fix: mongo username/pwd

Co-authored-by: Brophy <paul.brophy@bastage.net>

public/src/client/account/info.js

@@ -21,7 +21,7 @@ define('forum/account/info', ['forum/account/header', 'components', 'forum/accou
 				app.alertSuccess('[[user:info.moderation-note.success]]');
 				var timestamp = Date.now();
 				var data = [{
-					note: note,
+					note: utils.escapeHTML(note),
 					user: app.user,
 					timestamp: timestamp,
 					timestampISO: utils.toISOString(timestamp),

public/src/client/login.js

@@ -1,7 +1,7 @@
 'use strict';
 
 
-define('forum/login', ['jquery-form'], function () {
+define('forum/login', ['translator', 'jquery-form'], function (translator) {
 	var	Login = {
 		_capsState: false,
 	};
@@ -44,17 +44,22 @@ define('forum/login', ['jquery-form'], function () {
 						window.location.href = pathname + '?' + qs;
 					},
 					error: function (data) {
+						var message = data.responseText;
+						var errInfo = data.responseJSON;
 						if (data.status === 403 && data.responseText === 'Forbidden') {
 							window.location.href = config.relative_path + '/login?error=csrf-invalid';
-						} else {
-							errorEl.find('p').translateText(data.responseText);
-							errorEl.show();
-							submitEl.removeClass('disabled');
+						} else if (errInfo && errInfo.hasOwnProperty('banned_until')) {
+							message = errInfo.banned_until ?
+								translator.compile('error:user-banned-reason-until', (new Date(errInfo.banned_until).toLocaleString()), errInfo.reason) :
+								'[[error:user-banned-reason, ' + errInfo.reason + ']]';
+						}
+						errorEl.find('p').translateText(message);
+						errorEl.show();
+						submitEl.removeClass('disabled');
 
-							// Select the entire password if that field has focus
-							if ($('#password:focus').length) {
-								$('#password').select();
-							}
+						// Select the entire password if that field has focus
+						if ($('#password:focus').length) {
+							$('#password').select();
 						}
 					},
 				});

public/src/sockets.js

@@ -208,15 +208,20 @@ socket = window.socket;
 	}
 
 	function onEventBanned(data) {
-		var message = data.until ? '[[error:user-banned-reason-until, ' + utils.toISOString(data.until) + ', ' + data.reason + ']]' : '[[error:user-banned-reason, ' + data.reason + ']]';
-
-		bootbox.alert({
-			title: '[[error:user-banned]]',
-			message: message,
-			closeButton: false,
-			callback: function () {
-				window.location.href = config.relative_path + '/';
-			},
+		require(['translator'], function (translator) {
+			var message = data.until ?
+				translator.compile('error:user-banned-reason-until', (new Date(data.until).toLocaleString()), data.reason) :
+				'[[error:user-banned-reason, ' + data.reason + ']]';
+			translator.translate(message, function (message) {
+				bootbox.alert({
+					title: '[[error:user-banned]]',
+					message: message,
+					closeButton: false,
+					callback: function () {
+						window.location.href = config.relative_path + '/';
+					},
+				});
+			});
 		});
 	}
 

src/controllers/authentication.js

@@ -15,7 +15,6 @@ const user = require('../user');
 const plugins = require('../plugins');
 const utils = require('../utils');
 const slugify = require('../slugify');
-const translator = require('../translator');
 const helpers = require('./helpers');
 const privileges = require('../privileges');
 const sockets = require('../socket.io');
@@ -263,7 +262,7 @@ function continueLogin(strategy, req, res, next) {
 	passport.authenticate(strategy, async (err, userData, info) => {
 		if (err) {
 			plugins.hooks.fire('action:login.continue', { req, strategy, userData, error: err });
-			return helpers.noScriptErrors(req, res, err.message, 403);
+			return helpers.noScriptErrors(req, res, err.data || err.message, 403);
 		}
 
 		if (!userData) {
@@ -423,8 +422,7 @@ authenticationController.localLogin = async function (req, username, password, n
 		userData.isAdminOrGlobalMod = isAdminOrGlobalMod;
 
 		if (!canLoginIfBanned) {
-			const banMesage = await getBanInfo(uid);
-			return next(new Error(banMesage));
+			return next(await getBanError(uid));
 		}
 
 		// Doing this after the ban check, because user's privileges might change after a ban expires
@@ -483,19 +481,19 @@ authenticationController.logout = async function (req, res, next) {
 	}
 };
 
-async function getBanInfo(uid) {
+async function getBanError(uid) {
 	try {
 		const banInfo = await user.getLatestBanInfo(uid);
 
 		if (!banInfo.reason) {
-			banInfo.reason = await translator.translate('[[user:info.banned-no-reason]]');
+			banInfo.reason = '[[user:info.banned-no-reason]]';
 		}
-		return banInfo.banned_until ?
-			`[[error:user-banned-reason-until, ${banInfo.banned_until_readable}, ${banInfo.reason}]]` :
-			`[[error:user-banned-reason, ${banInfo.reason}]]`;
+		const err = new Error(banInfo.reason);
+		err.data = banInfo;
+		return err;
 	} catch (err) {
 		if (err.message === 'no-ban-info') {
-			return '[[error:user-banned]]';
+			return new Error('[[error:user-banned]]');
 		}
 		throw err;
 	}

src/controllers/helpers.js

@@ -11,6 +11,7 @@ const privileges = require('../privileges');
 const categories = require('../categories');
 const plugins = require('../plugins');
 const meta = require('../meta');
+const middlewareHelpers = require('../middleware/helpers');
 
 const helpers = module.exports;
 
@@ -19,7 +20,10 @@ const url = nconf.get('url');
 
 helpers.noScriptErrors = async function (req, res, error, httpStatus) {
 	if (req.body.noscript !== 'true') {
-		return res.status(httpStatus).send(error);
+		if (typeof error === 'string') {
+			return res.status(httpStatus).send(error);
+		}
+		return res.status(httpStatus).json(error);
 	}
 	const middleware = require('../middleware');
 	const httpStatusString = httpStatus.toString();
@@ -124,7 +128,17 @@ helpers.notAllowed = async function (req, res, error) {
 
 	if (req.loggedIn || req.uid === -1) {
 		if (res.locals.isAPI) {
-			helpers.formatApiResponse(403, res, error);
+			if (req.originalUrl.startsWith(`${relative_path}/api/v3`)) {
+				helpers.formatApiResponse(403, res, error);
+			} else {
+				res.status(403).json({
+					path: req.path.replace(/^\/api/, ''),
+					loggedIn: req.loggedIn,
+					error: error,
+					title: '[[global:403.title]]',
+					bodyClass: middlewareHelpers.buildBodyClass(req, res),
+				});
+			}
 		} else {
 			const middleware = require('../middleware');
 			await middleware.buildHeaderAsync(req, res);

src/database/mongo/connection.js

@@ -12,7 +12,7 @@ connection.getConnectionString = function (mongo) {
 	let usernamePassword = '';
 	const uri = mongo.uri || '';
 	if (mongo.username && mongo.password) {
-		usernamePassword = `${nconf.get('mongo:username')}:${encodeURIComponent(nconf.get('mongo:password'))}@`;
+		usernamePassword = `${mongo.username}:${encodeURIComponent(mongo.password)}@`;
 	} else if (!uri.includes('@') || !uri.slice(uri.indexOf('://') + 3, uri.indexOf('@'))) {
 		winston.warn('You have no mongo username/password setup!');
 	}

src/database/mongo/sorted/remove.js

@@ -57,7 +57,7 @@ module.exports = function (module) {
 			return;
 		}
 		const bulk = module.client.collection('objects').initializeUnorderedBulkOp();
-		data.forEach(item => bulk.find({ _key: item[0], value: String(item[1]) }).remove());
+		data.forEach(item => bulk.find({ _key: item[0], value: String(item[1]) }).delete());
 		await bulk.execute();
 	};
 };

test/authentication.js

@@ -487,7 +487,15 @@ describe('authentication', () => {
 				loginUser(bannedUser.username, bannedUser.pw, (err, res, body) => {
 					assert.ifError(err);
 					assert.equal(res.statusCode, 403);
-					assert.equal(body, '[[error:user-banned-reason, spammer]]');
+					delete body.timestamp;
+					assert.deepStrictEqual(body, {
+						banned_until: 0,
+						banned_until_readable: '',
+						expiry: 0,
+						expiry_readable: '',
+						reason: 'spammer',
+						uid: 6,
+					});
 					user.bans.unban(bannedUser.uid, (err) => {
 						assert.ifError(err);
 						const expiry = Date.now() + 10000;
@@ -496,7 +504,8 @@ describe('authentication', () => {
 							loginUser(bannedUser.username, bannedUser.pw, (err, res, body) => {
 								assert.ifError(err);
 								assert.equal(res.statusCode, 403);
-								assert.equal(body, `[[error:user-banned-reason-until, ${utils.toISOString(expiry)}, No reason given.]]`);
+								assert(body.banned_until);
+								assert(body.reason, '[[user:info.banned-no-reason]]');
 								done();
 							});
 						});