Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-11-01 19:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

started work on #2082

Browse Source
This commit is contained in:
Julian Lam
2014-09-14 10:21:32 -04:00
parent 3360752c5c
commit 40e5ad075f
11 changed files with 24 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
public/src/app.js
View File

@@ -161,9 +161,7 @@ var socket,
}; };
app.logout = function() { app.logout = function() {
$.post(RELATIVE_PATH + '/logout', { $.post(RELATIVE_PATH + '/logout', function() {
_csrf: $('#csrf_token').val()
}, function() {
window.location.href = RELATIVE_PATH + '/'; window.location.href = RELATIVE_PATH + '/';
}); });
}; };

4
public/src/forum/admin/index.js
View File

@@ -13,9 +13,7 @@ define('forum/admin/index', function() {
socket.on('event:meta.rooms.update', Admin.updateRoomUsage); socket.on('event:meta.rooms.update', Admin.updateRoomUsage);
$('#logout-link').on('click', function() { $('#logout-link').on('click', function() {
$.post(RELATIVE_PATH + '/logout', { $.post(RELATIVE_PATH + '/logout', function() {
_csrf: $('#csrf_token').val()
}, function() {
window.location.href = RELATIVE_PATH + '/'; window.location.href = RELATIVE_PATH + '/';
}); });
}); });

3
public/src/modules/uploader.js
View File

@@ -58,9 +58,6 @@ define('uploader', function() {
return false; return false;
} }
$(this).find('#imageUploadCsrf').val($('#csrf_token').val());
$(this).ajaxSubmit({ $(this).ajaxSubmit({
error: function(xhr) { error: function(xhr) {
xhr = maybeParse(xhr); xhr = maybeParse(xhr);

4
src/controllers/admin.js
View File

@@ -181,7 +181,9 @@ adminController.languages.get = function(req, res, next) {
}; };
adminController.settings.get = function(req, res, next) { adminController.settings.get = function(req, res, next) {
res.render('admin/settings', {}); res.render('admin/settings', {
'csrf': req.csrfToken()
});
}; };
adminController.logger.get = function(req, res, next) { adminController.logger.get = function(req, res, next) {

4
src/controllers/index.js
View File

@@ -123,7 +123,7 @@ Controllers.login = function(req, res, next) {
data.alternate_logins = num_strategies > 0; data.alternate_logins = num_strategies > 0;
data.authentication = login_strategies; data.authentication = login_strategies;
data.token = res.locals.csrf_token; data.token = req.csrfToken();
data.showResetLink = emailersPresent; data.showResetLink = emailersPresent;
data.allowLocalLogin = meta.config.allowLocalLogin === undefined || parseInt(meta.config.allowLocalLogin, 10) === 1; data.allowLocalLogin = meta.config.allowLocalLogin === undefined || parseInt(meta.config.allowLocalLogin, 10) === 1;
data.allowRegistration = meta.config.allowRegistration; data.allowRegistration = meta.config.allowRegistration;
@@ -152,7 +152,7 @@ Controllers.register = function(req, res, next) {
data.authentication = login_strategies; data.authentication = login_strategies;
data.token = res.locals.csrf_token; data.token = req.csrfToken();
data.minimumUsernameLength = meta.config.minimumUsernameLength; data.minimumUsernameLength = meta.config.minimumUsernameLength;
data.maximumUsernameLength = meta.config.maximumUsernameLength; data.maximumUsernameLength = meta.config.maximumUsernameLength;
data.minimumPasswordLength = meta.config.minimumPasswordLength; data.minimumPasswordLength = meta.config.minimumPasswordLength;

2
src/middleware/admin.js
View File

@@ -61,7 +61,7 @@ middleware.buildHeader = function(req, res, next) {
} }
}, function(err, pluginData) { }, function(err, pluginData) {
var data = { var data = {
csrf: res.locals.csrf_token, csrf: req.csrfToken ? req.csrfToken() : undefined,
relative_path: nconf.get('relative_path'), relative_path: nconf.get('relative_path'),
plugins: pluginData.custom_header.plugins, plugins: pluginData.custom_header.plugins,
authentication: pluginData.custom_header.authentication, authentication: pluginData.custom_header.authentication,

3
src/middleware/index.js
View File

@@ -20,7 +20,6 @@ var utils = require('./../../public/src/utils'),
compression = require('compression'), compression = require('compression'),
favicon = require('serve-favicon'), favicon = require('serve-favicon'),
multipart = require('connect-multiparty'), multipart = require('connect-multiparty'),
csrf = require('csurf'),
session = require('express-session'), session = require('express-session'),
relativePath, relativePath,
@@ -107,10 +106,8 @@ module.exports = function(app, data) {
})); }));
app.use(multipart()); app.use(multipart());
app.use(csrf());
app.use(function (req, res, next) { app.use(function (req, res, next) {
res.locals.csrf_token = req.csrfToken();
res.setHeader('X-Powered-By', 'NodeBB'); res.setHeader('X-Powered-By', 'NodeBB');
res.setHeader('X-Frame-Options', 'SAMEORIGIN'); res.setHeader('X-Frame-Options', 'SAMEORIGIN');

5
src/middleware/middleware.js
View File

@@ -16,6 +16,7 @@ var app,
topics = require('./../topics'), topics = require('./../topics'),
messaging = require('../messaging'), messaging = require('../messaging'),
ensureLoggedIn = require('connect-ensure-login'), ensureLoggedIn = require('connect-ensure-login'),
csrf = require('csurf'),
controllers = { controllers = {
api: require('./../controllers/api') api: require('./../controllers/api')
@@ -33,6 +34,8 @@ middleware.authenticate = function(req, res, next) {
} }
}; };
middleware.requireCSRF = csrf();
middleware.ensureLoggedIn = ensureLoggedIn.ensureLoggedIn(); middleware.ensureLoggedIn = ensureLoggedIn.ensureLoggedIn();
middleware.updateLastOnlineTime = function(req, res, next) { middleware.updateLastOnlineTime = function(req, res, next) {
@@ -251,7 +254,7 @@ middleware.renderHeader = function(req, res, callback) {
'cache-buster': meta.config['cache-buster'] ? 'v=' + meta.config['cache-buster'] : '', 'cache-buster': meta.config['cache-buster'] ? 'v=' + meta.config['cache-buster'] : '',
'brand:logo': meta.config['brand:logo'] || '', 'brand:logo': meta.config['brand:logo'] || '',
'brand:logo:display': meta.config['brand:logo']?'':'hide', 'brand:logo:display': meta.config['brand:logo']?'':'hide',
csrf: res.locals.csrf_token, csrf: req.csrfToken ? req.csrfToken() : undefined,
navigation: custom_header.navigation, navigation: custom_header.navigation,
allowRegistration: meta.config.allowRegistration === undefined || parseInt(meta.config.allowRegistration, 10) === 1, allowRegistration: meta.config.allowRegistration === undefined || parseInt(meta.config.allowRegistration, 10) === 1,
searchEnabled: plugins.hasListeners('filter:search.query') searchEnabled: plugins.hasListeners('filter:search.query')

12
src/routes/admin.js
View File

@@ -9,8 +9,8 @@ function mainRoutes(app, middleware, controllers) {
app.get('/admin/plugins', middleware.admin.buildHeader, controllers.admin.plugins.get); app.get('/admin/plugins', middleware.admin.buildHeader, controllers.admin.plugins.get);
app.get('/api/admin/plugins', controllers.admin.plugins.get); app.get('/api/admin/plugins', controllers.admin.plugins.get);
app.get('/admin/settings', middleware.admin.buildHeader, controllers.admin.settings.get); app.get('/admin/settings', middleware.requireCSRF, middleware.admin.buildHeader, controllers.admin.settings.get);
app.get('/api/admin/settings', controllers.admin.settings.get); app.get('/api/admin/settings', middleware.requireCSRF, controllers.admin.settings.get);
app.get('/admin/themes', middleware.admin.buildHeader, controllers.admin.themes.get); app.get('/admin/themes', middleware.admin.buildHeader, controllers.admin.themes.get);
app.get('/api/admin/themes', controllers.admin.themes.get); app.get('/api/admin/themes', controllers.admin.themes.get);
@@ -57,10 +57,10 @@ function apiRoutes(app, middleware, controllers) {
// todo, needs to be in api namespace // todo, needs to be in api namespace
app.get('/admin/users/csv', middleware.authenticate, controllers.admin.users.getCSV); app.get('/admin/users/csv', middleware.authenticate, controllers.admin.users.getCSV);
app.post('/admin/category/uploadpicture', middleware.authenticate, controllers.admin.uploads.uploadCategoryPicture); app.post('/admin/category/uploadpicture', middleware.requireCSRF, middleware.authenticate, controllers.admin.uploads.uploadCategoryPicture);
app.post('/admin/uploadfavicon', middleware.authenticate, controllers.admin.uploads.uploadFavicon); app.post('/admin/uploadfavicon', middleware.requireCSRF, middleware.authenticate, controllers.admin.uploads.uploadFavicon);
app.post('/admin/uploadlogo', middleware.authenticate, controllers.admin.uploads.uploadLogo); app.post('/admin/uploadlogo', middleware.requireCSRF, middleware.authenticate, controllers.admin.uploads.uploadLogo);
app.post('/admin/uploadgravatardefault', middleware.authenticate, controllers.admin.uploads.uploadGravatarDefault); app.post('/admin/uploadgravatardefault', middleware.requireCSRF, middleware.authenticate, controllers.admin.uploads.uploadGravatarDefault);
} }
function miscRoutes(app, middleware, controllers) { function miscRoutes(app, middleware, controllers) {

4
src/routes/authentication.js
View File

@@ -197,8 +197,8 @@
/* End backwards compatibility block */ /* End backwards compatibility block */
app.post('/logout', logout); app.post('/logout', logout);
app.post('/register', register); app.post('/register', middleware.requireCSRF, register);
app.post('/login', login); app.post('/login', middleware.requireCSRF, login);
}); });
}); });
}; };

8
src/routes/index.js
View File

@@ -21,11 +21,11 @@ function mainRoutes(app, middleware, controllers) {
app.get('/', middleware.buildHeader, controllers.home); app.get('/', middleware.buildHeader, controllers.home);
app.get('/api', controllers.home); app.get('/api', controllers.home);
app.get('/login', middleware.redirectToAccountIfLoggedIn, middleware.buildHeader, controllers.login); app.get('/login', middleware.requireCSRF, middleware.redirectToAccountIfLoggedIn, middleware.buildHeader, controllers.login);
app.get('/api/login', middleware.redirectToAccountIfLoggedIn, controllers.login); app.get('/api/login', middleware.requireCSRF, middleware.redirectToAccountIfLoggedIn, controllers.login);
app.get('/register', middleware.redirectToAccountIfLoggedIn, middleware.buildHeader, controllers.register); app.get('/register', middleware.requireCSRF, middleware.redirectToAccountIfLoggedIn, middleware.buildHeader, controllers.register);
app.get('/api/register', middleware.redirectToAccountIfLoggedIn, controllers.register); app.get('/api/register', middleware.requireCSRF, middleware.redirectToAccountIfLoggedIn, controllers.register);
app.get('/confirm/:code', middleware.buildHeader, controllers.confirmEmail); app.get('/confirm/:code', middleware.buildHeader, controllers.confirmEmail);
app.get('/api/confirm/:code', controllers.confirmEmail); app.get('/api/confirm/:code', controllers.confirmEmail);