if Config.SslSchema {
w.Header().Set("Content-Security-Policy", "upgrade-insecure-requests")
}
// TODO: WIP. Refactor this to eliminate the unnecessary query
// TODO: Better take proxies into consideration
if !Config.DisableIP {
var host string
// TODO: Prefer Cf-Connecting-Ip header, fewer shenanigans
if Site.HasProxy {
// TODO: Check the right-most IP, might get tricky with multiple proxies, maybe have a setting for the number of hops we jump through
xForwardedFor := r.Header.Get("X-Forwarded-For")
if xForwardedFor != "" {
forwardedFor := strings.Split(xForwardedFor, ",")
// TODO: Check if this is a valid IP Address, reject if not
host = forwardedFor[len(forwardedFor)-1]
}
}
if host == "" {
var e error
host, _, e = net.SplitHostPort(r.RemoteAddr)
if e != nil {
_ = PreError("Bad IP", w, r)
return *usercpy, false
}
}
if !Config.DisableLastIP && usercpy.Loggedin && host != usercpy.GetIP() {
mon := time.Now().Month()
e := usercpy.UpdateIP(strconv.Itoa(int(mon)) + "-" + host)
if e != nil {
_ = InternalError(e, w, r)
return *usercpy, false
}
}
usercpy.LastIP = host
}
return *usercpy, true
}
func UploadAvatar(w http.ResponseWriter, r *http.Request, u *User, tuid int) (ext string, ferr RouteError) {
// We don't want multiple files
// TODO: Are we doing this correctly?
filenameMap := make(map[string]bool)
for _, fheaders := range r.MultipartForm.File {
for _, hdr := range fheaders {
if hdr.Filename == "" {
continue
}
filenameMap[hdr.Filename] = true
}
}
if len(filenameMap) > 1 {
return "", LocalError("You may only upload one avatar", w, r, u)
}
for _, fheaders := range r.MultipartForm.File {
for _, hdr := range fheaders {
if hdr.Filename == "" {
continue
}
inFile, err := hdr.Open()
if err != nil {
return "", LocalError("Upload failed", w, r, u)
}
defer inFile.Close()
if ext == "" {
extarr := strings.Split(hdr.Filename, ".")
if len(extarr) < 2 {
return "", LocalError("Bad file", w, r, u)
}
ext = extarr[len(extarr)-1]
// TODO: Can we do this without a regex?
reg, err := regexp.Compile("[^A-Za-z0-9]+")
if err != nil {
return "", LocalError("Bad file extension", w, r, u)
}
ext = reg.ReplaceAllString(ext, "")
ext = strings.ToLower(ext)
if !ImageFileExts.Contains(ext) {
return "", LocalError("You can only use an image for your avatar", w, r, u)
}
}
// TODO: Centralise this string, so we don't have to change it in two different places when it changes
outFile, err := os.Create("./uploads/avatar_" + strconv.Itoa(tuid) + "." + ext)
if err != nil {
return "", LocalError("Upload failed [File Creation Failed]", w, r, u)
}
defer outFile.Close()
_, err = io.Copy(outFile, inFile)
if err != nil {
return "", LocalError("Upload failed [Copy Failed]", w, r, u)
}
}
}
if ext == "" {
return "", LocalError("No file", w, r, u)
}
return ext, nil
}
func ChangeAvatar(path string, w http.ResponseWriter, r *http.Request, u *User) RouteError {
e := u.ChangeAvatar(path)
if e != nil {
return InternalError(e, w, r)
}
// Clean up the old avatar data, so we don't end up with too many dead files in /uploads/
if len(u.RawAvatar) > 2 {
if u.RawAvatar[0] == '.' && u.RawAvatar[1] == '.' {
e := os.Remove("./uploads/avatar_" + strconv.Itoa(u.ID) + "_tmp" + u.RawAvatar[1:])
if e != nil && !os.IsNotExist(e) {
LogWarning(e)
return LocalError("Something went wrong", w, r, u)
}
e = os.Remove("./uploads/avatar_" + strconv.Itoa(u.ID) + "_w48" + u.RawAvatar[1:])
if e != nil && !os.IsNotExist(e) {
LogWarning(e)
return LocalError("Something went wrong", w, r, u)
}
}
}
return nil
}
// SuperAdminOnly makes sure that only super admin can access certain critical panel routes
func SuperAdminOnly(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if !u.IsSuperAdmin {
return NoPermissions(w, r, u)
}
return nil
}
// AdminOnly makes sure that only admins can access certain panel routes
func AdminOnly(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if !u.IsAdmin {
return NoPermissions(w, r, u)
}
return nil
}
// SuperModeOnly makes sure that only super mods or higher can access the panel routes
func SuperModOnly(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if !u.IsSuperMod {
return NoPermissions(w, r, u)
}
return nil
}
// MemberOnly makes sure that only logged in users can access this route
func MemberOnly(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if !u.Loggedin {
return LoginRequired(w, r, u)
}
return nil
}
// NoBanned stops any banned users from accessing this route
func NoBanned(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if u.IsBanned {
return Banned(w, r, u)
}
return nil
}
func ParseForm(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if e := r.ParseForm(); e != nil {
return LocalError("Bad Form", w, r, u)
}
return nil
}
func NoSessionMismatch(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if e := r.ParseForm(); e != nil {
return LocalError("Bad Form", w, r, u)
}
if len(u.Session) == 0 {
return SecurityError(w, r, u)
}
// TODO: Try to eliminate some of these allocations
sess := []byte(u.Session)
if subtle.ConstantTimeCompare([]byte(r.FormValue("session")), sess) != 1 && subtle.ConstantTimeCompare([]byte(r.FormValue("s")), sess) != 1 {
return SecurityError(w, r, u)
}
return nil
}
func ReqIsJson(r *http.Request) bool {
return r.Header.Get("Content-type") == "application/json"
}
func HandleUploadRoute(w http.ResponseWriter, r *http.Request, u *User, maxFileSize int) RouteError {
// TODO: Reuse this code more
if r.ContentLength > int64(maxFileSize) {
size, unit := ConvertByteUnit(float64(maxFileSize))
return CustomError("Your upload is too big. Your files need to be smaller than "+strconv.Itoa(int(size))+unit+".", http.StatusExpectationFailed, "Error", w, r, nil, u)
}
r.Body = http.MaxBytesReader(w, r.Body, r.ContentLength)
e := r.ParseMultipartForm(int64(Megabyte))
if e != nil {
return LocalError("Bad Form", w, r, u)
}
return nil
}
func NoUploadSessionMismatch(w http.ResponseWriter, r *http.Request, u *User) RouteError {
if len(u.Session) == 0 {
return SecurityError(w, r, u)
}
// TODO: Try to eliminate some of these allocations
sess := []byte(u.Session)
if subtle.ConstantTimeCompare([]byte(r.FormValue("session")), sess) != 1 && subtle.ConstantTimeCompare([]byte(r.FormValue("s")), sess) != 1 {
return SecurityError(w, r, u)
}
return nil
}