2014-03-15 15:01:50 +04:00
// Copyright 2014 The Gogs Authors. All rights reserved.
2019-04-19 11:59:26 +03:00
// Copyright 2019 The Gitea Authors. All rights reserved.
2014-03-15 15:01:50 +04:00
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.
2016-03-11 19:56:52 +03:00
package context
2014-03-15 15:01:50 +04:00
import (
2019-04-19 11:59:26 +03:00
"code.gitea.io/gitea/models"
2016-11-10 19:24:48 +03:00
"code.gitea.io/gitea/modules/auth"
2019-02-19 10:19:28 +03:00
"code.gitea.io/gitea/modules/log"
2016-11-10 19:24:48 +03:00
"code.gitea.io/gitea/modules/setting"
2019-08-23 19:40:30 +03:00
"gitea.com/macaron/csrf"
"gitea.com/macaron/macaron"
2014-03-15 15:01:50 +04:00
)
2016-11-25 09:51:01 +03:00
// ToggleOptions contains required or check options
2014-03-22 21:44:02 +04:00
type ToggleOptions struct {
2016-03-11 19:56:52 +03:00
SignInRequired bool
SignOutRequired bool
AdminRequired bool
DisableCSRF bool
2015-08-13 21:43:40 +03:00
}
2016-11-25 09:51:01 +03:00
// Toggle returns toggle options as middleware
2014-07-26 08:24:27 +04:00
func Toggle ( options * ToggleOptions ) macaron . Handler {
2014-03-15 15:01:50 +04:00
return func ( ctx * Context ) {
2014-05-05 21:08:01 +04:00
// Cannot view any page before installation.
2014-05-26 04:11:25 +04:00
if ! setting . InstallLock {
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/install" )
2014-03-30 19:58:21 +04:00
return
}
2016-07-16 05:22:16 +03:00
// Check prohibit login users.
2018-09-13 15:04:25 +03:00
if ctx . IsSigned {
2019-02-19 10:19:28 +03:00
if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
ctx . HTML ( 200 , "user/auth/activate" )
return
} else if ! ctx . User . IsActive || ctx . User . ProhibitLogin {
log . Info ( "Failed authentication attempt for %s from %s" , ctx . User . Name , ctx . RemoteAddr ( ) )
2018-09-13 15:04:25 +03:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( 200 , "user/auth/prohibit_login" )
return
}
if ctx . User . MustChangePassword {
2019-02-28 11:01:42 +03:00
if ctx . Req . URL . Path != "/user/settings/change_password" {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.must_change_password" )
ctx . Data [ "ChangePasscodeLink" ] = setting . AppSubURL + "/user/change_password"
2019-03-18 17:00:23 +03:00
ctx . SetCookie ( "redirect_to" , setting . AppSubURL + ctx . Req . RequestURI , 0 , setting . AppSubURL )
2019-02-28 11:01:42 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/settings/change_password" )
return
}
} else if ctx . Req . URL . Path == "/user/settings/change_password" {
// make sure that the form cannot be accessed by users who don't need this
ctx . Redirect ( setting . AppSubURL + "/" )
2018-09-13 15:04:25 +03:00
return
}
2016-07-16 05:22:16 +03:00
}
2014-05-05 21:08:01 +04:00
// Redirect to dashboard if user tries to visit any non-login page.
2016-03-11 19:56:52 +03:00
if options . SignOutRequired && ctx . IsSigned && ctx . Req . RequestURI != "/" {
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/" )
2014-03-20 15:50:26 +04:00
return
}
2016-03-11 19:56:52 +03:00
if ! options . SignOutRequired && ! options . DisableCSRF && ctx . Req . Method == "POST" && ! auth . IsAPIPath ( ctx . Req . URL . Path ) {
2014-08-01 01:25:34 +04:00
csrf . Validate ( ctx . Context , ctx . csrf )
if ctx . Written ( ) {
return
}
2014-03-22 21:44:02 +04:00
}
2016-03-11 19:56:52 +03:00
if options . SignInRequired {
2014-03-22 21:44:02 +04:00
if ! ctx . IsSigned {
2015-07-15 14:17:57 +03:00
// Restrict API calls with error message.
if auth . IsAPIPath ( ctx . Req . URL . Path ) {
2016-03-14 01:49:16 +03:00
ctx . JSON ( 403 , map [ string ] string {
"message" : "Only signed in user is allowed to call APIs." ,
} )
2015-07-15 14:17:57 +03:00
return
}
2019-03-18 17:00:23 +03:00
ctx . SetCookie ( "redirect_to" , setting . AppSubURL + ctx . Req . RequestURI , 0 , setting . AppSubURL )
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/login" )
2014-03-22 21:44:02 +04:00
return
2014-05-26 04:11:25 +04:00
} else if ! ctx . User . IsActive && setting . Service . RegisterEmailConfirm {
2014-08-10 08:02:00 +04:00
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
2014-09-02 21:01:02 +04:00
ctx . HTML ( 200 , "user/auth/activate" )
2014-03-22 21:44:02 +04:00
return
}
2019-04-19 11:59:26 +03:00
if ctx . IsSigned && auth . IsAPIPath ( ctx . Req . URL . Path ) && ctx . IsBasicAuth {
twofa , err := models . GetTwoFactorByUID ( ctx . User . ID )
if err != nil {
if models . IsErrTwoFactorNotEnrolled ( err ) {
return // No 2FA enrollment for this user
}
ctx . Error ( 500 )
return
}
otpHeader := ctx . Req . Header . Get ( "X-Gitea-OTP" )
ok , err := twofa . ValidateTOTP ( otpHeader )
if err != nil {
ctx . Error ( 500 )
return
}
if ! ok {
ctx . JSON ( 403 , map [ string ] string {
"message" : "Only signed in user is allowed to call APIs." ,
} )
return
}
}
2014-03-22 21:44:02 +04:00
}
2016-03-11 19:56:52 +03:00
// Redirect to log in page if auto-signin info is provided and has not signed in.
if ! options . SignOutRequired && ! ctx . IsSigned && ! auth . IsAPIPath ( ctx . Req . URL . Path ) &&
2016-03-03 23:09:43 +03:00
len ( ctx . GetCookie ( setting . CookieUserName ) ) > 0 {
2019-03-18 17:00:23 +03:00
ctx . SetCookie ( "redirect_to" , setting . AppSubURL + ctx . Req . RequestURI , 0 , setting . AppSubURL )
2016-11-27 13:14:25 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/login" )
2016-03-04 17:15:11 +03:00
return
2015-11-19 07:52:09 +03:00
}
2016-03-11 19:56:52 +03:00
if options . AdminRequired {
2014-03-22 21:44:02 +04:00
if ! ctx . User . IsAdmin {
ctx . Error ( 403 )
return
}
2014-03-22 22:27:03 +04:00
ctx . Data [ "PageIsAdmin" ] = true
2014-03-15 15:01:50 +04:00
}
}
}