starred/newznab-tmux
1
0
Fork 0
mirror of https://github.com/NNTmux/newznab-tmux.git synced 2026-08-29 01:08:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update admin area access handling (still WIP)

Browse Source
This commit is contained in:
DariusIII
2018-03-23 14:21:16 +01:00
parent 85adb413be
commit b14724de36
11 changed files with 59 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Blacklight/http/AdminPage.php
+2 -1
View File
@@ -4,6 +4,7 @@ namespace Blacklight\http;
use App\Models\User;
use App\Models\Category;
use Illuminate\Support\Facades\Auth;
/**
* All admin pages implement this class. Enforces admin role for requesting user.
@@ -28,7 +29,7 @@ class AdminPage extends BasePage
]
);
if (! isset($this->userdata['user_roles_id']) || (int) $this->userdata['user_roles_id'] !== User::ROLE_ADMIN || ! User::isLoggedIn()) {
if (! Auth::check()) {
$this->show403(true);
}
Blacklight/http/BasePage.php
+12 -3
View File
@@ -129,6 +129,7 @@ class BasePage
$this->page = request()->input('page') ?? 'content';
if (Auth::check()) {
$this->userdata = User::find(Auth::id());
$this->setUserPreferences();
} else {
$this->theme = $this->getSettingValue('site.main.style');
@@ -196,10 +197,19 @@ class BasePage
/**
* Show 403 page.
*
*
* @param bool $from_admin
*/
public function show403(): void
public function show403($from_admin = false): void
{
die(view('errors.403'));
header(
'Location: '.
($from_admin ? str_replace('/admin', '', WWW_TOP) : WWW_TOP).
'/login?redirect='.
urlencode(request()->getRequestUri())
);
exit();
}
/**
@@ -273,7 +283,6 @@ class BasePage
*/
protected function setUserPreferences(): void
{
$this->userdata = User::find(Auth::id());
$this->userdata['categoryexclusions'] = User::getCategoryExclusion(Auth::id());
$this->userdata['rolecategoryexclusions'] = RoleExcludedCategory::getRoleCategoryExclusion($this->userdata['user_roles_id']);
app/Http/Controllers/Auth/LoginController.php
-5
View File
@@ -70,9 +70,4 @@ class LoginController extends Controller
'login' => 'These credentials do not match our records.',
]);
}
public function logout()
{
Auth::logout();
}
}
app/Http/Controllers/Auth/RegisterController.php
+1
View File
@@ -5,6 +5,7 @@ namespace App\Http\Controllers\Auth;
use App\Models\User;
use Blacklight\utility\Utility;
use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Facades\Validator;
use Illuminate\Foundation\Auth\RegistersUsers;
app/Models/User.php
+1 -82
View File
@@ -575,7 +575,7 @@ class User extends Authenticatable
}
/**
* Generate a stron password.
* Generate a strong password.
*
*
* @param int $length
@@ -757,52 +757,6 @@ class User extends Authenticatable
)->id;
}
/**
* Verify if the user is logged in.
*
* @return bool
* @throws \Exception
*/
public static function isLoggedIn(): bool
{
if (isset($_SESSION['uid'])) {
return true;
}
if (isset($_COOKIE['uid'], $_COOKIE['idh'])) {
$u = self::find($_COOKIE['uid']);
if ((int) $u['user_roles_id'] !== self::ROLE_DISABLED && $_COOKIE['idh'] === self::hashSHA1($u['userseed'].$_COOKIE['uid'])) {
self::login($_COOKIE['uid'], $_SERVER['REMOTE_ADDR']);
}
}
return isset($_SESSION['uid']);
}
/**
* Log in a user.
*
* @param int $userID ID of the user.
* @param string $host
* @param bool $remember Save the user in cookies to keep them logged in.
*
* @throws \Exception
*/
public static function login($userID, $host = '', $remember = false): void
{
$_SESSION['uid'] = $userID;
if ((int) Settings::settingValue('..storeuserips') !== 1) {
$host = '';
}
self::updateSiteAccessed($userID, $host);
if ($remember === true) {
self::setCookies($userID);
}
}
/**
* When a user logs in, update the last time they logged in.
*
@@ -819,41 +773,6 @@ class User extends Authenticatable
);
}
/**
* Set up cookies for a user.
*
* @param int $userID
*/
public static function setCookies($userID): void
{
$user = self::find($userID);
$secure_cookie = request()->secure();
setcookie('uid', $userID, time() + 2592000, '/', null, $secure_cookie, true);
setcookie('idh', self::hashSHA1($user['userseed'].$userID), time() + 2592000, '/', null, $secure_cookie, true);
}
/**
* Return the User ID of the user.
*
* @return int
*/
public static function currentUserId(): int
{
return $_SESSION['uid'] ?? -1;
}
/**
* Logout the user, destroying his cookies and session.
*/
public static function logout(): void
{
session_unset();
session_destroy();
$secure_cookie = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? '1' : '0');
setcookie('uid', null, -1, '/', null, $secure_cookie, true);
setcookie('idh', null, -1, '/', null, $secure_cookie, true);
}
/**
* @param $uid
*/
public/admin/index.php
+8
View File
@@ -4,6 +4,14 @@ use Blacklight\http\AdminPage;
require_once dirname(__DIR__, 2).DIRECTORY_SEPARATOR.'resources/views/themes/smarty.php';
$kernel = $app->make(Illuminate\Contracts\Http\Kernel::class);
$response = $kernel->handle(
$request = Illuminate\Http\Request::capture()
);
$response->send();
$kernel->terminate($request, $response);
$page = new AdminPage();
$page->title = 'Admin Hangout';
public/admin/site-edit.php
+6 -2
View File
@@ -8,9 +8,14 @@ use App\Models\Category;
use App\Models\Settings;
use Blacklight\http\AdminPage;
use Blacklight\utility\Utility;
use Illuminate\Support\Facades\Auth;
$page = new AdminPage();
if (! Auth::check()) {
$page->show403(true);
}
$sites = new Sites();
$id = 0;
@@ -19,7 +24,6 @@ $action = request()->input('action') ?? 'view';
switch ($action) {
case 'submit':
if (! request()->has('book_reqids')) {
request()->merge(['book_reqids' => []]);
}
@@ -48,7 +52,7 @@ switch ($action) {
if ($error === '') {
$site = $ret;
$returnid = $site['id'];
header('Location:'.WWW_TOP.'/site-edit.php?id='.$returnid);
request()->header('Location:'.WWW_TOP.'/site-edit.php?id='.$returnid);
} else {
$page->smarty->assign('error', $error);
$site = $sites->row2Object(request()->all());
public/pages/register.php
+19 -23
View File
@@ -36,23 +36,22 @@ if ($showRegister === 1) {
switch ($action) {
case 'submit':
if ($captcha->getError() === false) {
if (Utility::checkCSRFToken() === true) {
$userName = request()->input('username');
$password = request()->input('password');
$confirmPassword = request()->input('confirmpassword');
$email = request()->input('email');
if (! empty(request()->input('invitecode'))) {
$inviteCode = request()->input('invitecode');
}
$userName = request()->input('username');
$password = request()->input('password');
$confirmPassword = request()->input('confirmpassword');
$email = request()->input('email');
if (! empty(request()->input('invitecode'))) {
$inviteCode = request()->input('invitecode');
}
// Check uname/email isn't in use, password valid. If all good create new user account and redirect back to home page.
if ($password !== $confirmPassword) {
$error = 'Password Mismatch';
} else {
// Get the default user role.
$userDefault = UserRole::getDefaultRole();
// Check uname/email isn't in use, password valid. If all good create new user account and redirect back to home page.
if ($password !== $confirmPassword) {
$error = 'Password Mismatch';
} else {
// Get the default user role.
$userDefault = UserRole::getDefaultRole();
$ret = User::signup(
$ret = User::signup(
$userName,
$password,
$email,
@@ -63,11 +62,11 @@ if ($showRegister === 1) {
$inviteCode
);
if ($ret > 0) {
User::login($ret, request()->ip());
header('Location: '.WWW_TOP.'/');
} else {
switch ($ret) {
if ($ret > 0) {
session()->flash('You are already a member!');
redirect('/');
} else {
switch ($ret) {
case User::ERR_SIGNUP_BADUNAME:
$error = 'Your username must be at least five characters.';
break;
@@ -90,10 +89,7 @@ if ($showRegister === 1) {
$error = 'Failed to register.';
break;
}
}
}
} else {
$page->showTokenError();
}
}
break;
resources/views/themes/Gentele/basepage.tpl
+8 -2
View File
@@ -117,8 +117,10 @@
API</a></li>
</ul>
<div class="clearfix"></div>
<li><a href="{$smarty.const.WWW_TOP}/logout"><i
class="fa fa-unlock"></i><span> Sign Out</span></a></li>
<li><a href="{{route('logout')}}" onclick="event.preventDefault(); document.getElementById('frm-logout').submit();">
<i class="fa fa-unlock"></i><span> Sign Out</span>
</a>
</li>
{else}
<li><a href="{$smarty.const.WWW_TOP}/login"><i class="fa fa-lock"></i><span> Sign In</span></a>
</li>
@@ -228,6 +230,10 @@
});
</script>
<form id="frm-logout" action="{{route('logout')}}" method="post" style="display: none;">
{{csrf_field()}}
</form>
</body>
</html>
resources/views/themes/Gentele/register.tpl
+1 -1
View File
@@ -16,7 +16,7 @@
<div class="register-box-body">
<p class="login-box-msg">Register a new membership</p>
<form method="post" action="register?action=submit{$invite_code_query}">
<input type="hidden" name="_token" value="{$csrf_token}">
{{csrf_field()}}
<div class="form-group has-feedback">
<input autocomplete="off" id="username" name="username" value="{$username}" type="text"
class="form-control" placeholder="Username"/>
resources/views/themes/admin/site-edit.tpl
+1
View File
@@ -2,6 +2,7 @@
<div class="well well-small">
<form action="{$SCRIPT_NAME}?action=submit" method="post">
{{csrf_field()}}
{if isset ($error) && $error != ''}
<div class="error">{$error}</div>