2014-07-26 06:24:27 +02:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2018-07-19 19:58:33 +02:00
// Copyright 2018 The Gitea Authors. All rights reserved.
2014-07-26 06:24:27 +02:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
package user
import (
2017-01-16 03:14:29 +01:00
"errors"
2016-03-11 17:56:52 +01:00
"fmt"
2017-02-25 15:57:06 +01:00
"net/http"
"strings"
2014-07-31 23:25:34 +02:00
2016-11-10 17:24:48 +01:00
"code.gitea.io/gitea/models"
"code.gitea.io/gitea/modules/auth"
2017-02-25 15:57:06 +01:00
"code.gitea.io/gitea/modules/auth/oauth2"
2016-11-10 17:24:48 +01:00
"code.gitea.io/gitea/modules/base"
"code.gitea.io/gitea/modules/context"
2020-05-07 23:49:00 +02:00
"code.gitea.io/gitea/modules/eventsource"
2020-10-03 05:37:53 +02:00
"code.gitea.io/gitea/modules/hcaptcha"
2016-11-10 17:24:48 +01:00
"code.gitea.io/gitea/modules/log"
2019-10-14 17:24:26 +02:00
"code.gitea.io/gitea/modules/password"
2018-07-05 06:13:05 +02:00
"code.gitea.io/gitea/modules/recaptcha"
2016-11-10 17:24:48 +01:00
"code.gitea.io/gitea/modules/setting"
2019-08-15 16:46:21 +02:00
"code.gitea.io/gitea/modules/timeutil"
2020-08-11 22:05:34 +02:00
"code.gitea.io/gitea/routers/utils"
2019-10-14 08:10:42 +02:00
"code.gitea.io/gitea/services/externalaccount"
2019-09-24 07:02:49 +02:00
"code.gitea.io/gitea/services/mailer"
2017-02-25 15:57:06 +01:00
2019-08-23 18:40:30 +02:00
"gitea.com/macaron/captcha"
2017-02-22 08:14:37 +01:00
"github.com/markbates/goth"
2018-05-19 16:12:37 +02:00
"github.com/tstranex/u2f"
2014-07-26 06:24:27 +02:00
)
const (
2018-09-13 14:04:25 +02:00
// tplMustChangePassword template for updating a user's password
tplMustChangePassword = "user/auth/change_passwd"
2016-11-18 04:03:03 +01:00
// tplSignIn template for sign in page
tplSignIn base . TplName = "user/auth/signin"
// tplSignUp template path for sign up page
tplSignUp base . TplName = "user/auth/signup"
// TplActivate template path for activate user
TplActivate base . TplName = "user/auth/activate"
tplForgotPassword base . TplName = "user/auth/forgot_passwd"
tplResetPassword base . TplName = "user/auth/reset_passwd"
2017-01-16 03:14:29 +01:00
tplTwofa base . TplName = "user/auth/twofa"
tplTwofaScratch base . TplName = "user/auth/twofa_scratch"
2017-02-22 08:14:37 +01:00
tplLinkAccount base . TplName = "user/auth/link_account"
2018-05-19 16:12:37 +02:00
tplU2F base . TplName = "user/auth/u2f"
2014-07-26 06:24:27 +02:00
)
2016-03-11 17:56:52 +01:00
// AutoSignIn reads cookie and try to auto-login.
func AutoSignIn ( ctx * context . Context ) ( bool , error ) {
if ! models . HasEngine {
return false , nil
}
uname := ctx . GetCookie ( setting . CookieUserName )
if len ( uname ) == 0 {
return false , nil
}
isSucceed := false
defer func ( ) {
if ! isSucceed {
log . Trace ( "auto-login cookie cleared: %s" , uname )
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( setting . CookieUserName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
ctx . SetCookie ( setting . CookieRememberName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2016-03-11 17:56:52 +01:00
}
} ( )
u , err := models . GetUserByName ( uname )
if err != nil {
if ! models . IsErrUserNotExist ( err ) {
return false , fmt . Errorf ( "GetUserByName: %v" , err )
}
return false , nil
}
2019-07-06 17:47:09 +02:00
if val , ok := ctx . GetSuperSecureCookie (
base . EncodeMD5 ( u . Rands + u . Passwd ) , setting . CookieRememberName ) ; ! ok || val != u . Name {
2016-03-11 17:56:52 +01:00
return false , nil
}
isSucceed = true
2020-05-17 14:43:29 +02:00
// Set session IDs
if err := ctx . Session . Set ( "uid" , u . ID ) ; err != nil {
2019-06-12 21:41:28 +02:00
return false , err
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uname" , u . Name ) ; err != nil {
return false , err
}
if err := ctx . Session . Release ( ) ; err != nil {
2019-06-12 21:41:28 +02:00
return false , err
}
2020-05-17 14:43:29 +02:00
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( setting . CSRFCookieName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2016-03-11 17:56:52 +01:00
return true , nil
}
2017-01-16 03:14:29 +01:00
func checkAutoLogin ( ctx * context . Context ) bool {
2014-07-26 06:24:27 +02:00
// Check auto-login.
2016-03-11 17:56:52 +01:00
isSucceed , err := AutoSignIn ( ctx )
2014-07-26 06:24:27 +02:00
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "AutoSignIn" , err )
2017-01-16 03:14:29 +01:00
return true
2014-07-26 06:24:27 +02:00
}
2016-08-28 00:07:02 +02:00
redirectTo := ctx . Query ( "redirect_to" )
if len ( redirectTo ) > 0 {
2018-08-14 22:16:37 +02:00
ctx . SetCookie ( "redirect_to" , redirectTo , 0 , setting . AppSubURL , "" , setting . SessionConfig . Secure , true )
2016-08-28 00:07:02 +02:00
} else {
2019-03-21 03:06:16 +01:00
redirectTo = ctx . GetCookie ( "redirect_to" )
2016-08-28 00:07:02 +02:00
}
2015-08-13 20:43:40 +02:00
if isSucceed {
2018-08-14 22:16:37 +02:00
ctx . SetCookie ( "redirect_to" , "" , - 1 , setting . AppSubURL , "" , setting . SessionConfig . Secure , true )
2018-03-15 22:13:34 +01:00
ctx . RedirectToFirst ( redirectTo , setting . AppSubURL + string ( setting . LandingPageURL ) )
2017-01-16 03:14:29 +01:00
return true
}
return false
}
// SignIn render sign in page
func SignIn ( ctx * context . Context ) {
2017-05-01 15:26:53 +02:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
2017-01-16 03:14:29 +01:00
// Check auto-login.
if checkAutoLogin ( ctx ) {
2014-07-26 06:24:27 +02:00
return
}
2017-05-01 15:26:53 +02:00
orderedOAuth2Names , oauth2Providers , err := models . GetActiveOAuth2Providers ( )
2017-02-22 08:14:37 +01:00
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-02-22 08:14:37 +01:00
return
}
2017-05-01 15:26:53 +02:00
ctx . Data [ "OrderedOAuth2Names" ] = orderedOAuth2Names
2017-02-22 08:14:37 +01:00
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
2017-03-17 15:16:08 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
2017-03-07 11:47:56 +01:00
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/login"
2017-03-17 15:16:08 +01:00
ctx . Data [ "PageIsSignIn" ] = true
ctx . Data [ "PageIsLogin" ] = true
2019-11-23 00:33:31 +01:00
ctx . Data [ "EnableSSPI" ] = models . IsSSPIEnabled ( )
2017-02-22 08:14:37 +01:00
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplSignIn )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// SignInPost response for sign in request
2016-03-11 17:56:52 +01:00
func SignInPost ( ctx * context . Context , form auth . SignInForm ) {
2017-05-01 15:26:53 +02:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
orderedOAuth2Names , oauth2Providers , err := models . GetActiveOAuth2Providers ( )
2017-02-22 08:14:37 +01:00
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-02-22 08:14:37 +01:00
return
}
2017-05-01 15:26:53 +02:00
ctx . Data [ "OrderedOAuth2Names" ] = orderedOAuth2Names
2017-02-22 08:14:37 +01:00
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
2017-03-07 11:47:56 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/login"
ctx . Data [ "PageIsSignIn" ] = true
ctx . Data [ "PageIsLogin" ] = true
2019-11-23 00:33:31 +01:00
ctx . Data [ "EnableSSPI" ] = models . IsSSPIEnabled ( )
2017-02-22 08:14:37 +01:00
2014-07-26 06:24:27 +02:00
if ctx . HasError ( ) {
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplSignIn )
2014-07-26 06:24:27 +02:00
return
}
u , err := models . UserSignIn ( form . UserName , form . Password )
if err != nil {
2015-08-05 05:14:17 +02:00
if models . IsErrUserNotExist ( err ) {
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "form.username_password_incorrect" ) , tplSignIn , & form )
2020-12-09 16:37:15 +01:00
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
2017-02-25 15:57:06 +01:00
} else if models . IsErrEmailAlreadyUsed ( err ) {
ctx . RenderWithErr ( ctx . Tr ( "form.email_been_used" ) , tplSignIn , & form )
2020-12-09 16:37:15 +01:00
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
2019-02-19 08:19:28 +01:00
} else if models . IsErrUserProhibitLogin ( err ) {
2020-12-09 16:37:15 +01:00
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
2019-02-19 08:19:28 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( 200 , "user/auth/prohibit_login" )
} else if models . IsErrUserInactive ( err ) {
if setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
ctx . HTML ( 200 , TplActivate )
} else {
2020-12-09 16:37:15 +01:00
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
2019-02-19 08:19:28 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( 200 , "user/auth/prohibit_login" )
}
2014-08-10 06:02:00 +02:00
} else {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2014-07-26 06:24:27 +02:00
}
return
}
2017-01-16 03:14:29 +01:00
// If this user is enrolled in 2FA, we can't sign the user in just yet.
// Instead, redirect them to the 2FA authentication page.
_ , err = models . GetTwoFactorByUID ( u . ID )
if err != nil {
if models . IsErrTwoFactorNotEnrolled ( err ) {
handleSignIn ( ctx , u , form . Remember )
} else {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
}
return
}
// User needs to use 2FA, save data and redirect to 2FA page.
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaUid" , u . ID ) ; err != nil {
ctx . ServerError ( "UserSignIn: Unable to set twofaUid in session" , err )
2019-06-12 21:41:28 +02:00
return
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaRemember" , form . Remember ) ; err != nil {
ctx . ServerError ( "UserSignIn: Unable to set twofaRemember in session" , err )
return
}
if err := ctx . Session . Release ( ) ; err != nil {
ctx . ServerError ( "UserSignIn: Unable to save session" , err )
2019-06-12 21:41:28 +02:00
return
}
2018-05-19 16:12:37 +02:00
regs , err := models . GetU2FRegistrationsByUID ( u . ID )
if err == nil && len ( regs ) > 0 {
ctx . Redirect ( setting . AppSubURL + "/user/u2f" )
return
}
2017-01-16 03:14:29 +01:00
ctx . Redirect ( setting . AppSubURL + "/user/two_factor" )
}
// TwoFactor shows the user a two-factor authentication page.
func TwoFactor ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "twofa" )
// Check auto-login.
if checkAutoLogin ( ctx ) {
return
}
// Ensure user is in a 2FA session.
if ctx . Session . Get ( "twofaUid" ) == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in 2FA session" ) )
2017-01-16 03:14:29 +01:00
return
}
ctx . HTML ( 200 , tplTwofa )
}
// TwoFactorPost validates a user's two-factor authentication token.
func TwoFactorPost ( ctx * context . Context , form auth . TwoFactorAuthForm ) {
ctx . Data [ "Title" ] = ctx . Tr ( "twofa" )
// Ensure user is in a 2FA session.
idSess := ctx . Session . Get ( "twofaUid" )
if idSess == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in 2FA session" ) )
2017-01-16 03:14:29 +01:00
return
}
id := idSess . ( int64 )
twofa , err := models . GetTwoFactorByUID ( id )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
// Validate the passcode with the stored TOTP secret.
ok , err := twofa . ValidateTOTP ( form . Passcode )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
2018-05-02 17:02:02 +02:00
if ok && twofa . LastUsedPasscode != form . Passcode {
2017-01-16 03:14:29 +01:00
remember := ctx . Session . Get ( "twofaRemember" ) . ( bool )
u , err := models . GetUserByID ( id )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
2017-02-27 11:10:26 +01:00
if ctx . Session . Get ( "linkAccount" ) != nil {
gothUser := ctx . Session . Get ( "linkAccountGothUser" )
if gothUser == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in LinkAccount session" ) )
2017-02-27 11:10:26 +01:00
return
}
2019-10-14 08:10:42 +02:00
err = externalaccount . LinkAccountToUser ( u , gothUser . ( goth . User ) )
2017-02-27 11:10:26 +01:00
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-02-27 11:10:26 +01:00
return
}
}
2018-05-02 17:02:02 +02:00
twofa . LastUsedPasscode = form . Passcode
if err = models . UpdateTwoFactor ( twofa ) ; err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
2017-01-16 03:14:29 +01:00
handleSignIn ( ctx , u , remember )
return
}
ctx . RenderWithErr ( ctx . Tr ( "auth.twofa_passcode_incorrect" ) , tplTwofa , auth . TwoFactorAuthForm { } )
}
// TwoFactorScratch shows the scratch code form for two-factor authentication.
func TwoFactorScratch ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "twofa_scratch" )
// Check auto-login.
if checkAutoLogin ( ctx ) {
return
}
// Ensure user is in a 2FA session.
if ctx . Session . Get ( "twofaUid" ) == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in 2FA session" ) )
2017-01-16 03:14:29 +01:00
return
}
ctx . HTML ( 200 , tplTwofaScratch )
}
// TwoFactorScratchPost validates and invalidates a user's two-factor scratch token.
func TwoFactorScratchPost ( ctx * context . Context , form auth . TwoFactorScratchAuthForm ) {
ctx . Data [ "Title" ] = ctx . Tr ( "twofa_scratch" )
// Ensure user is in a 2FA session.
idSess := ctx . Session . Get ( "twofaUid" )
if idSess == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in 2FA session" ) )
2017-01-16 03:14:29 +01:00
return
}
id := idSess . ( int64 )
twofa , err := models . GetTwoFactorByUID ( id )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
// Validate the passcode with the stored TOTP secret.
if twofa . VerifyScratchToken ( form . Token ) {
// Invalidate the scratch token.
2018-07-27 14:54:50 +02:00
_ , err = twofa . GenerateScratchToken ( )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
2017-01-16 03:14:29 +01:00
if err = models . UpdateTwoFactor ( twofa ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
remember := ctx . Session . Get ( "twofaRemember" ) . ( bool )
u , err := models . GetUserByID ( id )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-01-16 03:14:29 +01:00
return
}
handleSignInFull ( ctx , u , remember , false )
ctx . Flash . Info ( ctx . Tr ( "auth.twofa_scratch_used" ) )
2018-07-19 19:58:33 +02:00
ctx . Redirect ( setting . AppSubURL + "/user/settings/security" )
2017-01-16 03:14:29 +01:00
return
}
ctx . RenderWithErr ( ctx . Tr ( "auth.twofa_scratch_token_incorrect" ) , tplTwofaScratch , auth . TwoFactorScratchAuthForm { } )
}
2018-05-19 16:12:37 +02:00
// U2F shows the U2F login page
func U2F ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "twofa" )
ctx . Data [ "RequireU2F" ] = true
// Check auto-login.
if checkAutoLogin ( ctx ) {
return
}
// Ensure user is in a 2FA session.
if ctx . Session . Get ( "twofaUid" ) == nil {
ctx . ServerError ( "UserSignIn" , errors . New ( "not in U2F session" ) )
return
}
ctx . HTML ( 200 , tplU2F )
}
// U2FChallenge submits a sign challenge to the browser
func U2FChallenge ( ctx * context . Context ) {
// Ensure user is in a U2F session.
idSess := ctx . Session . Get ( "twofaUid" )
if idSess == nil {
ctx . ServerError ( "UserSignIn" , errors . New ( "not in U2F session" ) )
return
}
id := idSess . ( int64 )
regs , err := models . GetU2FRegistrationsByUID ( id )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
if len ( regs ) == 0 {
ctx . ServerError ( "UserSignIn" , errors . New ( "no device registered" ) )
return
}
challenge , err := u2f . NewChallenge ( setting . U2F . AppID , setting . U2F . TrustedFacets )
2019-06-12 21:41:28 +02:00
if err != nil {
ctx . ServerError ( "u2f.NewChallenge" , err )
return
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "u2fChallenge" , challenge ) ; err != nil {
ctx . ServerError ( "UserSignIn: unable to set u2fChallenge in session" , err )
2018-05-19 16:12:37 +02:00
return
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Release ( ) ; err != nil {
ctx . ServerError ( "UserSignIn: unable to store session" , err )
}
2018-05-19 16:12:37 +02:00
ctx . JSON ( 200 , challenge . SignRequest ( regs . ToRegistrations ( ) ) )
}
// U2FSign authenticates the user by signResp
func U2FSign ( ctx * context . Context , signResp u2f . SignResponse ) {
challSess := ctx . Session . Get ( "u2fChallenge" )
idSess := ctx . Session . Get ( "twofaUid" )
if challSess == nil || idSess == nil {
ctx . ServerError ( "UserSignIn" , errors . New ( "not in U2F session" ) )
return
}
challenge := challSess . ( * u2f . Challenge )
id := idSess . ( int64 )
regs , err := models . GetU2FRegistrationsByUID ( id )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
for _ , reg := range regs {
r , err := reg . Parse ( )
if err != nil {
2019-04-02 09:48:31 +02:00
log . Fatal ( "parsing u2f registration: %v" , err )
2018-05-19 16:12:37 +02:00
continue
}
newCounter , authErr := r . Authenticate ( signResp , * challenge , reg . Counter )
if authErr == nil {
reg . Counter = newCounter
user , err := models . GetUserByID ( id )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
remember := ctx . Session . Get ( "twofaRemember" ) . ( bool )
if err := reg . UpdateCounter ( ) ; err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
if ctx . Session . Get ( "linkAccount" ) != nil {
gothUser := ctx . Session . Get ( "linkAccountGothUser" )
if gothUser == nil {
ctx . ServerError ( "UserSignIn" , errors . New ( "not in LinkAccount session" ) )
return
}
2019-10-14 08:10:42 +02:00
err = externalaccount . LinkAccountToUser ( user , gothUser . ( goth . User ) )
2018-05-19 16:12:37 +02:00
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
}
redirect := handleSignInFull ( ctx , user , remember , false )
if redirect == "" {
redirect = setting . AppSubURL + "/"
}
ctx . PlainText ( 200 , [ ] byte ( redirect ) )
return
}
}
ctx . Error ( 401 )
}
2017-01-16 03:14:29 +01:00
// This handles the final part of the sign-in process of the user.
func handleSignIn ( ctx * context . Context , u * models . User , remember bool ) {
handleSignInFull ( ctx , u , remember , true )
}
2018-05-19 16:12:37 +02:00
func handleSignInFull ( ctx * context . Context , u * models . User , remember bool , obeyRedirect bool ) string {
2017-01-16 03:14:29 +01:00
if remember {
2014-07-26 06:24:27 +02:00
days := 86400 * setting . LogInRememberDays
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( setting . CookieUserName , u . Name , days , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2017-02-25 15:57:06 +01:00
ctx . SetSuperSecureCookie ( base . EncodeMD5 ( u . Rands + u . Passwd ) ,
2019-07-12 15:57:31 +02:00
setting . CookieRememberName , u . Name , days , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2014-07-26 06:24:27 +02:00
}
2019-06-12 21:41:28 +02:00
_ = ctx . Session . Delete ( "openid_verified_uri" )
_ = ctx . Session . Delete ( "openid_signin_remember" )
_ = ctx . Session . Delete ( "openid_determined_email" )
_ = ctx . Session . Delete ( "openid_determined_username" )
_ = ctx . Session . Delete ( "twofaUid" )
_ = ctx . Session . Delete ( "twofaRemember" )
_ = ctx . Session . Delete ( "u2fChallenge" )
_ = ctx . Session . Delete ( "linkAccount" )
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uid" , u . ID ) ; err != nil {
log . Error ( "Error setting uid %d in session: %v" , u . ID , err )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uname" , u . Name ) ; err != nil {
log . Error ( "Error setting uname %s session: %v" , u . Name , err )
}
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Unable to store session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2016-03-13 02:56:03 +01:00
2018-05-05 02:28:30 +02:00
// Language setting of the user overwrites the one previously set
// If the user does not have a locale set, we save the current one.
if len ( u . Language ) == 0 {
u . Language = ctx . Locale . Language ( )
if err := models . UpdateUserCols ( u , "language" ) ; err != nil {
2019-04-02 09:48:31 +02:00
log . Error ( fmt . Sprintf ( "Error updating user language [user: %d, locale: %s]" , u . ID , u . Language ) )
2018-05-19 16:12:37 +02:00
return setting . AppSubURL + "/"
2018-05-05 02:28:30 +02:00
}
}
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( "lang" , u . Language , nil , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2018-05-05 02:28:30 +02:00
2016-03-13 02:56:03 +01:00
// Clear whatever CSRF has right now, force to generate a new one
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( setting . CSRFCookieName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2016-03-13 02:56:03 +01:00
2016-11-09 11:53:45 +01:00
// Register last login
u . SetLastLogin ( )
2017-08-12 16:18:44 +02:00
if err := models . UpdateUserCols ( u , "last_login_unix" ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UpdateUserCols" , err )
2018-05-19 16:12:37 +02:00
return setting . AppSubURL + "/"
2016-11-09 11:53:45 +01:00
}
2020-08-11 22:05:34 +02:00
if redirectTo := ctx . GetCookie ( "redirect_to" ) ; len ( redirectTo ) > 0 && ! utils . IsExternalURL ( redirectTo ) {
2018-08-14 22:16:37 +02:00
ctx . SetCookie ( "redirect_to" , "" , - 1 , setting . AppSubURL , "" , setting . SessionConfig . Secure , true )
2017-01-16 03:14:29 +01:00
if obeyRedirect {
2018-03-15 22:13:34 +01:00
ctx . RedirectToFirst ( redirectTo )
2017-01-16 03:14:29 +01:00
}
2018-05-19 16:12:37 +02:00
return redirectTo
2014-07-26 06:24:27 +02:00
}
2017-01-16 03:14:29 +01:00
if obeyRedirect {
ctx . Redirect ( setting . AppSubURL + "/" )
}
2018-05-19 16:12:37 +02:00
return setting . AppSubURL + "/"
2014-07-26 06:24:27 +02:00
}
2017-02-22 08:14:37 +01:00
// SignInOAuth handles the OAuth2 login buttons
func SignInOAuth ( ctx * context . Context ) {
provider := ctx . Params ( ":provider" )
loginSource , err := models . GetActiveOAuth2LoginSourceByName ( provider )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "SignIn" , err )
2017-02-22 08:14:37 +01:00
return
}
// try to do a direct callback flow, so we don't authenticate the user again but use the valid accesstoken to get the user
user , gothUser , err := oAuth2UserLoginCallback ( loginSource , ctx . Req . Request , ctx . Resp )
if err == nil && user != nil {
// we got the user without going through the whole OAuth2 authentication flow again
handleOAuth2SignIn ( user , gothUser , ctx , err )
return
}
err = oauth2 . Auth ( loginSource . Name , ctx . Req . Request , ctx . Resp )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "SignIn" , err )
2017-02-22 08:14:37 +01:00
}
// redirect is done in oauth2.Auth
}
// SignInOAuthCallback handles the callback from the given provider
func SignInOAuthCallback ( ctx * context . Context ) {
provider := ctx . Params ( ":provider" )
// first look if the provider is still active
loginSource , err := models . GetActiveOAuth2LoginSourceByName ( provider )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "SignIn" , err )
2017-02-22 08:14:37 +01:00
return
}
if loginSource == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "SignIn" , errors . New ( "No valid provider found, check configured callback url in provider" ) )
2017-02-22 08:14:37 +01:00
return
}
u , gothUser , err := oAuth2UserLoginCallback ( loginSource , ctx . Req . Request , ctx . Resp )
handleOAuth2SignIn ( u , gothUser , ctx , err )
}
func handleOAuth2SignIn ( u * models . User , gothUser goth . User , ctx * context . Context , err error ) {
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , err )
2017-02-22 08:14:37 +01:00
return
}
if u == nil {
// no existing user is found, request attach or new account
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "linkAccountGothUser" , gothUser ) ; err != nil {
log . Error ( "Error setting linkAccountGothUser in session: %v" , err )
}
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Error storing session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2017-02-22 08:14:37 +01:00
ctx . Redirect ( setting . AppSubURL + "/user/link_account" )
return
}
// If this user is enrolled in 2FA, we can't sign the user in just yet.
// Instead, redirect them to the 2FA authentication page.
_ , err = models . GetTwoFactorByUID ( u . ID )
if err != nil {
2019-10-14 08:10:42 +02:00
if ! models . IsErrTwoFactorNotEnrolled ( err ) {
ctx . ServerError ( "UserSignIn" , err )
return
}
2017-02-22 08:14:37 +01:00
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uid" , u . ID ) ; err != nil {
log . Error ( "Error setting uid in session: %v" , err )
2019-10-14 08:10:42 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uname" , u . Name ) ; err != nil {
log . Error ( "Error setting uname in session: %v" , err )
}
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Error storing session: %v" , err )
2019-10-14 08:10:42 +02:00
}
2017-02-22 08:14:37 +01:00
2019-10-14 08:10:42 +02:00
// Clear whatever CSRF has right now, force to generate a new one
ctx . SetCookie ( setting . CSRFCookieName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
2017-02-22 08:14:37 +01:00
2019-10-14 08:10:42 +02:00
// Register last login
u . SetLastLogin ( )
if err := models . UpdateUserCols ( u , "last_login_unix" ) ; err != nil {
ctx . ServerError ( "UpdateUserCols" , err )
return
}
2017-02-22 08:14:37 +01:00
2019-10-14 08:10:42 +02:00
// update external user information
if err := models . UpdateExternalUser ( u , gothUser ) ; err != nil {
log . Error ( "UpdateExternalUser failed: %v" , err )
}
if redirectTo := ctx . GetCookie ( "redirect_to" ) ; len ( redirectTo ) > 0 {
ctx . SetCookie ( "redirect_to" , "" , - 1 , setting . AppSubURL , "" , setting . SessionConfig . Secure , true )
ctx . RedirectToFirst ( redirectTo )
return
2017-02-22 08:14:37 +01:00
}
2019-10-14 08:10:42 +02:00
ctx . Redirect ( setting . AppSubURL + "/" )
2017-02-22 08:14:37 +01:00
return
}
// User needs to use 2FA, save data and redirect to 2FA page.
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaUid" , u . ID ) ; err != nil {
log . Error ( "Error setting twofaUid in session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaRemember" , false ) ; err != nil {
log . Error ( "Error setting twofaRemember in session: %v" , err )
}
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Error storing session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2018-05-19 16:12:37 +02:00
// If U2F is enrolled -> Redirect to U2F instead
regs , err := models . GetU2FRegistrationsByUID ( u . ID )
if err == nil && len ( regs ) > 0 {
ctx . Redirect ( setting . AppSubURL + "/user/u2f" )
return
}
2017-02-22 08:14:37 +01:00
ctx . Redirect ( setting . AppSubURL + "/user/two_factor" )
}
// OAuth2UserLoginCallback attempts to handle the callback from the OAuth2 provider and if successful
// login the user
func oAuth2UserLoginCallback ( loginSource * models . LoginSource , request * http . Request , response http . ResponseWriter ) ( * models . User , goth . User , error ) {
gothUser , err := oauth2 . ProviderCallback ( loginSource . Name , request , response )
if err != nil {
2020-04-23 00:47:23 +02:00
if err . Error ( ) == "securecookie: the value is too long" {
log . Error ( "OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider" , loginSource . Name , setting . OAuth2 . MaxTokenLength )
err = fmt . Errorf ( "OAuth2 Provider %s returned too long a token. Current max: %d. Either increase the [OAuth2] MAX_TOKEN_LENGTH or reduce the information returned from the OAuth2 provider" , loginSource . Name , setting . OAuth2 . MaxTokenLength )
}
2017-02-22 08:14:37 +01:00
return nil , goth . User { } , err
}
user := & models . User {
LoginName : gothUser . UserID ,
LoginType : models . LoginOAuth2 ,
LoginSource : loginSource . ID ,
}
hasUser , err := models . GetUser ( user )
if err != nil {
return nil , goth . User { } , err
}
if hasUser {
2019-10-14 08:10:42 +02:00
return user , gothUser , nil
2017-02-22 08:14:37 +01:00
}
// search in external linked users
externalLoginUser := & models . ExternalLoginUser {
ExternalID : gothUser . UserID ,
LoginSourceID : loginSource . ID ,
}
hasUser , err = models . GetExternalLogin ( externalLoginUser )
if err != nil {
return nil , goth . User { } , err
}
if hasUser {
user , err = models . GetUserByID ( externalLoginUser . UserID )
2019-10-14 08:10:42 +02:00
return user , gothUser , err
2017-02-22 08:14:37 +01:00
}
// no user found to login
return nil , gothUser , nil
}
// LinkAccount shows the page where the user can decide to login or create a new account
func LinkAccount ( ctx * context . Context ) {
2019-11-09 10:42:34 +01:00
ctx . Data [ "DisablePassword" ] = ! setting . Service . RequireExternalRegistrationPassword || setting . Service . AllowOnlyExternalRegistration
2017-02-22 08:14:37 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "link_account" )
ctx . Data [ "LinkAccountMode" ] = true
2019-07-06 21:48:02 +02:00
ctx . Data [ "EnableCaptcha" ] = setting . Service . EnableCaptcha && setting . Service . RequireExternalRegistrationCaptcha
2018-07-05 06:13:05 +02:00
ctx . Data [ "CaptchaType" ] = setting . Service . CaptchaType
2019-05-02 15:09:39 +02:00
ctx . Data [ "RecaptchaURL" ] = setting . Service . RecaptchaURL
2018-07-05 06:13:05 +02:00
ctx . Data [ "RecaptchaSitekey" ] = setting . Service . RecaptchaSitekey
2017-02-22 08:14:37 +01:00
ctx . Data [ "DisableRegistration" ] = setting . Service . DisableRegistration
ctx . Data [ "ShowRegistrationButton" ] = false
// use this to set the right link into the signIn and signUp templates in the link_account template
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/link_account_signin"
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/link_account_signup"
gothUser := ctx . Session . Get ( "linkAccountGothUser" )
if gothUser == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in LinkAccount session" ) )
2017-02-22 08:14:37 +01:00
return
}
2018-10-28 23:46:16 +01:00
uname := gothUser . ( goth . User ) . NickName
email := gothUser . ( goth . User ) . Email
ctx . Data [ "user_name" ] = uname
ctx . Data [ "email" ] = email
if len ( email ) != 0 {
u , err := models . GetUserByEmail ( email )
if err != nil && ! models . IsErrUserNotExist ( err ) {
ctx . ServerError ( "UserSignIn" , err )
return
}
if u != nil {
ctx . Data [ "user_exists" ] = true
}
} else if len ( uname ) != 0 {
u , err := models . GetUserByName ( uname )
if err != nil && ! models . IsErrUserNotExist ( err ) {
ctx . ServerError ( "UserSignIn" , err )
return
}
if u != nil {
ctx . Data [ "user_exists" ] = true
}
}
2017-02-22 08:14:37 +01:00
ctx . HTML ( 200 , tplLinkAccount )
}
// LinkAccountPostSignIn handle the coupling of external account with another account using signIn
func LinkAccountPostSignIn ( ctx * context . Context , signInForm auth . SignInForm ) {
2019-11-09 10:42:34 +01:00
ctx . Data [ "DisablePassword" ] = ! setting . Service . RequireExternalRegistrationPassword || setting . Service . AllowOnlyExternalRegistration
2017-02-22 08:14:37 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "link_account" )
ctx . Data [ "LinkAccountMode" ] = true
ctx . Data [ "LinkAccountModeSignIn" ] = true
2019-07-06 21:48:02 +02:00
ctx . Data [ "EnableCaptcha" ] = setting . Service . EnableCaptcha && setting . Service . RequireExternalRegistrationCaptcha
2019-05-02 15:09:39 +02:00
ctx . Data [ "RecaptchaURL" ] = setting . Service . RecaptchaURL
2018-07-05 06:13:05 +02:00
ctx . Data [ "CaptchaType" ] = setting . Service . CaptchaType
ctx . Data [ "RecaptchaSitekey" ] = setting . Service . RecaptchaSitekey
2017-02-22 08:14:37 +01:00
ctx . Data [ "DisableRegistration" ] = setting . Service . DisableRegistration
ctx . Data [ "ShowRegistrationButton" ] = false
// use this to set the right link into the signIn and signUp templates in the link_account template
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/link_account_signin"
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/link_account_signup"
gothUser := ctx . Session . Get ( "linkAccountGothUser" )
if gothUser == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignIn" , errors . New ( "not in LinkAccount session" ) )
2017-02-22 08:14:37 +01:00
return
}
if ctx . HasError ( ) {
ctx . HTML ( 200 , tplLinkAccount )
return
}
u , err := models . UserSignIn ( signInForm . UserName , signInForm . Password )
if err != nil {
if models . IsErrUserNotExist ( err ) {
2019-11-24 21:17:53 +01:00
ctx . Data [ "user_exists" ] = true
2017-02-22 08:14:37 +01:00
ctx . RenderWithErr ( ctx . Tr ( "form.username_password_incorrect" ) , tplLinkAccount , & signInForm )
} else {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserLinkAccount" , err )
2017-02-22 08:14:37 +01:00
}
return
}
// If this user is enrolled in 2FA, we can't sign the user in just yet.
// Instead, redirect them to the 2FA authentication page.
_ , err = models . GetTwoFactorByUID ( u . ID )
if err != nil {
2019-10-14 08:10:42 +02:00
if ! models . IsErrTwoFactorNotEnrolled ( err ) {
ctx . ServerError ( "UserLinkAccount" , err )
return
}
err = externalaccount . LinkAccountToUser ( u , gothUser . ( goth . User ) )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserLinkAccount" , err )
2019-10-14 08:10:42 +02:00
return
2017-02-22 08:14:37 +01:00
}
2019-10-14 08:10:42 +02:00
handleSignIn ( ctx , u , signInForm . Remember )
2017-02-22 08:14:37 +01:00
return
}
// User needs to use 2FA, save data and redirect to 2FA page.
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaUid" , u . ID ) ; err != nil {
log . Error ( "Error setting twofaUid in session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "twofaRemember" , signInForm . Remember ) ; err != nil {
log . Error ( "Error setting twofaRemember in session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "linkAccount" , true ) ; err != nil {
log . Error ( "Error setting linkAccount in session: %v" , err )
}
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Error storing session: %v" , err )
2019-06-12 21:41:28 +02:00
}
2017-02-22 08:14:37 +01:00
2018-05-19 16:12:37 +02:00
// If U2F is enrolled -> Redirect to U2F instead
regs , err := models . GetU2FRegistrationsByUID ( u . ID )
if err == nil && len ( regs ) > 0 {
ctx . Redirect ( setting . AppSubURL + "/user/u2f" )
return
}
2017-02-22 08:14:37 +01:00
ctx . Redirect ( setting . AppSubURL + "/user/two_factor" )
}
// LinkAccountPostRegister handle the creation of a new account for an external account using signUp
func LinkAccountPostRegister ( ctx * context . Context , cpt * captcha . Captcha , form auth . RegisterForm ) {
2019-07-06 21:48:02 +02:00
// TODO Make insecure passwords optional for local accounts also,
// once email-based Second-Factor Auth is available
2019-11-09 10:42:34 +01:00
ctx . Data [ "DisablePassword" ] = ! setting . Service . RequireExternalRegistrationPassword || setting . Service . AllowOnlyExternalRegistration
2017-02-22 08:14:37 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "link_account" )
ctx . Data [ "LinkAccountMode" ] = true
ctx . Data [ "LinkAccountModeRegister" ] = true
2019-07-06 21:48:02 +02:00
ctx . Data [ "EnableCaptcha" ] = setting . Service . EnableCaptcha && setting . Service . RequireExternalRegistrationCaptcha
2019-05-02 15:09:39 +02:00
ctx . Data [ "RecaptchaURL" ] = setting . Service . RecaptchaURL
2018-07-05 06:13:05 +02:00
ctx . Data [ "CaptchaType" ] = setting . Service . CaptchaType
ctx . Data [ "RecaptchaSitekey" ] = setting . Service . RecaptchaSitekey
2017-02-22 08:14:37 +01:00
ctx . Data [ "DisableRegistration" ] = setting . Service . DisableRegistration
ctx . Data [ "ShowRegistrationButton" ] = false
// use this to set the right link into the signIn and signUp templates in the link_account template
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/link_account_signin"
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/link_account_signup"
gothUser := ctx . Session . Get ( "linkAccountGothUser" )
if gothUser == nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UserSignUp" , errors . New ( "not in LinkAccount session" ) )
2017-02-22 08:14:37 +01:00
return
}
if ctx . HasError ( ) {
ctx . HTML ( 200 , tplLinkAccount )
return
}
if setting . Service . DisableRegistration {
ctx . Error ( 403 )
return
}
2019-07-06 21:48:02 +02:00
if setting . Service . EnableCaptcha && setting . Service . RequireExternalRegistrationCaptcha {
var valid bool
2020-10-03 05:37:53 +02:00
var err error
2019-07-06 21:48:02 +02:00
switch setting . Service . CaptchaType {
case setting . ImageCaptcha :
valid = cpt . VerifyReq ( ctx . Req )
case setting . ReCaptcha :
2020-10-03 05:37:53 +02:00
valid , err = recaptcha . Verify ( ctx . Req . Context ( ) , form . GRecaptchaResponse )
case setting . HCaptcha :
valid , err = hcaptcha . Verify ( ctx . Req . Context ( ) , form . HcaptchaResponse )
2019-07-06 21:48:02 +02:00
default :
ctx . ServerError ( "Unknown Captcha Type" , fmt . Errorf ( "Unknown Captcha Type: %s" , setting . Service . CaptchaType ) )
return
}
2020-10-03 05:37:53 +02:00
if err != nil {
log . Debug ( "%s" , err . Error ( ) )
}
2017-02-22 08:14:37 +01:00
2018-07-05 06:13:05 +02:00
if ! valid {
ctx . Data [ "Err_Captcha" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.captcha_incorrect" ) , tplLinkAccount , & form )
return
}
}
2019-07-06 21:48:02 +02:00
if setting . Service . AllowOnlyExternalRegistration || ! setting . Service . RequireExternalRegistrationPassword {
// In models.User an empty password is classed as not set, so we set form.Password to empty.
// Eventually the database should be changed to indicate "Second Factor"-enabled accounts
// (accounts that do not introduce the security vulnerabilities of a password).
// If a user decides to circumvent second-factor security, and purposefully create a password,
// they can still do so using the "Recover Account" option.
form . Password = ""
} else {
if ( len ( strings . TrimSpace ( form . Password ) ) > 0 || len ( strings . TrimSpace ( form . Retype ) ) > 0 ) && form . Password != form . Retype {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.password_not_match" ) , tplLinkAccount , & form )
return
}
if len ( strings . TrimSpace ( form . Password ) ) > 0 && len ( form . Password ) < setting . MinPasswordLength {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.password_too_short" , setting . MinPasswordLength ) , tplLinkAccount , & form )
return
}
2017-02-22 08:14:37 +01:00
}
loginSource , err := models . GetActiveOAuth2LoginSourceByName ( gothUser . ( goth . User ) . Provider )
if err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "CreateUser" , err )
2017-02-22 08:14:37 +01:00
}
u := & models . User {
Name : form . UserName ,
Email : form . Email ,
Passwd : form . Password ,
IsActive : ! setting . Service . RegisterEmailConfirm ,
LoginType : models . LoginOAuth2 ,
LoginSource : loginSource . ID ,
LoginName : gothUser . ( goth . User ) . UserID ,
}
2020-02-23 20:52:05 +01:00
//nolint: dupl
2017-02-22 08:14:37 +01:00
if err := models . CreateUser ( u ) ; err != nil {
switch {
case models . IsErrUserAlreadyExist ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.username_been_taken" ) , tplLinkAccount , & form )
case models . IsErrEmailAlreadyUsed ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_been_used" ) , tplLinkAccount , & form )
2020-11-22 18:31:35 +01:00
case models . IsErrEmailInvalid ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_invalid" ) , tplSignUp , & form )
2017-02-22 08:14:37 +01:00
case models . IsErrNameReserved ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_reserved" , err . ( models . ErrNameReserved ) . Name ) , tplLinkAccount , & form )
case models . IsErrNamePatternNotAllowed ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_pattern_not_allowed" , err . ( models . ErrNamePatternNotAllowed ) . Pattern ) , tplLinkAccount , & form )
2020-02-23 20:52:05 +01:00
case models . IsErrNameCharsNotAllowed ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_chars_not_allowed" , err . ( models . ErrNameCharsNotAllowed ) . Name ) , tplLinkAccount , & form )
2017-02-22 08:14:37 +01:00
default :
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "CreateUser" , err )
2017-02-22 08:14:37 +01:00
}
return
}
log . Trace ( "Account created: %s" , u . Name )
// Auto-set admin for the only user.
if models . CountUsers ( ) == 1 {
u . IsAdmin = true
u . IsActive = true
2017-08-12 16:18:44 +02:00
u . SetLastLogin ( )
if err := models . UpdateUserCols ( u , "is_admin" , "is_active" , "last_login_unix" ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UpdateUser" , err )
2017-02-22 08:14:37 +01:00
return
}
}
2019-10-14 08:10:42 +02:00
// update external user information
if err := models . UpdateExternalUser ( u , gothUser . ( goth . User ) ) ; err != nil {
log . Error ( "UpdateExternalUser failed: %v" , err )
}
2017-02-22 08:14:37 +01:00
// Send confirmation email
if setting . Service . RegisterEmailConfirm && u . ID > 1 {
2019-09-24 07:02:49 +02:00
mailer . SendActivateAccountMail ( ctx . Locale , u )
2017-02-22 08:14:37 +01:00
ctx . Data [ "IsSendRegisterMail" ] = true
ctx . Data [ "Email" ] = u . Email
2019-08-15 16:46:21 +02:00
ctx . Data [ "ActiveCodeLives" ] = timeutil . MinutesToFriendly ( setting . Service . ActiveCodeLives , ctx . Locale . Language ( ) )
2017-02-22 08:14:37 +01:00
ctx . HTML ( 200 , TplActivate )
if err := ctx . Cache . Put ( "MailResendLimit_" + u . LowerName , u . LowerName , 180 ) ; err != nil {
2019-04-02 09:48:31 +02:00
log . Error ( "Set cache(MailResendLimit) fail: %v" , err )
2017-02-22 08:14:37 +01:00
}
return
}
ctx . Redirect ( setting . AppSubURL + "/user/login" )
}
2020-05-07 23:49:00 +02:00
// HandleSignOut resets the session and sets the cookies
func HandleSignOut ( ctx * context . Context ) {
2020-05-17 08:05:11 +02:00
_ = ctx . Session . Flush ( )
_ = ctx . Session . Destroy ( ctx . Context )
2019-07-12 15:57:31 +02:00
ctx . SetCookie ( setting . CookieUserName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
ctx . SetCookie ( setting . CookieRememberName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
ctx . SetCookie ( setting . CSRFCookieName , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true )
ctx . SetCookie ( "lang" , "" , - 1 , setting . AppSubURL , setting . SessionConfig . Domain , setting . SessionConfig . Secure , true ) // Setting the lang cookie will trigger the middleware to reset the language ot previous state.
2020-04-26 00:11:32 +02:00
ctx . SetCookie ( "redirect_to" , "" , - 1 , setting . AppSubURL ) // logout default should set redirect to to default
2019-04-18 09:23:59 +02:00
}
// SignOut sign out from login status
func SignOut ( ctx * context . Context ) {
2020-05-07 23:49:00 +02:00
if ctx . User != nil {
eventsource . GetManager ( ) . SendMessageBlocking ( ctx . User . ID , & eventsource . Event {
Name : "logout" ,
Data : ctx . Session . ID ( ) ,
} )
}
HandleSignOut ( ctx )
2016-11-27 11:14:25 +01:00
ctx . Redirect ( setting . AppSubURL + "/" )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// SignUp render the register page
2016-03-11 17:56:52 +01:00
func SignUp ( ctx * context . Context ) {
2014-07-26 06:24:27 +02:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_up" )
2017-03-07 11:47:56 +01:00
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/sign_up"
2015-09-13 17:07:21 +02:00
ctx . Data [ "EnableCaptcha" ] = setting . Service . EnableCaptcha
2019-05-02 15:09:39 +02:00
ctx . Data [ "RecaptchaURL" ] = setting . Service . RecaptchaURL
2018-07-05 06:13:05 +02:00
ctx . Data [ "CaptchaType" ] = setting . Service . CaptchaType
ctx . Data [ "RecaptchaSitekey" ] = setting . Service . RecaptchaSitekey
2020-10-03 05:37:53 +02:00
ctx . Data [ "HcaptchaSitekey" ] = setting . Service . HcaptchaSitekey
2020-05-12 20:01:15 +02:00
ctx . Data [ "PageIsSignUp" ] = true
2018-07-05 06:13:05 +02:00
2020-04-29 23:46:43 +02:00
//Show Disabled Registration message if DisableRegistration or AllowOnlyExternalRegistration options are true
ctx . Data [ "DisableRegistration" ] = setting . Service . DisableRegistration || setting . Service . AllowOnlyExternalRegistration
2014-07-26 06:24:27 +02:00
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplSignUp )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// SignUpPost response for sign up information submission
2016-03-11 17:56:52 +01:00
func SignUpPost ( ctx * context . Context , cpt * captcha . Captcha , form auth . RegisterForm ) {
2014-07-26 06:24:27 +02:00
ctx . Data [ "Title" ] = ctx . Tr ( "sign_up" )
2017-03-07 11:47:56 +01:00
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/sign_up"
2015-09-13 17:07:21 +02:00
ctx . Data [ "EnableCaptcha" ] = setting . Service . EnableCaptcha
2019-05-02 15:09:39 +02:00
ctx . Data [ "RecaptchaURL" ] = setting . Service . RecaptchaURL
2018-07-05 06:13:05 +02:00
ctx . Data [ "CaptchaType" ] = setting . Service . CaptchaType
ctx . Data [ "RecaptchaSitekey" ] = setting . Service . RecaptchaSitekey
2020-10-03 05:37:53 +02:00
ctx . Data [ "HcaptchaSitekey" ] = setting . Service . HcaptchaSitekey
2020-05-12 20:01:15 +02:00
ctx . Data [ "PageIsSignUp" ] = true
2018-07-05 06:13:05 +02:00
2018-05-13 09:51:16 +02:00
//Permission denied if DisableRegistration or AllowOnlyExternalRegistration options are true
2020-04-29 23:46:43 +02:00
if setting . Service . DisableRegistration || setting . Service . AllowOnlyExternalRegistration {
2014-07-26 06:24:27 +02:00
ctx . Error ( 403 )
return
}
if ctx . HasError ( ) {
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplSignUp )
2014-07-26 06:24:27 +02:00
return
}
2019-07-06 21:48:02 +02:00
if setting . Service . EnableCaptcha {
var valid bool
2020-10-03 05:37:53 +02:00
var err error
2019-07-06 21:48:02 +02:00
switch setting . Service . CaptchaType {
case setting . ImageCaptcha :
valid = cpt . VerifyReq ( ctx . Req )
case setting . ReCaptcha :
2020-10-03 05:37:53 +02:00
valid , err = recaptcha . Verify ( ctx . Req . Context ( ) , form . GRecaptchaResponse )
case setting . HCaptcha :
valid , err = hcaptcha . Verify ( ctx . Req . Context ( ) , form . HcaptchaResponse )
2019-07-06 21:48:02 +02:00
default :
ctx . ServerError ( "Unknown Captcha Type" , fmt . Errorf ( "Unknown Captcha Type: %s" , setting . Service . CaptchaType ) )
return
}
2020-10-03 05:37:53 +02:00
if err != nil {
log . Debug ( "%s" , err . Error ( ) )
}
2015-09-13 15:51:51 +02:00
2018-07-05 06:13:05 +02:00
if ! valid {
ctx . Data [ "Err_Captcha" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.captcha_incorrect" ) , tplSignUp , & form )
return
}
}
2018-11-15 02:00:04 +01:00
if ! form . IsEmailDomainWhitelisted ( ) {
ctx . RenderWithErr ( ctx . Tr ( "auth.email_domain_blacklisted" ) , tplSignUp , & form )
return
}
2015-09-13 15:51:51 +02:00
if form . Password != form . Retype {
2014-07-26 06:24:27 +02:00
ctx . Data [ "Err_Password" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "form.password_not_match" ) , tplSignUp , & form )
2014-07-26 06:24:27 +02:00
return
}
2016-12-24 14:40:44 +01:00
if len ( form . Password ) < setting . MinPasswordLength {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.password_too_short" , setting . MinPasswordLength ) , tplSignUp , & form )
return
}
2019-11-09 04:40:37 +01:00
if ! password . IsComplexEnough ( form . Password ) {
ctx . Data [ "Err_Password" ] = true
2019-11-19 23:44:58 +01:00
ctx . RenderWithErr ( password . BuildComplexityError ( ctx ) , tplSignUp , & form )
2019-11-09 04:40:37 +01:00
return
}
2020-09-09 00:06:39 +02:00
pwned , err := password . IsPwned ( ctx . Req . Context ( ) , form . Password )
if pwned {
errMsg := ctx . Tr ( "auth.password_pwned" )
if err != nil {
log . Error ( err . Error ( ) )
errMsg = ctx . Tr ( "auth.password_pwned_err" )
}
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( errMsg , tplSignUp , & form )
return
}
2014-07-26 06:24:27 +02:00
u := & models . User {
Name : form . UserName ,
Email : form . Email ,
Passwd : form . Password ,
2015-09-17 22:11:44 +02:00
IsActive : ! setting . Service . RegisterEmailConfirm ,
2014-07-26 06:24:27 +02:00
}
if err := models . CreateUser ( u ) ; err != nil {
2015-03-26 22:11:47 +01:00
switch {
case models . IsErrUserAlreadyExist ( err ) :
2014-07-26 06:24:27 +02:00
ctx . Data [ "Err_UserName" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "form.username_been_taken" ) , tplSignUp , & form )
2015-03-26 22:11:47 +01:00
case models . IsErrEmailAlreadyUsed ( err ) :
2014-07-26 06:24:27 +02:00
ctx . Data [ "Err_Email" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "form.email_been_used" ) , tplSignUp , & form )
2020-11-22 18:31:35 +01:00
case models . IsErrEmailInvalid ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_invalid" ) , tplSignUp , & form )
2015-03-26 22:11:47 +01:00
case models . IsErrNameReserved ( err ) :
2014-07-26 06:24:27 +02:00
ctx . Data [ "Err_UserName" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_reserved" , err . ( models . ErrNameReserved ) . Name ) , tplSignUp , & form )
2015-03-26 22:11:47 +01:00
case models . IsErrNamePatternNotAllowed ( err ) :
ctx . Data [ "Err_UserName" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_pattern_not_allowed" , err . ( models . ErrNamePatternNotAllowed ) . Pattern ) , tplSignUp , & form )
2014-07-26 06:24:27 +02:00
default :
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "CreateUser" , err )
2014-07-26 06:24:27 +02:00
}
return
}
log . Trace ( "Account created: %s" , u . Name )
2015-08-18 22:58:45 +02:00
// Auto-set admin for the only user.
if models . CountUsers ( ) == 1 {
u . IsAdmin = true
u . IsActive = true
2017-08-12 16:18:44 +02:00
u . SetLastLogin ( )
if err := models . UpdateUserCols ( u , "is_admin" , "is_active" , "last_login_unix" ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UpdateUser" , err )
2015-08-18 22:58:45 +02:00
return
}
}
2016-07-15 18:36:39 +02:00
// Send confirmation email, no need for social account.
2016-07-23 19:08:22 +02:00
if setting . Service . RegisterEmailConfirm && u . ID > 1 {
2019-09-24 07:02:49 +02:00
mailer . SendActivateAccountMail ( ctx . Locale , u )
2014-08-10 02:25:02 +02:00
ctx . Data [ "IsSendRegisterMail" ] = true
ctx . Data [ "Email" ] = u . Email
2019-08-15 16:46:21 +02:00
ctx . Data [ "ActiveCodeLives" ] = timeutil . MinutesToFriendly ( setting . Service . ActiveCodeLives , ctx . Locale . Language ( ) )
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , TplActivate )
2014-08-10 02:25:02 +02:00
if err := ctx . Cache . Put ( "MailResendLimit_" + u . LowerName , u . LowerName , 180 ) ; err != nil {
2019-04-02 09:48:31 +02:00
log . Error ( "Set cache(MailResendLimit) fail: %v" , err )
2014-08-10 02:25:02 +02:00
}
return
}
2014-07-26 06:24:27 +02:00
2018-08-11 21:33:19 +02:00
ctx . Flash . Success ( ctx . Tr ( "auth.sign_up_successful" ) )
handleSignInFull ( ctx , u , false , true )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// Activate render activate user page
2016-03-11 17:56:52 +01:00
func Activate ( ctx * context . Context ) {
2014-08-10 06:02:00 +02:00
code := ctx . Query ( "code" )
if len ( code ) == 0 {
ctx . Data [ "IsActivatePage" ] = true
if ctx . User . IsActive {
ctx . Error ( 404 )
return
}
2016-07-15 18:36:39 +02:00
// Resend confirmation email.
2014-08-10 06:02:00 +02:00
if setting . Service . RegisterEmailConfirm {
if ctx . Cache . IsExist ( "MailResendLimit_" + ctx . User . LowerName ) {
ctx . Data [ "ResendLimited" ] = true
} else {
2019-08-15 16:46:21 +02:00
ctx . Data [ "ActiveCodeLives" ] = timeutil . MinutesToFriendly ( setting . Service . ActiveCodeLives , ctx . Locale . Language ( ) )
2019-09-24 07:02:49 +02:00
mailer . SendActivateAccountMail ( ctx . Locale , ctx . User )
2014-08-10 06:02:00 +02:00
if err := ctx . Cache . Put ( "MailResendLimit_" + ctx . User . LowerName , ctx . User . LowerName , 180 ) ; err != nil {
2019-04-02 09:48:31 +02:00
log . Error ( "Set cache(MailResendLimit) fail: %v" , err )
2014-08-10 06:02:00 +02:00
}
}
} else {
ctx . Data [ "ServiceNotEnabled" ] = true
}
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , TplActivate )
2014-08-10 06:02:00 +02:00
return
}
// Verify code.
if user := models . VerifyUserActiveCode ( code ) ; user != nil {
user . IsActive = true
2016-12-20 13:32:02 +01:00
var err error
if user . Rands , err = models . GetUserSalt ( ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UpdateUser" , err )
2016-12-20 13:32:02 +01:00
return
}
2017-08-12 16:18:44 +02:00
if err := models . UpdateUserCols ( user , "is_active" , "rands" ) ; err != nil {
2015-08-05 05:14:17 +02:00
if models . IsErrUserNotExist ( err ) {
2014-08-10 06:02:00 +02:00
ctx . Error ( 404 )
} else {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "UpdateUser" , err )
2014-08-10 06:02:00 +02:00
}
return
}
log . Trace ( "User activated: %s" , user . Name )
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uid" , user . ID ) ; err != nil {
log . Error ( fmt . Sprintf ( "Error setting uid in session: %v" , err ) )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Set ( "uname" , user . Name ) ; err != nil {
log . Error ( fmt . Sprintf ( "Error setting uname in session: %v" , err ) )
2019-06-12 21:41:28 +02:00
}
2020-05-17 14:43:29 +02:00
if err := ctx . Session . Release ( ) ; err != nil {
log . Error ( "Error storing session: %v" , err )
}
2018-07-25 19:54:56 +02:00
ctx . Flash . Success ( ctx . Tr ( "auth.account_activated" ) )
2016-11-27 11:14:25 +01:00
ctx . Redirect ( setting . AppSubURL + "/" )
2014-08-10 06:02:00 +02:00
return
}
ctx . Data [ "IsActivateFailed" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , TplActivate )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// ActivateEmail render the activate email page
2016-03-11 17:56:52 +01:00
func ActivateEmail ( ctx * context . Context ) {
2014-12-17 16:41:49 +01:00
code := ctx . Query ( "code" )
2016-11-18 04:03:03 +01:00
emailStr := ctx . Query ( "email" )
2014-12-17 16:41:49 +01:00
// Verify code.
2016-11-18 04:03:03 +01:00
if email := models . VerifyActiveEmailCode ( code , emailStr ) ; email != nil {
2015-02-22 04:13:47 +01:00
if err := email . Activate ( ) ; err != nil {
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "ActivateEmail" , err )
2014-12-17 16:41:49 +01:00
}
log . Trace ( "Email activated: %s" , email . Email )
2015-11-19 17:52:39 +01:00
ctx . Flash . Success ( ctx . Tr ( "settings.add_email_success" ) )
2020-03-02 19:25:36 +01:00
if u , err := models . GetUserByID ( email . UID ) ; err != nil {
log . Warn ( "GetUserByID: %d" , email . UID )
} else {
// Allow user to validate more emails
_ = ctx . Cache . Delete ( "MailResendLimit_" + u . LowerName )
}
2014-12-17 16:41:49 +01:00
}
2020-03-02 19:25:36 +01:00
// FIXME: e-mail verification does not require the user to be logged in,
// so this could be redirecting to the login page.
// Should users be logged in automatically here? (consider 2FA requirements, etc.)
2020-03-01 00:46:20 +01:00
ctx . Redirect ( setting . AppSubURL + "/user/settings/account" )
2014-12-17 16:41:49 +01:00
}
2016-11-18 04:03:03 +01:00
// ForgotPasswd render the forget pasword page
2016-03-11 17:56:52 +01:00
func ForgotPasswd ( ctx * context . Context ) {
2017-02-20 19:27:20 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.forgot_password_title" )
2014-07-26 06:24:27 +02:00
if setting . MailService == nil {
ctx . Data [ "IsResetDisable" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplForgotPassword )
2014-07-26 06:24:27 +02:00
return
}
2017-03-11 10:11:54 +01:00
email := ctx . Query ( "email" )
ctx . Data [ "Email" ] = email
2014-07-26 06:24:27 +02:00
ctx . Data [ "IsResetRequest" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplForgotPassword )
2014-07-26 06:24:27 +02:00
}
2016-11-18 04:03:03 +01:00
// ForgotPasswdPost response for forget password request
2016-03-11 17:56:52 +01:00
func ForgotPasswdPost ( ctx * context . Context ) {
2017-02-20 19:27:20 +01:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.forgot_password_title" )
2014-08-10 06:02:00 +02:00
if setting . MailService == nil {
2018-01-10 22:34:17 +01:00
ctx . NotFound ( "ForgotPasswdPost" , nil )
2014-08-10 06:02:00 +02:00
return
}
ctx . Data [ "IsResetRequest" ] = true
email := ctx . Query ( "email" )
2015-09-17 20:57:24 +02:00
ctx . Data [ "Email" ] = email
2014-08-10 06:02:00 +02:00
u , err := models . GetUserByEmail ( email )
if err != nil {
2015-08-05 05:14:17 +02:00
if models . IsErrUserNotExist ( err ) {
2019-08-15 16:46:21 +02:00
ctx . Data [ "ResetPwdCodeLives" ] = timeutil . MinutesToFriendly ( setting . Service . ResetPwdCodeLives , ctx . Locale . Language ( ) )
2016-10-17 04:08:40 +02:00
ctx . Data [ "IsResetSent" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplForgotPassword )
2016-10-17 04:08:40 +02:00
return
2014-08-10 06:02:00 +02:00
}
2016-11-18 04:03:03 +01:00
2018-01-10 22:34:17 +01:00
ctx . ServerError ( "user.ResetPasswd(check existence)" , err )
2014-08-10 06:02:00 +02:00
return
}
2017-02-22 08:14:37 +01:00
if ! u . IsLocal ( ) && ! u . IsOAuth2 ( ) {
2016-03-14 15:40:16 +01:00
ctx . Data [ "Err_Email" ] = true
2016-11-18 04:03:03 +01:00
ctx . RenderWithErr ( ctx . Tr ( "auth.non_local_account" ) , tplForgotPassword , nil )
2016-03-14 15:40:16 +01:00
return
}
2014-08-10 06:02:00 +02:00
if ctx . Cache . IsExist ( "MailResendLimit_" + u . LowerName ) {
ctx . Data [ "ResendLimited" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplForgotPassword )
2014-08-10 06:02:00 +02:00
return
}
2019-09-24 07:02:49 +02:00
mailer . SendResetPasswordMail ( ctx . Locale , u )
2014-08-10 06:02:00 +02:00
if err = ctx . Cache . Put ( "MailResendLimit_" + u . LowerName , u . LowerName , 180 ) ; err != nil {
2019-04-02 09:48:31 +02:00
log . Error ( "Set cache(MailResendLimit) fail: %v" , err )
2014-08-10 06:02:00 +02:00
}
2019-08-15 16:46:21 +02:00
ctx . Data [ "ResetPwdCodeLives" ] = timeutil . MinutesToFriendly ( setting . Service . ResetPwdCodeLives , ctx . Locale . Language ( ) )
2014-08-10 06:02:00 +02:00
ctx . Data [ "IsResetSent" ] = true
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplForgotPassword )
2014-07-26 06:24:27 +02:00
}
2020-01-19 21:17:12 +01:00
func commonResetPassword ( ctx * context . Context ) ( * models . User , * models . TwoFactor ) {
2019-04-18 09:23:59 +02:00
code := ctx . Query ( "code" )
2014-08-10 06:02:00 +02:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.reset_password" )
2019-04-18 09:23:59 +02:00
ctx . Data [ "Code" ] = code
if nil != ctx . User {
ctx . Data [ "user_signed_in" ] = true
}
2014-07-26 06:24:27 +02:00
if len ( code ) == 0 {
2019-04-18 09:23:59 +02:00
ctx . Flash . Error ( ctx . Tr ( "auth.invalid_code" ) )
2020-01-19 21:17:12 +01:00
return nil , nil
2014-07-26 06:24:27 +02:00
}
2019-02-20 00:09:47 +01:00
2019-04-18 09:23:59 +02:00
// Fail early, don't frustrate the user
u := models . VerifyUserActiveCode ( code )
if u == nil {
ctx . Flash . Error ( ctx . Tr ( "auth.invalid_code" ) )
2020-01-19 21:17:12 +01:00
return nil , nil
}
twofa , err := models . GetTwoFactorByUID ( u . ID )
if err != nil {
if ! models . IsErrTwoFactorNotEnrolled ( err ) {
ctx . Error ( http . StatusInternalServerError , "CommonResetPassword" , err . Error ( ) )
return nil , nil
}
} else {
ctx . Data [ "has_two_factor" ] = true
ctx . Data [ "scratch_code" ] = ctx . QueryBool ( "scratch_code" )
2019-02-20 00:09:47 +01:00
}
2019-04-18 09:23:59 +02:00
// Show the user that they are affecting the account that they intended to
ctx . Data [ "user_email" ] = u . Email
if nil != ctx . User && u . ID != ctx . User . ID {
ctx . Flash . Error ( ctx . Tr ( "auth.reset_password_wrong_user" , ctx . User . Email , u . Email ) )
2020-01-19 21:17:12 +01:00
return nil , nil
2019-04-18 09:23:59 +02:00
}
2020-01-19 21:17:12 +01:00
return u , twofa
2019-04-18 09:23:59 +02:00
}
// ResetPasswd render the account recovery page
func ResetPasswd ( ctx * context . Context ) {
ctx . Data [ "IsResetForm" ] = true
commonResetPassword ( ctx )
2020-01-19 21:17:12 +01:00
if ctx . Written ( ) {
return
}
2019-04-18 09:23:59 +02:00
2016-11-18 04:03:03 +01:00
ctx . HTML ( 200 , tplResetPassword )
2014-07-26 06:24:27 +02:00
}
2019-04-18 09:23:59 +02:00
// ResetPasswdPost response from account recovery request
2016-03-11 17:56:52 +01:00
func ResetPasswdPost ( ctx * context . Context ) {
2020-01-19 21:17:12 +01:00
u , twofa := commonResetPassword ( ctx )
if ctx . Written ( ) {
return
}
2014-08-10 06:02:00 +02:00
2019-04-18 09:23:59 +02:00
if u == nil {
// Flash error has been set
ctx . HTML ( 200 , tplResetPassword )
2014-08-10 06:02:00 +02:00
return
}
2019-04-18 09:23:59 +02:00
// Validate password length.
passwd := ctx . Query ( "password" )
if len ( passwd ) < setting . MinPasswordLength {
ctx . Data [ "IsResetForm" ] = true
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.password_too_short" , setting . MinPasswordLength ) , tplResetPassword , nil )
return
2019-10-14 17:24:26 +02:00
} else if ! password . IsComplexEnough ( passwd ) {
ctx . Data [ "IsResetForm" ] = true
ctx . Data [ "Err_Password" ] = true
2019-11-19 23:44:58 +01:00
ctx . RenderWithErr ( password . BuildComplexityError ( ctx ) , tplResetPassword , nil )
2019-10-14 17:24:26 +02:00
return
2020-09-09 00:06:39 +02:00
} else if pwned , err := password . IsPwned ( ctx . Req . Context ( ) , passwd ) ; pwned || err != nil {
errMsg := ctx . Tr ( "auth.password_pwned" )
if err != nil {
log . Error ( err . Error ( ) )
errMsg = ctx . Tr ( "auth.password_pwned_err" )
}
ctx . Data [ "IsResetForm" ] = true
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( errMsg , tplResetPassword , nil )
return
2019-04-18 09:23:59 +02:00
}
2014-08-10 06:02:00 +02:00
2020-01-19 21:17:12 +01:00
// Handle two-factor
regenerateScratchToken := false
if twofa != nil {
if ctx . QueryBool ( "scratch_code" ) {
if ! twofa . VerifyScratchToken ( ctx . Query ( "token" ) ) {
ctx . Data [ "IsResetForm" ] = true
ctx . Data [ "Err_Token" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.twofa_scratch_token_incorrect" ) , tplResetPassword , nil )
return
}
regenerateScratchToken = true
} else {
passcode := ctx . Query ( "passcode" )
ok , err := twofa . ValidateTOTP ( passcode )
if err != nil {
ctx . Error ( http . StatusInternalServerError , "ValidateTOTP" , err . Error ( ) )
return
}
if ! ok || twofa . LastUsedPasscode == passcode {
ctx . Data [ "IsResetForm" ] = true
ctx . Data [ "Err_Passcode" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.twofa_passcode_incorrect" ) , tplResetPassword , nil )
return
}
twofa . LastUsedPasscode = passcode
if err = models . UpdateTwoFactor ( twofa ) ; err != nil {
ctx . ServerError ( "ResetPasswdPost: UpdateTwoFactor" , err )
return
}
}
}
2019-04-18 09:23:59 +02:00
var err error
if u . Rands , err = models . GetUserSalt ( ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
return
}
if u . Salt , err = models . GetUserSalt ( ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
return
}
u . HashPassword ( passwd )
u . MustChangePassword = false
if err := models . UpdateUserCols ( u , "must_change_password" , "passwd" , "rands" , "salt" ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
2014-08-10 06:02:00 +02:00
return
}
2019-04-18 09:23:59 +02:00
log . Trace ( "User password reset: %s" , u . Name )
2014-08-10 06:02:00 +02:00
ctx . Data [ "IsResetFailed" ] = true
2019-04-18 09:23:59 +02:00
remember := len ( ctx . Query ( "remember" ) ) != 0
2020-01-19 21:17:12 +01:00
if regenerateScratchToken {
// Invalidate the scratch token.
_ , err = twofa . GenerateScratchToken ( )
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
if err = models . UpdateTwoFactor ( twofa ) ; err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
handleSignInFull ( ctx , u , remember , false )
ctx . Flash . Info ( ctx . Tr ( "auth.twofa_scratch_used" ) )
ctx . Redirect ( setting . AppSubURL + "/user/settings/security" )
return
}
2019-04-18 09:23:59 +02:00
handleSignInFull ( ctx , u , remember , true )
2014-07-26 06:24:27 +02:00
}
2018-09-13 14:04:25 +02:00
// MustChangePassword renders the page to change a user's password
func MustChangePassword ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.must_change_password" )
ctx . Data [ "ChangePasscodeLink" ] = setting . AppSubURL + "/user/settings/change_password"
2020-05-27 00:39:39 +02:00
ctx . Data [ "MustChangePassword" ] = true
2018-09-13 14:04:25 +02:00
ctx . HTML ( 200 , tplMustChangePassword )
}
// MustChangePasswordPost response for updating a user's password after his/her
// account was created by an admin
func MustChangePasswordPost ( ctx * context . Context , cpt * captcha . Captcha , form auth . MustChangePasswordForm ) {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.must_change_password" )
ctx . Data [ "ChangePasscodeLink" ] = setting . AppSubURL + "/user/settings/change_password"
if ctx . HasError ( ) {
ctx . HTML ( 200 , tplMustChangePassword )
return
}
u := ctx . User
// Make sure only requests for users who are eligible to change their password via
// this method passes through
if ! u . MustChangePassword {
ctx . ServerError ( "MustUpdatePassword" , errors . New ( "cannot update password.. Please visit the settings page" ) )
return
}
if form . Password != form . Retype {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.password_not_match" ) , tplMustChangePassword , & form )
return
}
if len ( form . Password ) < setting . MinPasswordLength {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.password_too_short" , setting . MinPasswordLength ) , tplMustChangePassword , & form )
return
}
var err error
if u . Salt , err = models . GetUserSalt ( ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
return
}
u . HashPassword ( form . Password )
u . MustChangePassword = false
if err := models . UpdateUserCols ( u , "must_change_password" , "passwd" , "salt" ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
return
}
ctx . Flash . Success ( ctx . Tr ( "settings.change_password_success" ) )
log . Trace ( "User updated password: %s" , u . Name )
2020-08-11 22:05:34 +02:00
if redirectTo := ctx . GetCookie ( "redirect_to" ) ; len ( redirectTo ) > 0 && ! utils . IsExternalURL ( redirectTo ) {
2018-09-13 14:04:25 +02:00
ctx . SetCookie ( "redirect_to" , "" , - 1 , setting . AppSubURL )
ctx . RedirectToFirst ( redirectTo )
return
}
ctx . Redirect ( setting . AppSubURL + "/" )
}