Skip to content

Commit a4b36ab

Browse files
cbonellocbonello
committed
first commit
1 parent b183c05 commit a4b36ab

21 files changed

+6236
-0
lines changed

‎samples/demo/.gitignore

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
test-results/
2+
tmp/
3+
routes/

‎samples/demo/app/controllers/app.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
package controllers
2+
3+
import (
4+
"github.com/robfig/revel"
5+
"csrf-nosurf/app/routes"
6+
"fmt"
7+
)
8+
9+
type App struct {
10+
*revel.Controller
11+
}
12+
13+
func (c App) Index() revel.Result {
14+
return c.Render()
15+
}
16+
17+
func (c App) Hello(name string) revel.Result {
18+
return c.Render(name)
19+
}
20+
21+
func (c App) Logout(name string) revel.Result {
22+
fmt.Printf("Deleting session keys...\n")
23+
for k := range c.Session {
24+
fmt.Printf("Deleting Session[%s]: '%s'\n", k, c.Session[k])
25+
delete(c.Session, k)
26+
}
27+
return c.Redirect(routes.App.Index())
28+
}

‎samples/demo/app/init.go

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
package app
2+
3+
import (
4+
"github.com/cbonello/revel-csrf"
5+
"github.com/robfig/revel"
6+
)
7+
8+
func init() {
9+
// Filters is the default set of global filters.
10+
revel.Filters = []revel.Filter{
11+
revel.PanicFilter, // Recover from panics and display an error page instead.
12+
revel.RouterFilter, // Use the routing table to select the right Action
13+
revel.FilterConfiguringFilter, // A hook for adding or removing per-Action filters.
14+
revel.ParamsFilter, // Parse parameters into Controller.Params.
15+
revel.SessionFilter, // Restore and write the session cookie.
16+
revel.FlashFilter, // Restore and write the flash cookie.
17+
csrf.CSRFFilter, // CSRF prevention.
18+
revel.ValidationFilter, // Restore kept validation errors and save new ones from cookie.
19+
revel.I18nFilter, // Resolve the requested language
20+
revel.InterceptorFilter, // Run interceptors around the action.
21+
revel.ActionInvoker, // Invoke the action.
22+
}
23+
}

‎samples/demo/app/views/App/Hello.html

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
{{set . "title" "Home"}}
2+
{{template "header.html" .}}
3+
4+
<header class="hero-unit" style="background-color:#A9F16C">
5+
<div class="container">
6+
<div class="row">
7+
<div class="hero-text">
8+
<h1>{{if .name}}Hello {{ .name }}{{else}}Hello anonymous user{{end}}</h1>
9+
<p></p>
10+
</div>
11+
</div>
12+
</div>
13+
</header>
14+
15+
<div class="container">
16+
<div class="row">
17+
<div class="span6">
18+
{{template "flash.html" .}}
19+
</div>
20+
</div>
21+
</div>
22+
23+
<div class="container">
24+
<div class="row">
25+
<div class="span12">
26+
<a href="/">Go Back</a>
27+
</div>
28+
</div>
29+
</div>
30+
31+
{{template "footer.html" .}}

‎samples/demo/app/views/App/Index.html

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
{{set . "title" "Home"}}
2+
{{template "header.html" .}}
3+
4+
<header class="hero-unit" style="background-color:#A9F16C">
5+
<div class="container">
6+
<div class="row">
7+
<div class="hero-text">
8+
<h1>It works!</h1>
9+
<p></p>
10+
</div>
11+
</div>
12+
</div>
13+
</header>
14+
15+
<div class="container">
16+
<div class="row">
17+
<div class="span6">
18+
{{template "flash.html" .}}
19+
</div>
20+
</div>
21+
</div>
22+
23+
<div class="container">
24+
<div class="row" style="padding-bottom: 25px;">
25+
<a href="/Logout" class="btn btn-success" data-toggle="tooltip"
26+
title="Clear session to force generation of a new CSRF token">Clear Session</a>
27+
<a href="#AlterModal" id="alterCSRFButton" role="button" class="btn btn-danger"
28+
data-toggle="tooltip" title="Alter CSRF token so that subsequent connections with server fail">Alter CSRF Token</a>
29+
</div>
30+
<div class="row">
31+
<form class="form-inline" action="/Hello" method="POST">
32+
<input type="text" name="name" />
33+
<input type="hidden" id="CSRFToken" name="csrf_token" value="{{ .csrf_token }}" />
34+
<button type="submit" class="btn btn-primary">Send (POST Method)</button>
35+
</form>
36+
</div>
37+
<div class="row" style="padding-bottom: 25px;">
38+
<form id="AJAXForm" class="form-inline">
39+
<input id="AJAXFormName" type="text" name="name" />
40+
<button type="submit" class="btn btn-primary">Send (AJAX POST Call)</button>
41+
</form>
42+
</div>
43+
</div>
44+
<div class="container">
45+
<div class="row">
46+
<div class="span2">CSRF token:</div>
47+
<div id="CSRFTokenDisplay" class="span10">{{ .csrf_token }}</div>
48+
</div>
49+
</div>
50+
<div class="container" id="cookies">
51+
<h3>Cookies</h3>
52+
</div>
53+
54+
<div id="AlterModal" class="modal hide" tabindex="-1" role="dialog" aria-labelledby="AlterModalLabel" aria-hidden="true">
55+
<div class="modal-header">
56+
<button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button>
57+
<h3 id="AlterModalLabel">Warning</h3>
58+
</div>
59+
<div class="modal-body">
60+
<p>
61+
Hidden CSRF token (in form) has been tampered and subsequent connections
62+
to server should fail. Clear session to restore.
63+
</p>
64+
<p>
65+
For some reason, CSRF token will still have its old value if you display
66+
the source code. But it has really been updated, trust me!
67+
</p>
68+
</div>
69+
<div class="modal-footer">
70+
<button class="btn" data-dismiss="modal" aria-hidden="true">Close</button>
71+
</div>
72+
</div>
73+
74+
<script src="/public/js/bootstrap.min.js" type="text/javascript" charset="utf-8"></script>
75+
76+
<script>
77+
function listCookies() {
78+
var cookies = document.cookie.split(';');
79+
for (var i = 0 ; i < cookies.length; i++) {
80+
c = cookies[i].split('=');
81+
$("#cookies").append('<p><div class="row"><div class="span2">'+c[0]+'</div><div class="span10">'+c[1]+'</div></div></p>');
82+
}
83+
}
84+
85+
function csrfSafeMethod(method) {
86+
// These HTTP methods do not require CSRF protection.
87+
return (/^(GET|HEAD|OPTIONS|TRACE)$/.test(method));
88+
}
89+
90+
$.ajaxSetup({
91+
cache: false,
92+
crossDomain: false,
93+
beforeSend: function(xhr, settings) {
94+
if (!csrfSafeMethod(settings.type)) {
95+
xhr.setRequestHeader("X-CSRF-Token", $("#CSRFTokenDisplay").text());
96+
}
97+
}
98+
});
99+
100+
$( document ).ready(function() {
101+
$("#alterCSRFButton").click(function() {
102+
var alteredToken = $("#CSRFToken").val().concat("REVEL");
103+
$("input[id='CSRFToken']").val(alteredToken);
104+
$("#CSRFTokenDisplay").text(alteredToken);
105+
$("#AlterModal").modal("show");
106+
});
107+
108+
$("#AJAXForm").submit(function(event){
109+
event.preventDefault();
110+
111+
$.ajax({
112+
type: "POST",
113+
url: "/Hello",
114+
data: {
115+
name: $("#AJAXFormName").val()
116+
},
117+
success: function(data) {
118+
// Switch to HTML code returned by server on success.
119+
jQuery("body").html(data);
120+
},
121+
error: function(jqXHR, status, errorThrown) {
122+
alert(jqXHR.statusText);
123+
},
124+
});
125+
});
126+
127+
listCookies();
128+
});
129+
</script>
130+
131+
{{template "footer.html" .}}

‎samples/demo/app/views/debug.html

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
<style type="text/css">
2+
#sidebar {
3+
position: absolute;
4+
right: 0px;
5+
top:69px;
6+
max-width: 75%;
7+
z-index: 1000;
8+
background-color: #fee;
9+
border: thin solid grey;
10+
padding: 10px;
11+
}
12+
#toggleSidebar {
13+
position: absolute;
14+
right: 0px;
15+
top: 50px;
16+
background-color: #fee;
17+
}
18+
19+
</style>
20+
<div id="sidebar" style="display:none;">
21+
<h4>Available pipelines</h4>
22+
<dl>
23+
{{ range $index, $value := .}}
24+
<dt>{{$index}}</dt>
25+
<dd>{{$value}}</dd>
26+
{{end}}
27+
</dl>
28+
<h4>Flash</h4>
29+
<dl>
30+
{{ range $index, $value := .flash}}
31+
<dt>{{$index}}</dt>
32+
<dd>{{$value}}</dd>
33+
{{end}}
34+
</dl>
35+
36+
<h4>Errors</h4>
37+
<dl>
38+
{{ range $index, $value := .errors}}
39+
<dt>{{$index}}</dt>
40+
<dd>{{$value}}</dd>
41+
{{end}}
42+
</dl>
43+
</div>
44+
<a id="toggleSidebar" href="#" class="toggles"><i class="icon-chevron-left"></i></a>
45+
46+
<script>
47+
$sidebar = 0;
48+
$('#toggleSidebar').click(function() {
49+
if ($sidebar === 1) {
50+
$('#sidebar').hide();
51+
$('#toggleSidebar i').addClass('icon-chevron-left');
52+
$('#toggleSidebar i').removeClass('icon-chevron-right');
53+
$sidebar = 0;
54+
}
55+
else {
56+
$('#sidebar').show();
57+
$('#toggleSidebar i').addClass('icon-chevron-right');
58+
$('#toggleSidebar i').removeClass('icon-chevron-left');
59+
$sidebar = 1;
60+
}
61+
});
62+
</script>

‎samples/demo/app/views/errors/404.html

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
<head>
4+
<title>Not found</title>
5+
</head>
6+
<body>
7+
{{if eq .RunMode "dev"}}
8+
{{template "errors/404-dev.html" .}}
9+
{{else}}
10+
{{with .Error}}
11+
<h1>
12+
{{.Title}}
13+
</h1>
14+
<p>
15+
{{.Description}}
16+
</p>
17+
{{end}}
18+
{{end}}
19+
</body>
20+
</html>

‎samples/demo/app/views/errors/500.html

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<title>Application error</title>
5+
</head>
6+
<body>
7+
{{if eq .RunMode "dev"}}
8+
{{template "errors/500-dev.html" .}}
9+
{{else}}
10+
<h1>Oops, an error occured</h1>
11+
<p>
12+
This exception has been logged.
13+
</p>
14+
{{end}}
15+
</body>
16+
</html>

‎samples/demo/app/views/flash.html

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
{{if .flash.success}}
2+
<div class="alert alert-success">
3+
{{.flash.success}}
4+
</div>
5+
{{end}}
6+
7+
{{if or .errors .flash.error}}
8+
<div class="alert alert-error">
9+
{{if .flash.error}}
10+
{{.flash.error}}
11+
{{end}}
12+
<ul style="margin-top:10px;">
13+
{{range .errors}}
14+
<li>{{.}}</li>
15+
{{end}}
16+
</ul>
17+
</div>
18+
{{end}}

‎samples/demo/app/views/footer.html

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{{if eq .RunMode "dev"}}
2+
{{template "debug.html" .}}
3+
{{end}}
4+
</body>
5+
</html>

‎samples/demo/app/views/header.html

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<!DOCTYPE html>
2+
3+
<html>
4+
<head>
5+
<title>{{.title}}</title>
6+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
7+
<link rel="stylesheet" type="text/css" href="/public/css/bootstrap.css">
8+
<link rel="shortcut icon" type="image/png" href="/public/img/favicon.png">
9+
<script src="/public/js/jquery-1.9.1.min.js" type="text/javascript" charset="utf-8"></script>
10+
{{range .moreStyles}}
11+
<link rel="stylesheet" type="text/css" href="/public/{{.}}">
12+
{{end}}
13+
{{range .moreScripts}}
14+
<script src="/public/{{.}}" type="text/javascript" charset="utf-8"></script>
15+
{{end}}
16+
</head>
17+
<body>

0 commit comments

Comments
 (0)