2014-03-15 15:01:50 +04:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2019-04-19 11:59:26 +03:00
// Copyright 2019 The Gitea Authors. All rights reserved.
2014-03-15 15:01:50 +04:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
2016-03-11 19:56:52 +03:00
package context
2014-03-15 15:01:50 +04:00
import (
2021-04-05 18:30:52 +03:00
"net/http"
2019-04-19 11:59:26 +03:00
"code.gitea.io/gitea/models"
2019-02-19 10:19:28 +03:00
"code.gitea.io/gitea/modules/log"
2016-11-10 19:24:48 +03:00
"code.gitea.io/gitea/modules/setting"
2021-03-07 11:12:43 +03:00
"code.gitea.io/gitea/modules/web/middleware"
2014-03-15 15:01:50 +04:00
)
2016-11-25 09:51:01 +03:00
// ToggleOptions contains required or check options
2014-03-22 21:44:02 +04:00
type ToggleOptions struct {
2016-03-11 19:56:52 +03:00
SignInRequired bool
SignOutRequired bool
AdminRequired bool
DisableCSRF bool
2015-08-13 21:43:40 +03:00
}
2016-11-25 09:51:01 +03:00
// Toggle returns toggle options as middleware
2021-01-26 18:36:53 +03:00
func Toggle ( options * ToggleOptions ) func ( ctx * Context ) {
2014-03-15 15:01:50 +04:00
return func ( ctx * Context ) {
2016-07-16 05:22:16 +03:00
// Check prohibit login users.
2018-09-13 15:04:25 +03:00
if ctx . IsSigned {
2019-02-19 10:19:28 +03:00
if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
2021-04-05 18:30:52 +03:00
ctx . HTML ( http . StatusOK , "user/auth/activate" )
2019-02-19 10:19:28 +03:00
return
2021-01-26 18:36:53 +03:00
}
if ! ctx . User . IsActive || ctx . User . ProhibitLogin {
2019-02-19 10:19:28 +03:00
log . Info ( "Failed authentication attempt for %s from %s" , ctx . User . Name , ctx . RemoteAddr ( ) )
2018-09-13 15:04:25 +03:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
2021-04-05 18:30:52 +03:00
ctx . HTML ( http . StatusOK , "user/auth/prohibit_login" )
2018-09-13 15:04:25 +03:00
return
}
if ctx . User . MustChangePassword {
2019-02-28 11:01:42 +03:00
if ctx . Req . URL . Path != "/user/settings/change_password" {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.must_change_password" )
ctx . Data [ "ChangePasscodeLink" ] = setting . AppSubURL + "/user/change_password"
2020-05-27 01:39:39 +03:00
if ctx . Req . URL . Path != "/user/events" {
2021-03-07 11:12:43 +03:00
middleware . SetRedirectToCookie ( ctx . Resp , setting . AppSubURL + ctx . Req . URL . RequestURI ( ) )
2020-05-27 01:39:39 +03:00
}
2019-02-28 11:01:42 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/settings/change_password" )
return
}
} else if ctx . Req . URL . Path == "/user/settings/change_password" {
// make sure that the form cannot be accessed by users who don't need this
ctx . Redirect ( setting . AppSubURL + "/" )
2018-09-13 15:04:25 +03:00
return
}
2016-07-16 05:22:16 +03:00
}
2014-05-05 21:08:01 +04:00
// Redirect to dashboard if user tries to visit any non-login page.
2019-12-24 03:11:12 +03:00
if options . SignOutRequired && ctx . IsSigned && ctx . Req . URL . RequestURI ( ) != "/" {
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/" )
2014-03-20 15:50:26 +04:00
return
}
2021-01-26 18:36:53 +03:00
if ! options . SignOutRequired && ! options . DisableCSRF && ctx . Req . Method == "POST" {
Validate ( ctx , ctx . csrf )
2014-08-01 01:25:34 +04:00
if ctx . Written ( ) {
return
}
2014-03-22 21:44:02 +04:00
}
2016-03-11 19:56:52 +03:00
if options . SignInRequired {
2014-03-22 21:44:02 +04:00
if ! ctx . IsSigned {
2020-08-09 01:39:40 +03:00
if ctx . Req . URL . Path != "/user/events" {
2021-03-07 11:12:43 +03:00
middleware . SetRedirectToCookie ( ctx . Resp , setting . AppSubURL + ctx . Req . URL . RequestURI ( ) )
2020-08-09 01:39:40 +03:00
}
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/login" )
2014-03-22 21:44:02 +04:00
return
2014-05-26 04:11:25 +04:00
} else if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
2014-08-10 08:02:00 +04:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
2021-04-05 18:30:52 +03:00
ctx . HTML ( http . StatusOK , "user/auth/activate" )
2014-03-22 21:44:02 +04:00
return
}
2021-01-26 18:36:53 +03:00
}
// Redirect to log in page if auto-signin info is provided and has not signed in.
if ! options . SignOutRequired && ! ctx . IsSigned &&
len ( ctx . GetCookie ( setting . CookieUserName ) ) > 0 {
if ctx . Req . URL . Path != "/user/events" {
2021-03-07 11:12:43 +03:00
middleware . SetRedirectToCookie ( ctx . Resp , setting . AppSubURL + ctx . Req . URL . RequestURI ( ) )
2021-01-26 18:36:53 +03:00
}
ctx . Redirect ( setting . AppSubURL + "/user/login" )
return
}
if options . AdminRequired {
if ! ctx . User . IsAdmin {
2021-04-05 18:30:52 +03:00
ctx . Error ( http . StatusForbidden )
2021-01-26 18:36:53 +03:00
return
}
ctx . Data [ "PageIsAdmin" ] = true
}
}
}
// ToggleAPI returns toggle options as middleware
func ToggleAPI ( options * ToggleOptions ) func ( ctx * APIContext ) {
return func ( ctx * APIContext ) {
// Check prohibit login users.
if ctx . IsSigned {
if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2021-01-26 18:36:53 +03:00
"message" : "This account is not activated." ,
} )
return
}
if ! ctx . User . IsActive || ctx . User . ProhibitLogin {
log . Info ( "Failed authentication attempt for %s from %s" , ctx . User . Name , ctx . RemoteAddr ( ) )
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2021-01-26 18:36:53 +03:00
"message" : "This account is prohibited from signing in, please contact your site administrator." ,
} )
return
}
if ctx . User . MustChangePassword {
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2021-01-26 18:36:53 +03:00
"message" : "You must change your password. Change it at: " + setting . AppURL + "/user/change_password" ,
} )
return
}
}
// Redirect to dashboard if user tries to visit any non-login page.
if options . SignOutRequired && ctx . IsSigned && ctx . Req . URL . RequestURI ( ) != "/" {
ctx . Redirect ( setting . AppSubURL + "/" )
return
}
if options . SignInRequired {
if ! ctx . IsSigned {
// Restrict API calls with error message.
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2021-01-26 18:36:53 +03:00
"message" : "Only signed in user is allowed to call APIs." ,
} )
return
} else if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
2021-04-05 18:30:52 +03:00
ctx . HTML ( http . StatusOK , "user/auth/activate" )
2021-01-26 18:36:53 +03:00
return
}
if ctx . IsSigned && ctx . IsBasicAuth {
2019-04-19 11:59:26 +03:00
twofa , err := models . GetTwoFactorByUID ( ctx . User . ID )
if err != nil {
if models . IsErrTwoFactorNotEnrolled ( err ) {
return // No 2FA enrollment for this user
}
2021-01-26 18:36:53 +03:00
ctx . InternalServerError ( err )
2019-04-19 11:59:26 +03:00
return
}
otpHeader := ctx . Req . Header . Get ( "X-Gitea-OTP" )
ok , err := twofa . ValidateTOTP ( otpHeader )
if err != nil {
2021-01-26 18:36:53 +03:00
ctx . InternalServerError ( err )
2019-04-19 11:59:26 +03:00
return
}
if ! ok {
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2019-04-19 11:59:26 +03:00
"message" : "Only signed in user is allowed to call APIs." ,
} )
return
}
}
2014-03-22 21:44:02 +04:00
}
2016-03-11 19:56:52 +03:00
if options . AdminRequired {
2014-03-22 21:44:02 +04:00
if ! ctx . User . IsAdmin {
2021-04-05 18:30:52 +03:00
ctx . JSON ( http . StatusForbidden , map [ string ] string {
2021-01-26 18:36:53 +03:00
"message" : "You have no permission to request for this." ,
} )
2014-03-22 21:44:02 +04:00
return
}
2014-03-22 22:27:03 +04:00
ctx . Data [ "PageIsAdmin" ] = true
2014-03-15 15:01:50 +04:00
}
}
}