Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-26 16:46:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: no more session cookie for guests (#7982)

Browse Source 
* feat: no more session cookie for guests

* fix(tests): added additional tests and fixed the broken test
This commit is contained in:
Julian Lam
2019-10-22 13:38:36 -04:00
committed by GitHub
parent 6155c4600f
commit cf7e0cfd2d
5 changed files with 43 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/controllers/accounts/profile.js
View File

@@ -66,7 +66,7 @@ profileController.get = async function (req, res, next) {
};
async function incrementProfileViews(req, userData) {
if (req.uid >= 0) {
if (req.uid >= 1) {
req.session.uids_viewed = req.session.uids_viewed || {};
if (req.uid !== userData.uid && (!req.session.uids_viewed[userData.uid] || req.session.uids_viewed[userData.uid] < Date.now() - 3600000)) {

7
src/controllers/authentication.js
View File

@@ -399,7 +399,7 @@ authenticationController.localLogin = async function (req, username, password, n
}
};
const regenerateAsync = util.promisify((req, callback) => req.session.regenerate(callback));
const destroyAsync = util.promisify((req, callback) => req.session.destroy(callback));
authenticationController.logout = async function (req, res, next) {
if (!req.loggedIn || !req.sessionID) {
@@ -412,7 +412,10 @@ authenticationController.logout = async function (req, res, next) {
await user.auth.revokeSession(sessionID, uid);
req.logout();
await regenerateAsync(req);
await destroyAsync(req);
res.clearCookie('express.sid', {
path: nconf.get('relative_path'),
});
req.uid = 0;
req.headers['x-csrf-token'] = req.csrfToken();

2
src/controllers/topics.js
View File

@@ -127,7 +127,7 @@ function calculateStartStop(page, postIndex, settings) {
}
function incrementViewCount(req, tid) {
if (req.uid >= 0) {
if (req.uid >= 1) {
req.session.tids_viewed = req.session.tids_viewed || {};
if (!req.session.tids_viewed[tid] || req.session.tids_viewed[tid] < Date.now() - 3600000) {
topics.increaseViewCount(tid);

4
src/middleware/index.js
View File

@@ -31,7 +31,9 @@ middleware.regexes = {
timestampedUpload: /^\d+-.+$/,
};
middleware.applyCSRF = csrf();
middleware.applyCSRF = csrf({
cookie: true,
});
middleware.ensureLoggedIn = ensureLoggedIn.ensureLoggedIn(nconf.get('relative_path') + '/login');

33
test/controllers.js
View File

@@ -1398,8 +1398,38 @@ describe('Controllers', function () {
});
});
it('should increase profile view', function (done) {
it('should not increase profile view if you visit your own profile', (done) => {
request(nconf.get('url') + '/api/user/foo', { jar: jar }, function (err, res) {
assert.ifError(err);
assert.equal(res.statusCode, 200);
setTimeout(function () {
user.getUserField(fooUid, 'profileviews', function (err, viewcount) {
assert.ifError(err);
assert(viewcount === 0);
done();
});
}, 500);
});
});
it('should not increase profile view if a guest visits a profile', (done) => {
request(nconf.get('url') + '/api/user/foo', { }, function (err, res) {
assert.ifError(err);
assert.equal(res.statusCode, 200);
setTimeout(function () {
user.getUserField(fooUid, 'profileviews', function (err, viewcount) {
assert.ifError(err);
assert(viewcount === 0);
done();
});
}, 500);
});
});
it('should increase profile view', function (done) {
helpers.loginUser('regularJoe', 'barbar', function (err, jar) {
assert.ifError(err);
request(nconf.get('url') + '/api/user/foo', { jar: jar }, function (err, res) {
assert.ifError(err);
assert.equal(res.statusCode, 200);
setTimeout(function () {
@@ -1411,6 +1441,7 @@ describe('Controllers', function () {
}, 500);
});
});
});
it('should parse about me', function (done) {
user.setUserFields(fooUid, { picture: '/path/to/picture', aboutme: 'hi i am a bot' }, function (err) {