added admin page, adjusted way of creating posts

controllers/admin.go

@@ -0,0 +1,87 @@
+package controllers
+
+import (
+	"crypto/sha256"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"gitlab.com/rawleyifowler/site-rework/models"
+	"gitlab.com/rawleyifowler/site-rework/utils"
+)
+
+var (
+	key        string            = utils.LoadApiKey("api_key.pem")
+	admin_hash string            = utils.LoadAdminHash("admin_hash.pem")
+	att        map[string]uint32 = make(map[string]uint32)
+)
+
+// Ensure is logged in
+func AdminOnly() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		k, err := c.Cookie("admin_key")
+		if err != nil {
+			c.Redirect(http.StatusPermanentRedirect, "/admin/")
+		}
+		if k == key {
+			c.Next()
+		}
+	}
+}
+
+func RegisterAdminGroup(r *gin.RouterGroup) {
+	r.GET("/", utils.ServePage("login.tmpl"))
+	r.POST("/login", HandleLogin)
+	r.GET("/post", AdminOnly(), utils.ServePage("create_post.tmpl"))
+	r.POST("/post", AdminOnly(), CreatePost)
+}
+
+func HandleLogin(c *gin.Context) {
+	if att[c.ClientIP()] > 5 {
+		c.Redirect(http.StatusPermanentRedirect, "/admin/")
+	}
+	err := c.Request.ParseForm()
+	if err != nil {
+		c.Redirect(http.StatusPermanentRedirect, "/admin/")
+	}
+	f := c.Request.Form
+	for _, v := range []string{"username", "password"} {
+		if !f.Has(v) {
+			c.AbortWithStatus(http.StatusNotAcceptable)
+		}
+	}
+	str := f.Get("username") + f.Get("password")
+	s := sha256.New()
+	s.Sum([]byte(str))
+	var h []byte
+	s.Write(h)
+	if string(h) == admin_hash {
+		c.SetCookie("admin_key", key, 1, "/", "rawley.xyz", true, true)
+		c.Redirect(http.StatusTemporaryRedirect, "/admin/post")
+	} else {
+		att[c.ClientIP()]++
+		c.Redirect(http.StatusTemporaryRedirect, "/admin/")
+	}
+}
+
+func CreatePost(c *gin.Context) {
+	err := c.Request.ParseForm()
+	if err != nil {
+		c.AbortWithStatus(http.StatusBadRequest)
+	}
+	f := c.Request.Form
+	for _, v := range []string{"title", "content", "url"} {
+		if !f.Has(v) {
+			c.AbortWithStatus(http.StatusNotAcceptable)
+		}
+	}
+	b := AddBlogPost(&models.BlogPost{
+		Title:   f.Get("title"),
+		Content: f.Get("content"),
+		Url:     f.Get("url"),
+	})
+	if b {
+		c.Redirect(http.StatusTemporaryRedirect, "/blog/post/"+f.Get("url"))
+	} else {
+		c.Redirect(http.StatusTemporaryRedirect, "/admin/post")
+	}
+}

controllers/blog.go

@@ -16,8 +16,6 @@ along with this program.  If not, see <https://www.gnu.org/licenses/>.Rawley Fow
 */
 
 import (
-	"encoding/json"
-	"io/ioutil"
 	"net/http"
 	"strconv"
 
@@ -34,7 +32,6 @@ type CommentDto struct {
 
 var (
 	db            *gorm.DB
-	apiKey        string
 	recentPosters map[string]uint
 	captchaVals   [2]int
 )
@@ -44,8 +41,6 @@ func RegisterBlogGroup(r *gin.RouterGroup) {
 	recentPosters = make(map[string]uint)
 	// Load dsn and initialize database
 	dsn := utils.LoadDSN("dsn")
-	// Load and initialize api key
-	apiKey = utils.LoadApiKey("api_key.pem")
 	var err error
 	db, err = gorm.Open(mysql.Open(dsn), &gorm.Config{})
 	if err != nil {
@@ -54,7 +49,7 @@ func RegisterBlogGroup(r *gin.RouterGroup) {
 	utils.PerformMigrations(db)
 	r.GET("/", RenderBlogPage)
 	r.GET("/post/:url", RenderIndividualBlogPost)
-	r.POST("/post", CreateBlogPost)
+	r.POST("/post")
 	r.POST("/post/comment", CreateComment)
 	// Clear the commenters cache every 15 minutes
 	go utils.TimedClearMap(&recentPosters, 180000*5)
@@ -86,40 +81,9 @@ func RenderIndividualBlogPost(c *gin.Context) {
 	}
 }
 
-func CreateBlogPost(c *gin.Context) {
-	reqKey, err := c.Request.Cookie("APK")
-	if err != nil {
-		c.Status(http.StatusForbidden)
-		return
-	}
-	if reqKey.Value != apiKey {
-		c.Status(http.StatusForbidden)
-		return
-	}
-	raw, err := ioutil.ReadAll(c.Request.Body)
-	if err != nil {
-		c.Status(http.StatusNotAcceptable)
-		return
-	}
-	var data models.BlogPost
-	// Write the data from the request to the data variable
-	if json.Unmarshal([]byte(raw), &data) != nil {
-		c.Status(http.StatusNotAcceptable)
-		return
-	}
-	// Create the blog post in the database
-	err = db.Create(&data).Error
-	if err != nil {
-		c.JSON(http.StatusNotAcceptable, "{ \"error\": "+err.Error()+" }")
-	} else {
-		c.Status(http.StatusAccepted)
-	}
-}
-
 func CreateComment(c *gin.Context) {
 	if c.Request.ParseForm() != nil {
-		c.Status(http.StatusNotAcceptable)
-		return
+		c.AbortWithStatus(http.StatusNotAcceptable)
 	}
 	a := []string{c.Request.Form.Get("author"),
 		c.Request.Form.Get("content"),
@@ -128,7 +92,7 @@ func CreateComment(c *gin.Context) {
 	// If the length of the comment is great enough, and the comment already exists we can safely assume it is spam.
 	if len(a[1]) > 20 && len(*GetCommentsByContent(a[1], a[2])) > 0 {
 		c.HTML(http.StatusNotAcceptable, "comment_post_failed.tmpl", CommentDto{Url: a[2]})
-		return
+		c.Abort()
 	}
 	i, err := strconv.ParseInt(a[3], 10, 32)
 	if err != nil || int(i) != (captchaVals[0]+captchaVals[1]) {
@@ -160,6 +124,11 @@ func GetNumberOfRecentPosts(c *gin.Context) uint {
 	return recentPosters[c.ClientIP()]
 }
 
+func AddBlogPost(bp *models.BlogPost) bool {
+	err := db.Create(bp).Error
+	return err == nil
+}
+
 func DeleteBlogPostById(id string) bool {
 	err := db.Model(&models.BlogPost{}).Delete(&models.BlogPost{Url: id}).Error
 	return err == nil