diff --git a/controllers/admin.go b/controllers/admin.go
index 6d09ec0..4875de6 100644
--- a/controllers/admin.go
+++ b/controllers/admin.go
@@ -2,6 +2,7 @@ package controllers
import (
"crypto/sha256"
+ "fmt"
"net/http"
"github.com/gin-gonic/gin"
@@ -11,19 +12,25 @@ import (
var (
key string = utils.LoadApiKey("api_key.pem")
- admin_hash string = utils.LoadAdminHash("admin_hash.pem")
+ admin_hash [32]byte = utils.LoadAdminHash("admin_hash.pem")
att map[string]uint32 = make(map[string]uint32)
)
// Ensure is logged in
func AdminOnly() gin.HandlerFunc {
return func(c *gin.Context) {
+ var status uint = http.StatusOK
k, err := c.Cookie("admin_key")
if err != nil {
- c.Redirect(http.StatusPermanentRedirect, "/admin/")
+ status = http.StatusForbidden
}
- if k == key {
+ fmt.Println(k)
+ if k == key && status == http.StatusOK {
c.Next()
+ } else {
+ c.HTML(int(status), "forbidden.tmpl", models.Page{Title: " | forbidden"})
+ c.Abort()
+ return
}
}
}
@@ -37,41 +44,48 @@ func RegisterAdminGroup(r *gin.RouterGroup) {
func HandleLogin(c *gin.Context) {
if att[c.ClientIP()] > 5 {
- c.Redirect(http.StatusPermanentRedirect, "/admin/")
+ c.HTML(http.StatusForbidden, "forbidden.tmpl", models.Page{Title: " | forbidden"})
+ return
}
err := c.Request.ParseForm()
if err != nil {
- c.Redirect(http.StatusPermanentRedirect, "/admin/")
+ c.HTML(http.StatusForbidden, "forbidden.tmpl", models.Page{Title: " | forbidden"})
+ return
}
f := c.Request.Form
for _, v := range []string{"username", "password"} {
if !f.Has(v) {
c.AbortWithStatus(http.StatusNotAcceptable)
+ return
}
}
str := f.Get("username") + f.Get("password")
- s := sha256.New()
- s.Sum([]byte(str))
- var h []byte
- s.Write(h)
- if string(h) == admin_hash {
- c.SetCookie("admin_key", key, 1, "/", "rawley.xyz", true, true)
- c.Redirect(http.StatusTemporaryRedirect, "/admin/post")
+ s := sha256.Sum256([]byte(str))
+ var success bool
+ if s == admin_hash {
+ c.SetCookie("admin_key", key, 3600, "/", "rawley.xyz", false, true)
+ success = true
} else {
att[c.ClientIP()]++
- c.Redirect(http.StatusTemporaryRedirect, "/admin/")
+ success = false
}
+ c.HTML(http.StatusOK, "admin_success_redirect.tmpl", struct {
+ Success bool
+ Title string
+ }{Success: success, Title: "login"})
}
func CreatePost(c *gin.Context) {
err := c.Request.ParseForm()
if err != nil {
c.AbortWithStatus(http.StatusBadRequest)
+ return
}
f := c.Request.Form
for _, v := range []string{"title", "content", "url"} {
if !f.Has(v) {
c.AbortWithStatus(http.StatusNotAcceptable)
+ return
}
}
b := AddBlogPost(&models.BlogPost{
@@ -79,9 +93,8 @@ func CreatePost(c *gin.Context) {
Content: f.Get("content"),
Url: f.Get("url"),
})
- if b {
- c.Redirect(http.StatusTemporaryRedirect, "/blog/post/"+f.Get("url"))
- } else {
- c.Redirect(http.StatusTemporaryRedirect, "/admin/post")
- }
+ c.HTML(http.StatusOK, "post_success.tmpl", struct {
+ Url string
+ Success bool
+ }{Url: f.Get("url"), Success: b})
}
diff --git a/controllers/blog.go b/controllers/blog.go
index 889b72e..d913f3f 100644
--- a/controllers/blog.go
+++ b/controllers/blog.go
@@ -84,6 +84,7 @@ func RenderIndividualBlogPost(c *gin.Context) {
func CreateComment(c *gin.Context) {
if c.Request.ParseForm() != nil {
c.AbortWithStatus(http.StatusNotAcceptable)
+ return
}
a := []string{c.Request.Form.Get("author"),
c.Request.Form.Get("content"),
@@ -92,7 +93,7 @@ func CreateComment(c *gin.Context) {
// If the length of the comment is great enough, and the comment already exists we can safely assume it is spam.
if len(a[1]) > 20 && len(*GetCommentsByContent(a[1], a[2])) > 0 {
c.HTML(http.StatusNotAcceptable, "comment_post_failed.tmpl", CommentDto{Url: a[2]})
- c.Abort()
+ return
}
i, err := strconv.ParseInt(a[3], 10, 32)
if err != nil || int(i) != (captchaVals[0]+captchaVals[1]) {
diff --git a/e b/e
new file mode 100644
index 0000000..12a9954
--- /dev/null
+++ b/e
@@ -0,0 +1,43 @@
+[GIN-debug] [WARNING] Creating an Engine instance with the Logger and Recovery middleware already attached.
+
+[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
+ - using env: export GIN_MODE=release
+ - using code: gin.SetMode(gin.ReleaseMode)
+
+[GIN-debug] Loaded HTML Templates (20):
+ - forbidden.tmpl
+ - not_found.tmpl
+ - create_post.tmpl
+ - footer.tmpl
+ - blog_post.tmpl
+ - comment_post.tmpl
+ - contact.tmpl
+ - index.tmpl
+ - login.tmpl
+ - resume.tmpl
+ -
+ - blog.tmpl
+ - wip.tmpl
+ - comment_post_spam.tmpl
+ - footer_no_banners.tmpl
+ - header.tmpl
+ - internal_server_error.tmpl
+ - nav.tmpl
+ - admin_success_redirect.tmpl
+ - comment_post_failed.tmpl
+
+[GIN-debug] GET /blog/ --> gitlab.com/rawleyifowler/site-rework/controllers.RenderBlogPage (4 handlers)
+[GIN-debug] GET /blog/post/:url --> gitlab.com/rawleyifowler/site-rework/controllers.RenderIndividualBlogPost (4 handlers)
+[GIN-debug] POST /blog/post --> github.com/gin-gonic/gin.CustomRecoveryWithWriter.func1 (3 handlers)
+[GIN-debug] POST /blog/post/comment --> gitlab.com/rawleyifowler/site-rework/controllers.CreateComment (4 handlers)
+[GIN-debug] GET /admin/ --> gitlab.com/rawleyifowler/site-rework/utils.ServePage.func1 (4 handlers)
+[GIN-debug] POST /admin/login --> gitlab.com/rawleyifowler/site-rework/controllers.HandleLogin (4 handlers)
+[GIN-debug] GET /admin/post --> gitlab.com/rawleyifowler/site-rework/utils.ServePage.func1 (5 handlers)
+[GIN-debug] POST /admin/post --> gitlab.com/rawleyifowler/site-rework/controllers.CreatePost (5 handlers)
+[GIN-debug] GET / --> gitlab.com/rawleyifowler/site-rework/utils.ServePage.func1 (4 handlers)
+[GIN-debug] GET /resume --> gitlab.com/rawleyifowler/site-rework/utils.ServePage.func1 (4 handlers)
+[GIN-debug] GET /contact --> gitlab.com/rawleyifowler/site-rework/utils.ServePage.func1 (4 handlers)
+[GIN-debug] [WARNING] You trusted all proxies, this is NOT safe. We recommend you to set a value.
+Please check https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies for details.
+[GIN-debug] Listening and serving HTTP on :8080
+signal: interrupt
diff --git a/templates/admin_success_redirect.tmpl b/templates/admin_success_redirect.tmpl
new file mode 100644
index 0000000..8a0cc7f
--- /dev/null
+++ b/templates/admin_success_redirect.tmpl
@@ -0,0 +1,10 @@
+{{ template "header.tmpl" . }}
+{{ if .Success }}
+ Login was successful!
+ Click here to go to the post creation area.
+{{ else }}
+ Login was not successful!
+ Click here to return to the login page to try again.
+{{ end }}
+
+