adjusted css of code blocks
This commit is contained in:
rawleyIfowler
@@ -1,101 +1,179 @@
|
||||
package controllers
|
||||
|
||||
/*
|
||||
Copyright (C) 2022 Rawley Fowler
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.Rawley Fowler, 2022
|
||||
*/
|
||||
|
||||
import (
|
||||
"crypto/sha256"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gitlab.com/rawleyifowler/site-rework/models"
|
||||
"gitlab.com/rawleyifowler/site-rework/repos"
|
||||
"gitlab.com/rawleyifowler/site-rework/utils"
|
||||
)
|
||||
|
||||
var (
|
||||
key string = utils.LoadApiKey("api_key.pem")
|
||||
admin_hash [32]byte = utils.LoadAdminHash("admin_hash.pem")
|
||||
att map[string]uint32 = make(map[string]uint32)
|
||||
api_key string = utils.LoadApiKey("api_key.pem")
|
||||
)
|
||||
|
||||
// Ensure is logged in
|
||||
func AdminOnly() gin.HandlerFunc {
|
||||
return func(c *gin.Context) {
|
||||
var status uint = http.StatusOK
|
||||
k, err := c.Cookie("admin_key")
|
||||
if err != nil {
|
||||
status = http.StatusUnauthorized
|
||||
}
|
||||
fmt.Println(k)
|
||||
if k == key && status == http.StatusOK {
|
||||
c.Next()
|
||||
} else {
|
||||
c.HTML(int(status), "forbidden.tmpl", models.Page{Title: " | forbidden"})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
}
|
||||
type AdminController struct {
|
||||
Repository *repos.AdminRepo
|
||||
BlogRepository *repos.BlogRepo
|
||||
ActiveLogins map[string]int64
|
||||
LoginAttemptsByIp map[string]uint
|
||||
}
|
||||
|
||||
func NewAdminController(r *repos.AdminRepo) *AdminController {
|
||||
var a AdminController
|
||||
a.Repository = r
|
||||
a.ActiveLogins = map[string]int64{}
|
||||
a.LoginAttemptsByIp = map[string]uint{}
|
||||
go utils.TimeClearMap(a.ActiveLogins, 850)
|
||||
return &a
|
||||
}
|
||||
|
||||
func RegisterAdminGroup(r *gin.RouterGroup) {
|
||||
a := NewAdminController(repos.NewAdminRepo("dsn"))
|
||||
r.Use(a.UserBannedMiddleware)
|
||||
r.GET("/", utils.ServePage("login.tmpl"))
|
||||
r.POST("/login", HandleLogin)
|
||||
r.GET("/post", AdminOnly(), utils.ServePage("create_post.tmpl"))
|
||||
r.POST("/post", AdminOnly(), CreatePost)
|
||||
r.POST("/login", a.AdminLogin)
|
||||
r.GET("/post", a.AuthMiddleware, utils.ServePage("create_post.tmpl"))
|
||||
r.POST("/post", a.AuthMiddleware, a.CRUDPost)
|
||||
r.POST("/user", a.CreateAdmin)
|
||||
}
|
||||
|
||||
func HandleLogin(c *gin.Context) {
|
||||
if att[c.ClientIP()] > 5 {
|
||||
c.HTML(http.StatusUnauthorized, "forbidden.tmpl", models.Page{Title: " | forbidden"})
|
||||
func (a *AdminController) AuthMiddleware(c *gin.Context) {
|
||||
cookie, err := c.Request.Cookie("token")
|
||||
if err != nil {
|
||||
c.HTML(http.StatusForbidden, "forbidden.tmpl", &gin.H{})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
if a.ActiveLogins[cookie.Value] == 0 {
|
||||
c.HTML(http.StatusForbidden, "session_revoked.tmpl", &gin.H{})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
c.Next()
|
||||
}
|
||||
|
||||
func (a *AdminController) UserBannedMiddleware(c *gin.Context) {
|
||||
if a.IpIsBanned(c.ClientIP()) {
|
||||
c.HTML(http.StatusForbidden, "forbidden.tmpl", &gin.H{})
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
c.Next()
|
||||
}
|
||||
|
||||
func (a *AdminController) IpIsBanned(ip string) bool {
|
||||
return a.LoginAttemptsByIp[ip] >= 3
|
||||
}
|
||||
|
||||
func (a *AdminController) AdminLogin(c *gin.Context) {
|
||||
err := c.Request.ParseForm()
|
||||
if err != nil {
|
||||
c.HTML(http.StatusUnauthorized, "forbidden.tmpl", models.Page{Title: " | forbidden"})
|
||||
a.LoginAttemptsByIp[c.ClientIP()]++
|
||||
return
|
||||
}
|
||||
f := c.Request.Form
|
||||
for _, v := range []string{"username", "password"} {
|
||||
if !f.Has(v) {
|
||||
c.AbortWithStatus(http.StatusNotAcceptable)
|
||||
return
|
||||
}
|
||||
if !f.Has("username") ||
|
||||
!f.Has("password") {
|
||||
c.HTML(http.StatusNotAcceptable, "admin_success_redirect.tmpl", false)
|
||||
a.LoginAttemptsByIp[c.ClientIP()]++
|
||||
return
|
||||
}
|
||||
str := f.Get("username") + f.Get("password")
|
||||
s := sha256.Sum256([]byte(str))
|
||||
var success bool
|
||||
if s == admin_hash {
|
||||
c.SetCookie("admin_key", key, 3600, "/", "rawley.xyz", false, true)
|
||||
success = true
|
||||
} else {
|
||||
att[c.ClientIP()]++
|
||||
success = false
|
||||
ad, err := a.Repository.GetAdminByCredentials(f.Get("username"), f.Get("password"))
|
||||
if err != nil ||
|
||||
ad == nil {
|
||||
c.HTML(http.StatusNotAcceptable, "admin_success_redirect.tmpl", false)
|
||||
a.LoginAttemptsByIp[c.ClientIP()]++
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusOK, "admin_success_redirect.tmpl", struct {
|
||||
Success bool
|
||||
Title string
|
||||
}{Success: success, Title: "login"})
|
||||
a.ActiveLogins[ad.Token] = time.Now().UnixMilli() + (3600 * 1000)
|
||||
c.SetCookie("token", ad.Token, 3600*1000, "/", "rawley.xyz", true, true)
|
||||
c.HTML(http.StatusAccepted, "admin_success_redirect.tmpl", true)
|
||||
}
|
||||
|
||||
func CreatePost(c *gin.Context) {
|
||||
func (a *AdminController) CRUDPost(c *gin.Context) {
|
||||
err := c.Request.ParseForm()
|
||||
if err != nil {
|
||||
c.AbortWithStatus(http.StatusBadRequest)
|
||||
c.HTML(http.StatusNotAcceptable, "post_success.tmpl", false)
|
||||
return
|
||||
}
|
||||
f := c.Request.Form
|
||||
for _, v := range []string{"title", "content", "url"} {
|
||||
if !f.Has(v) {
|
||||
c.AbortWithStatus(http.StatusNotAcceptable)
|
||||
return
|
||||
}
|
||||
if f.Get("url") == "" ||
|
||||
f.Get("op") == "" {
|
||||
c.HTML(http.StatusNotAcceptable, "post_success.tmpl", false)
|
||||
return
|
||||
}
|
||||
b := AddBlogPost(&models.BlogPost{
|
||||
Title: f.Get("title"),
|
||||
Content: f.Get("content"),
|
||||
tempBlogRepo := repos.NewBlogRepo("dsn")
|
||||
tempPost := &models.BlogPost{
|
||||
Url: f.Get("url"),
|
||||
})
|
||||
c.HTML(http.StatusOK, "post_success.tmpl", struct {
|
||||
Url string
|
||||
Success bool
|
||||
Title string
|
||||
}{Url: f.Get("url"), Success: b, Title: " | post attempt"})
|
||||
Content: f.Get("content"),
|
||||
Title: f.Get("title"),
|
||||
}
|
||||
switch f.Get("op") {
|
||||
case "create":
|
||||
err = tempBlogRepo.CreateBlogPost(tempPost)
|
||||
break
|
||||
case "update":
|
||||
err = tempBlogRepo.UpdateExistingPost(tempPost)
|
||||
break
|
||||
case "delete":
|
||||
err = tempBlogRepo.DeleteExistingPost(tempPost)
|
||||
break
|
||||
default:
|
||||
c.HTML(http.StatusNotAcceptable, "post_success.tmpl", false)
|
||||
return
|
||||
}
|
||||
if err != nil {
|
||||
c.HTML(http.StatusNotAcceptable, "post_success.tmpl", false)
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusAccepted, "post_success.tmpl", true)
|
||||
}
|
||||
|
||||
func (a *AdminController) CreateAdmin(c *gin.Context) {
|
||||
err := c.Request.ParseForm()
|
||||
if err != nil {
|
||||
c.HTML(http.StatusNotAcceptable, "forbidden.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
var at models.Administrator
|
||||
f := c.Request.Form
|
||||
if !f.Has("password") ||
|
||||
!f.Has("username") ||
|
||||
!f.Has("api_key") {
|
||||
c.HTML(http.StatusBadRequest, "forbidden.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
at.Username = f.Get("username")
|
||||
at.Password = f.Get("password")
|
||||
if f.Get("api_key") != api_key {
|
||||
c.HTML(http.StatusForbidden, "forbidden.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
err = a.Repository.CreateAdmin(&at)
|
||||
if err != nil {
|
||||
c.HTML(http.StatusForbidden, "forbidden.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusAccepted, "post_success.tmpl", true)
|
||||
}
|
||||
|
||||
18
controllers/admin_test.go
Normal file
18
controllers/admin_test.go
Normal file
@@ -0,0 +1,18 @@
|
||||
package controllers
|
||||
|
||||
/*
|
||||
Copyright (C) 2022 Rawley Fowler
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.Rawley Fowler, 2022
|
||||
*/
|
||||
@@ -17,158 +17,47 @@ along with this program. If not, see <https://www.gnu.org/licenses/>.Rawley Fow
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gitlab.com/rawleyifowler/site-rework/models"
|
||||
"gitlab.com/rawleyifowler/site-rework/utils"
|
||||
"gorm.io/driver/mysql"
|
||||
"gorm.io/gorm"
|
||||
"gitlab.com/rawleyifowler/site-rework/repos"
|
||||
)
|
||||
|
||||
type CommentDto struct {
|
||||
Url string
|
||||
}
|
||||
|
||||
var (
|
||||
db *gorm.DB
|
||||
recentPosters map[string]uint
|
||||
captchaVals [2]int
|
||||
)
|
||||
type BlogController struct {
|
||||
Repository *repos.BlogRepo
|
||||
}
|
||||
|
||||
func NewBlogController(r *repos.BlogRepo) *BlogController {
|
||||
c := new(BlogController)
|
||||
c.Repository = r
|
||||
return c
|
||||
}
|
||||
|
||||
func RegisterBlogGroup(r *gin.RouterGroup) {
|
||||
// Initialize recent posters cache
|
||||
recentPosters = make(map[string]uint)
|
||||
// Load dsn and initialize database
|
||||
dsn := utils.LoadDSN("dsn")
|
||||
var err error
|
||||
db, err = gorm.Open(mysql.Open(dsn), &gorm.Config{})
|
||||
c := NewBlogController(repos.NewBlogRepo("dsn"))
|
||||
r.GET("/", c.IndexBlogPage)
|
||||
r.GET("/post/:url", c.IndividualBlogPage)
|
||||
}
|
||||
|
||||
func (bc *BlogController) IndexBlogPage(c *gin.Context) {
|
||||
posts, err := bc.Repository.GetAllBlogPosts()
|
||||
if err != nil {
|
||||
panic("Database connection failed...")
|
||||
}
|
||||
utils.PerformMigrations(db)
|
||||
r.GET("/", RenderBlogPage)
|
||||
r.GET("/post/:url", RenderIndividualBlogPost)
|
||||
r.POST("/post")
|
||||
r.POST("/post/comment", CreateComment)
|
||||
// Clear the commenters cache every 15 minutes
|
||||
go utils.TimedClearMap(&recentPosters, 320000*5)
|
||||
go utils.UpdateCaptcha(&captchaVals)
|
||||
}
|
||||
|
||||
func RenderBlogPage(c *gin.Context) {
|
||||
posts := GetAllBlogPosts()
|
||||
if posts == nil {
|
||||
c.HTML(http.StatusInternalServerError, "internal_server_error.tmpl", models.Page{Title: " | 500"})
|
||||
} else {
|
||||
c.HTML(http.StatusOK, "blog.tmpl", struct {
|
||||
Posts []models.BlogPost
|
||||
Title string
|
||||
}{Posts: *posts, Title: " | blog"})
|
||||
}
|
||||
}
|
||||
|
||||
func RenderIndividualBlogPost(c *gin.Context) {
|
||||
bp := GetBlogPostById(c.Param("url"))
|
||||
if bp == nil {
|
||||
c.HTML(http.StatusNotFound, "not_found.tmpl", models.Page{Title: "404"})
|
||||
return
|
||||
} else {
|
||||
// Blog posts handle the title themselves
|
||||
c.HTML(http.StatusOK, "blog_post.tmpl", struct {
|
||||
Post *models.BlogPost
|
||||
Captcha [2]int
|
||||
}{Post: bp, Captcha: captchaVals})
|
||||
}
|
||||
}
|
||||
|
||||
func CreateComment(c *gin.Context) {
|
||||
if c.Request.ParseForm() != nil {
|
||||
c.AbortWithStatus(http.StatusNotAcceptable)
|
||||
c.HTML(http.StatusInternalServerError, "internal_server_error.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
a := []string{c.Request.Form.Get("author"),
|
||||
c.Request.Form.Get("content"),
|
||||
c.Request.Form.Get("url"),
|
||||
c.Request.Form.Get("captcha")}
|
||||
// If the length of the comment is great enough, and the comment already exists we can safely assume it is spam.
|
||||
if len(a[1]) > 20 && len(*GetCommentsByContent(a[1], a[2])) > 0 {
|
||||
c.HTML(http.StatusNotAcceptable, "comment_post_failed.tmpl", CommentDto{Url: a[2]})
|
||||
return
|
||||
}
|
||||
i, err := strconv.ParseInt(a[3], 10, 32)
|
||||
if err != nil || int(i) != (captchaVals[0]+captchaVals[1]) {
|
||||
c.HTML(http.StatusNotAcceptable, "comment_post_failed.tmpl", CommentDto{Url: a[2]})
|
||||
return
|
||||
}
|
||||
if GetNumberOfRecentPosts(c) >= 2 {
|
||||
c.HTML(http.StatusNotAcceptable, "comment_post_spam.tmpl", CommentDto{Url: a[2]})
|
||||
return
|
||||
}
|
||||
for _, v := range a {
|
||||
if len(v) == 0 {
|
||||
c.HTML(http.StatusNotAcceptable, "comment_post_failed.tmpl", CommentDto{Url: a[2]})
|
||||
return
|
||||
}
|
||||
}
|
||||
comment := models.Comment{
|
||||
Author: a[0],
|
||||
Content: a[1],
|
||||
AssociatedPost: a[2],
|
||||
}
|
||||
db.Create(&comment)
|
||||
// Something was wrong with c.ClientIP() with trusted?? Weird.
|
||||
recentPosters[c.ClientIP()]++
|
||||
// Pass the associated post to the template to add to the href
|
||||
c.HTML(http.StatusOK, "comment_post.tmpl", CommentDto{Url: comment.AssociatedPost})
|
||||
c.HTML(http.StatusOK, "blog.tmpl", *posts)
|
||||
}
|
||||
|
||||
func GetNumberOfRecentPosts(c *gin.Context) uint {
|
||||
return recentPosters[c.ClientIP()]
|
||||
}
|
||||
|
||||
func AddBlogPost(bp *models.BlogPost) bool {
|
||||
err := db.Create(bp).Error
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func DeleteBlogPostById(id string) bool {
|
||||
err := db.Model(&models.BlogPost{}).Delete(&models.BlogPost{Url: id}).Error
|
||||
return err == nil
|
||||
}
|
||||
|
||||
func GetAllBlogPosts() *[]models.BlogPost {
|
||||
var posts []models.BlogPost
|
||||
// Select title, date, and url fields from the blog post records an store them in posts.
|
||||
// This is so we don't grab the entire blog post when we render them on the overview page. Saves a couple ms.
|
||||
err := db.Model(&models.BlogPost{}).Select("title, date, url").Order("date DESC").Scan(&posts).Error
|
||||
func (bc *BlogController) IndividualBlogPage(c *gin.Context) {
|
||||
post, err := bc.Repository.GetBlogByUrl(c.Param("url"))
|
||||
if err != nil {
|
||||
return nil
|
||||
c.HTML(http.StatusNotFound, "not_found.tmpl", &gin.H{})
|
||||
return
|
||||
}
|
||||
return &posts
|
||||
}
|
||||
|
||||
func GetBlogPostById(id string) *models.BlogPost {
|
||||
var post models.BlogPost = models.BlogPost{}
|
||||
err := db.Model(&post).Where(&models.BlogPost{Url: id}).Find(&post).Error
|
||||
if err != nil || post.Equals(&models.BlogPost{}) {
|
||||
return nil
|
||||
}
|
||||
// TODO: Figure out gorm joins!
|
||||
// gorm joins are not working at all, just going to do another query to make it work for now.
|
||||
err = db.Model(&models.Comment{}).Where(&models.Comment{AssociatedPost: id}).Find(&post.Comments).Error
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
return &post
|
||||
}
|
||||
|
||||
func GetCommentsByContent(content string, url string) *[]models.Comment {
|
||||
// This is used to make sure people don't paste the same thing over and over.
|
||||
var comments []models.Comment
|
||||
err := db.Model(&comments).Where("content like ? and associated_post like ?", "%"+content[1:]+"%", url).Scan(&comments).Error
|
||||
if err != nil {
|
||||
return &[]models.Comment{}
|
||||
}
|
||||
return &comments
|
||||
// TODO: Re implement captcha here. It is already included on the blog post model, though not in the database.
|
||||
// The idea is to generate a captcha for each post, and index them by title. The async service should then update each captcha every hour.
|
||||
c.HTML(http.StatusOK, "blog_post.tmpl", post)
|
||||
}
|
||||
|
||||
@@ -1 +1,18 @@
|
||||
package controllers
|
||||
|
||||
/*
|
||||
Copyright (C) 2022 Rawley Fowler
|
||||
|
||||
This program is free software: you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation, either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <https://www.gnu.org/licenses/>.Rawley Fowler, 2022
|
||||
*/
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
package controllers
|
||||
Reference in New Issue
Block a user