2022-01-02 16:12:35 +03:00
// Copyright 2014 The Gogs Authors. All rights reserved.
// Copyright 2018 The Gitea Authors. All rights reserved.
2022-11-27 21:20:29 +03:00
// SPDX-License-Identifier: MIT
2022-01-02 16:12:35 +03:00
package auth
import (
2022-10-19 22:07:21 +03:00
"errors"
2022-01-02 16:12:35 +03:00
"fmt"
2024-02-26 00:55:00 +03:00
"html/template"
2022-01-02 16:12:35 +03:00
"net/http"
"strings"
"code.gitea.io/gitea/models/auth"
"code.gitea.io/gitea/models/db"
user_model "code.gitea.io/gitea/models/user"
2023-02-19 10:35:20 +03:00
"code.gitea.io/gitea/modules/auth/password"
2022-01-02 16:12:35 +03:00
"code.gitea.io/gitea/modules/base"
"code.gitea.io/gitea/modules/eventsource"
2024-03-21 23:32:40 +03:00
"code.gitea.io/gitea/modules/httplib"
2022-01-02 16:12:35 +03:00
"code.gitea.io/gitea/modules/log"
2024-02-04 16:29:09 +03:00
"code.gitea.io/gitea/modules/optional"
2022-01-02 16:12:35 +03:00
"code.gitea.io/gitea/modules/session"
"code.gitea.io/gitea/modules/setting"
"code.gitea.io/gitea/modules/timeutil"
2022-10-19 22:07:21 +03:00
"code.gitea.io/gitea/modules/util"
2022-01-02 16:12:35 +03:00
"code.gitea.io/gitea/modules/web"
"code.gitea.io/gitea/modules/web/middleware"
auth_service "code.gitea.io/gitea/services/auth"
"code.gitea.io/gitea/services/auth/source/oauth2"
2024-02-27 10:12:22 +03:00
"code.gitea.io/gitea/services/context"
2022-01-02 16:12:35 +03:00
"code.gitea.io/gitea/services/externalaccount"
"code.gitea.io/gitea/services/forms"
"code.gitea.io/gitea/services/mailer"
2024-02-04 16:29:09 +03:00
user_service "code.gitea.io/gitea/services/user"
2022-01-02 16:12:35 +03:00
"github.com/markbates/goth"
)
const (
2024-02-26 00:55:00 +03:00
tplSignIn base . TplName = "user/auth/signin" // for sign in page
tplSignUp base . TplName = "user/auth/signup" // for sign up page
TplActivate base . TplName = "user/auth/activate" // for activate user
TplActivatePrompt base . TplName = "user/auth/activate_prompt" // for showing a message for user activation
2022-01-02 16:12:35 +03:00
)
2023-10-14 03:56:41 +03:00
// autoSignIn reads cookie and try to auto-login.
func autoSignIn ( ctx * context . Context ) ( bool , error ) {
2022-01-02 16:12:35 +03:00
isSucceed := false
defer func ( ) {
if ! isSucceed {
2023-04-13 22:45:33 +03:00
ctx . DeleteSiteCookie ( setting . CookieRememberName )
2022-01-02 16:12:35 +03:00
}
} ( )
2023-10-14 03:56:41 +03:00
if err := auth . DeleteExpiredAuthTokens ( ctx ) ; err != nil {
log . Error ( "Failed to delete expired auth tokens: %v" , err )
}
t , err := auth_service . CheckAuthToken ( ctx , ctx . GetSiteCookie ( setting . CookieRememberName ) )
2022-01-02 16:12:35 +03:00
if err != nil {
2023-10-14 03:56:41 +03:00
switch err {
case auth_service . ErrAuthTokenInvalidFormat , auth_service . ErrAuthTokenExpired :
return false , nil
2022-01-02 16:12:35 +03:00
}
2023-10-14 03:56:41 +03:00
return false , err
}
if t == nil {
2022-01-02 16:12:35 +03:00
return false , nil
}
2023-10-14 03:56:41 +03:00
u , err := user_model . GetUserByID ( ctx , t . UserID )
if err != nil {
if ! user_model . IsErrUserNotExist ( err ) {
return false , fmt . Errorf ( "GetUserByID: %w" , err )
}
2022-01-02 16:12:35 +03:00
return false , nil
}
isSucceed = true
2023-10-14 03:56:41 +03:00
nt , token , err := auth_service . RegenerateAuthToken ( ctx , t )
if err != nil {
return false , err
}
ctx . SetSiteCookie ( setting . CookieRememberName , nt . ID + ":" + token , setting . LogInRememberDays * timeutil . Day )
2023-07-04 21:36:08 +03:00
if err := updateSession ( ctx , nil , map [ string ] any {
2022-11-10 14:43:06 +03:00
// Set session IDs
"uid" : u . ID ,
"uname" : u . Name ,
} ) ; err != nil {
return false , fmt . Errorf ( "unable to updateSession: %w" , err )
2022-01-02 16:12:35 +03:00
}
if err := resetLocale ( ctx , u ) ; err != nil {
return false , err
}
2023-04-13 22:45:33 +03:00
ctx . Csrf . DeleteCookie ( ctx )
2022-01-02 16:12:35 +03:00
return true , nil
}
func resetLocale ( ctx * context . Context , u * user_model . User ) error {
// Language setting of the user overwrites the one previously set
// If the user does not have a locale set, we save the current one.
2024-02-04 16:29:09 +03:00
if u . Language == "" {
opts := & user_service . UpdateOptions {
Language : optional . Some ( ctx . Locale . Language ( ) ) ,
}
if err := user_service . UpdateUser ( ctx , u , opts ) ; err != nil {
2022-01-02 16:12:35 +03:00
return err
}
}
middleware . SetLocaleCookie ( ctx . Resp , u . Language , 0 )
if ctx . Locale . Language ( ) != u . Language {
ctx . Locale = middleware . Locale ( ctx . Resp , ctx . Req )
}
return nil
}
2024-03-05 05:12:03 +03:00
func RedirectAfterLogin ( ctx * context . Context ) {
redirectTo := ctx . FormString ( "redirect_to" )
if redirectTo == "" {
redirectTo = ctx . GetSiteCookie ( "redirect_to" )
}
middleware . DeleteRedirectToCookie ( ctx . Resp )
nextRedirectTo := setting . AppSubURL + string ( setting . LandingPageURL )
if setting . LandingPageURL == setting . LandingPageLogin {
nextRedirectTo = setting . AppSubURL + "/" // do not cycle-redirect to the login page
}
2024-03-21 15:02:34 +03:00
ctx . RedirectToCurrentSite ( redirectTo , nextRedirectTo )
2024-03-05 05:12:03 +03:00
}
2023-10-14 03:56:41 +03:00
func CheckAutoLogin ( ctx * context . Context ) bool {
2024-03-05 05:12:03 +03:00
isSucceed , err := autoSignIn ( ctx ) // try to auto-login
2022-01-02 16:12:35 +03:00
if err != nil {
2023-10-14 03:56:41 +03:00
if errors . Is ( err , auth_service . ErrAuthTokenInvalidHash ) {
ctx . Flash . Error ( ctx . Tr ( "auth.remember_me.compromised" ) , true )
return false
}
ctx . ServerError ( "autoSignIn" , err )
2022-01-02 16:12:35 +03:00
return true
}
redirectTo := ctx . FormString ( "redirect_to" )
if len ( redirectTo ) > 0 {
middleware . SetRedirectToCookie ( ctx . Resp , redirectTo )
}
if isSucceed {
2024-03-05 05:12:03 +03:00
RedirectAfterLogin ( ctx )
2022-01-02 16:12:35 +03:00
return true
}
return false
}
// SignIn render sign in page
func SignIn ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
2023-10-14 03:56:41 +03:00
if CheckAutoLogin ( ctx ) {
2022-01-02 16:12:35 +03:00
return
}
2024-03-05 05:12:03 +03:00
if ctx . IsSigned {
RedirectAfterLogin ( ctx )
return
}
2024-03-02 18:42:31 +03:00
oauth2Providers , err := oauth2 . GetOAuth2Providers ( ctx , optional . Some ( true ) )
2022-01-02 16:12:35 +03:00
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/login"
ctx . Data [ "PageIsSignIn" ] = true
ctx . Data [ "PageIsLogin" ] = true
2023-10-11 07:24:07 +03:00
ctx . Data [ "EnableSSPI" ] = auth . IsSSPIEnabled ( ctx )
2022-01-02 16:12:35 +03:00
2022-11-23 00:13:18 +03:00
if setting . Service . EnableCaptcha && setting . Service . RequireCaptchaForLogin {
context . SetCaptchaData ( ctx )
}
2022-01-02 16:12:35 +03:00
ctx . HTML ( http . StatusOK , tplSignIn )
}
// SignInPost response for sign in request
func SignInPost ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
2024-03-02 18:42:31 +03:00
oauth2Providers , err := oauth2 . GetOAuth2Providers ( ctx , optional . Some ( true ) )
2022-01-02 16:12:35 +03:00
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
ctx . Data [ "Title" ] = ctx . Tr ( "sign_in" )
ctx . Data [ "SignInLink" ] = setting . AppSubURL + "/user/login"
ctx . Data [ "PageIsSignIn" ] = true
ctx . Data [ "PageIsLogin" ] = true
2023-10-11 07:24:07 +03:00
ctx . Data [ "EnableSSPI" ] = auth . IsSSPIEnabled ( ctx )
2022-01-02 16:12:35 +03:00
if ctx . HasError ( ) {
ctx . HTML ( http . StatusOK , tplSignIn )
return
}
form := web . GetForm ( ctx ) . ( * forms . SignInForm )
2022-11-23 00:13:18 +03:00
if setting . Service . EnableCaptcha && setting . Service . RequireCaptchaForLogin {
context . SetCaptchaData ( ctx )
context . VerifyCaptcha ( ctx , tplSignIn , form )
if ctx . Written ( ) {
return
}
}
2023-09-14 20:09:32 +03:00
u , source , err := auth_service . UserSignIn ( ctx , form . UserName , form . Password )
2022-01-02 16:12:35 +03:00
if err != nil {
2023-07-04 01:39:38 +03:00
if errors . Is ( err , util . ErrNotExist ) || errors . Is ( err , util . ErrInvalidArgument ) {
2022-01-02 16:12:35 +03:00
ctx . RenderWithErr ( ctx . Tr ( "form.username_password_incorrect" ) , tplSignIn , & form )
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
} else if user_model . IsErrEmailAlreadyUsed ( err ) {
ctx . RenderWithErr ( ctx . Tr ( "form.email_been_used" ) , tplSignIn , & form )
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
} else if user_model . IsErrUserProhibitLogin ( err ) {
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( http . StatusOK , "user/auth/prohibit_login" )
} else if user_model . IsErrUserInactive ( err ) {
if setting . Service . RegisterEmailConfirm {
ctx . Data [ "Title" ] = ctx . Tr ( "auth.active_your_account" )
ctx . HTML ( http . StatusOK , TplActivate )
} else {
log . Info ( "Failed authentication attempt for %s from %s: %v" , form . UserName , ctx . RemoteAddr ( ) , err )
ctx . Data [ "Title" ] = ctx . Tr ( "auth.prohibit_login" )
ctx . HTML ( http . StatusOK , "user/auth/prohibit_login" )
}
} else {
ctx . ServerError ( "UserSignIn" , err )
}
return
}
// Now handle 2FA:
// First of all if the source can skip local two fa we're done
if skipper , ok := source . Cfg . ( auth_service . LocalTwoFASkipper ) ; ok && skipper . IsSkipLocalTwoFA ( ) {
handleSignIn ( ctx , u , form . Remember )
return
}
// If this user is enrolled in 2FA TOTP, we can't sign the user in just yet.
// Instead, redirect them to the 2FA authentication page.
2023-09-15 09:13:19 +03:00
hasTOTPtwofa , err := auth . HasTwoFactorByUID ( ctx , u . ID )
2022-01-02 16:12:35 +03:00
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
2022-01-14 18:03:31 +03:00
// Check if the user has webauthn registration
2023-09-16 17:39:12 +03:00
hasWebAuthnTwofa , err := auth . HasWebAuthnRegistrationsByUID ( ctx , u . ID )
2022-01-02 16:12:35 +03:00
if err != nil {
ctx . ServerError ( "UserSignIn" , err )
return
}
2022-01-14 18:03:31 +03:00
if ! hasTOTPtwofa && ! hasWebAuthnTwofa {
2022-01-02 16:12:35 +03:00
// No two factor auth configured we can sign in the user
handleSignIn ( ctx , u , form . Remember )
return
}
2023-07-04 21:36:08 +03:00
updates := map [ string ] any {
2022-11-10 14:43:06 +03:00
// User will need to use 2FA TOTP or WebAuthn, save data
"twofaUid" : u . ID ,
"twofaRemember" : form . Remember ,
2022-01-02 16:12:35 +03:00
}
if hasTOTPtwofa {
2022-06-27 05:20:58 +03:00
// User will need to use WebAuthn, save data
2022-11-10 14:43:06 +03:00
updates [ "totpEnrolled" ] = u . ID
2022-01-02 16:12:35 +03:00
}
2022-11-10 14:43:06 +03:00
if err := updateSession ( ctx , nil , updates ) ; err != nil {
ctx . ServerError ( "UserSignIn: Unable to update session" , err )
2022-01-02 16:12:35 +03:00
return
}
2022-06-27 05:20:58 +03:00
// If we have WebAuthn redirect there first
2022-01-14 18:03:31 +03:00
if hasWebAuthnTwofa {
ctx . Redirect ( setting . AppSubURL + "/user/webauthn" )
2022-01-02 16:12:35 +03:00
return
}
// Fallback to 2FA
ctx . Redirect ( setting . AppSubURL + "/user/two_factor" )
}
// This handles the final part of the sign-in process of the user.
func handleSignIn ( ctx * context . Context , u * user_model . User , remember bool ) {
redirect := handleSignInFull ( ctx , u , remember , true )
if ctx . Written ( ) {
return
}
ctx . Redirect ( redirect )
}
2022-01-20 20:46:10 +03:00
func handleSignInFull ( ctx * context . Context , u * user_model . User , remember , obeyRedirect bool ) string {
2022-01-02 16:12:35 +03:00
if remember {
2023-10-14 03:56:41 +03:00
nt , token , err := auth_service . CreateAuthTokenForUserID ( ctx , u . ID )
if err != nil {
ctx . ServerError ( "CreateAuthTokenForUserID" , err )
return setting . AppSubURL + "/"
}
ctx . SetSiteCookie ( setting . CookieRememberName , nt . ID + ":" + token , setting . LogInRememberDays * timeutil . Day )
2022-01-02 16:12:35 +03:00
}
2022-11-10 14:43:06 +03:00
if err := updateSession ( ctx , [ ] string {
// Delete the openid, 2fa and linkaccount data
"openid_verified_uri" ,
"openid_signin_remember" ,
"openid_determined_email" ,
"openid_determined_username" ,
"twofaUid" ,
"twofaRemember" ,
"linkAccount" ,
2023-07-04 21:36:08 +03:00
} , map [ string ] any {
2022-11-10 14:43:06 +03:00
"uid" : u . ID ,
"uname" : u . Name ,
} ) ; err != nil {
2022-01-02 16:12:35 +03:00
ctx . ServerError ( "RegenerateSession" , err )
return setting . AppSubURL + "/"
}
// Language setting of the user overwrites the one previously set
// If the user does not have a locale set, we save the current one.
2024-02-04 16:29:09 +03:00
if u . Language == "" {
opts := & user_service . UpdateOptions {
Language : optional . Some ( ctx . Locale . Language ( ) ) ,
}
if err := user_service . UpdateUser ( ctx , u , opts ) ; err != nil {
ctx . ServerError ( "UpdateUser Language" , fmt . Errorf ( "Error updating user language [user: %d, locale: %s]" , u . ID , ctx . Locale . Language ( ) ) )
2022-01-02 16:12:35 +03:00
return setting . AppSubURL + "/"
}
}
middleware . SetLocaleCookie ( ctx . Resp , u . Language , 0 )
if ctx . Locale . Language ( ) != u . Language {
ctx . Locale = middleware . Locale ( ctx . Resp , ctx . Req )
}
2022-04-08 08:21:05 +03:00
// Clear whatever CSRF cookie has right now, force to generate a new one
2023-04-13 22:45:33 +03:00
ctx . Csrf . DeleteCookie ( ctx )
2022-01-02 16:12:35 +03:00
// Register last login
2024-02-04 16:29:09 +03:00
if err := user_service . UpdateUser ( ctx , u , & user_service . UpdateOptions { SetLastLogin : true } ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
2022-01-02 16:12:35 +03:00
return setting . AppSubURL + "/"
}
2024-05-07 11:26:13 +03:00
if redirectTo := ctx . GetSiteCookie ( "redirect_to" ) ; redirectTo != "" && httplib . IsCurrentGiteaSiteURL ( ctx , redirectTo ) {
2022-01-02 16:12:35 +03:00
middleware . DeleteRedirectToCookie ( ctx . Resp )
if obeyRedirect {
2024-03-21 15:02:34 +03:00
ctx . RedirectToCurrentSite ( redirectTo )
2022-01-02 16:12:35 +03:00
}
return redirectTo
}
if obeyRedirect {
ctx . Redirect ( setting . AppSubURL + "/" )
}
return setting . AppSubURL + "/"
}
2024-04-25 14:22:32 +03:00
// extractUserNameFromOAuth2 tries to extract a normalized username from the given OAuth2 user.
// It returns ("", nil) if the required field doesn't exist.
func extractUserNameFromOAuth2 ( gothUser * goth . User ) ( string , error ) {
2022-01-02 16:12:35 +03:00
switch setting . OAuth2Client . Username {
case setting . OAuth2UsernameEmail :
2024-04-25 14:22:32 +03:00
return user_model . NormalizeUserName ( gothUser . Email )
2024-04-16 08:41:39 +03:00
case setting . OAuth2UsernamePreferredUsername :
2024-04-25 14:22:32 +03:00
if preferredUsername , ok := gothUser . RawData [ "preferred_username" ] . ( string ) ; ok {
return user_model . NormalizeUserName ( preferredUsername )
2024-04-16 08:41:39 +03:00
}
2024-04-25 14:22:32 +03:00
return "" , nil
2022-01-02 16:12:35 +03:00
case setting . OAuth2UsernameNickname :
2024-01-04 03:48:20 +03:00
return user_model . NormalizeUserName ( gothUser . NickName )
2022-01-02 16:12:35 +03:00
default : // OAuth2UsernameUserid
2024-01-04 03:48:20 +03:00
return gothUser . UserID , nil
2022-01-02 16:12:35 +03:00
}
}
// HandleSignOut resets the session and sets the cookies
func HandleSignOut ( ctx * context . Context ) {
_ = ctx . Session . Flush ( )
_ = ctx . Session . Destroy ( ctx . Resp , ctx . Req )
2023-04-13 22:45:33 +03:00
ctx . DeleteSiteCookie ( setting . CookieRememberName )
ctx . Csrf . DeleteCookie ( ctx )
2022-01-02 16:12:35 +03:00
middleware . DeleteRedirectToCookie ( ctx . Resp )
}
// SignOut sign out from login status
func SignOut ( ctx * context . Context ) {
2022-03-22 10:03:22 +03:00
if ctx . Doer != nil {
eventsource . GetManager ( ) . SendMessageBlocking ( ctx . Doer . ID , & eventsource . Event {
2022-01-02 16:12:35 +03:00
Name : "logout" ,
Data : ctx . Session . ID ( ) ,
} )
}
HandleSignOut ( ctx )
2023-06-26 22:36:10 +03:00
ctx . JSONRedirect ( setting . AppSubURL + "/" )
2022-01-02 16:12:35 +03:00
}
// SignUp render the register page
func SignUp ( ctx * context . Context ) {
ctx . Data [ "Title" ] = ctx . Tr ( "sign_up" )
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/sign_up"
2024-03-02 18:42:31 +03:00
oauth2Providers , err := oauth2 . GetOAuth2Providers ( ctx , optional . Some ( true ) )
2023-09-13 08:14:21 +03:00
if err != nil {
ctx . ServerError ( "UserSignUp" , err )
return
}
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
2022-11-23 00:13:18 +03:00
context . SetCaptchaData ( ctx )
2023-09-13 08:14:21 +03:00
2022-01-02 16:12:35 +03:00
ctx . Data [ "PageIsSignUp" ] = true
2022-01-20 20:46:10 +03:00
// Show Disabled Registration message if DisableRegistration or AllowOnlyExternalRegistration options are true
2022-01-02 16:12:35 +03:00
ctx . Data [ "DisableRegistration" ] = setting . Service . DisableRegistration || setting . Service . AllowOnlyExternalRegistration
2023-08-31 19:26:13 +03:00
redirectTo := ctx . FormString ( "redirect_to" )
if len ( redirectTo ) > 0 {
middleware . SetRedirectToCookie ( ctx . Resp , redirectTo )
}
2022-01-02 16:12:35 +03:00
ctx . HTML ( http . StatusOK , tplSignUp )
}
// SignUpPost response for sign up information submission
func SignUpPost ( ctx * context . Context ) {
form := web . GetForm ( ctx ) . ( * forms . RegisterForm )
ctx . Data [ "Title" ] = ctx . Tr ( "sign_up" )
ctx . Data [ "SignUpLink" ] = setting . AppSubURL + "/user/sign_up"
2024-03-02 18:42:31 +03:00
oauth2Providers , err := oauth2 . GetOAuth2Providers ( ctx , optional . Some ( true ) )
2023-09-13 08:14:21 +03:00
if err != nil {
ctx . ServerError ( "UserSignUp" , err )
return
}
ctx . Data [ "OAuth2Providers" ] = oauth2Providers
2022-11-23 00:13:18 +03:00
context . SetCaptchaData ( ctx )
2023-09-13 08:14:21 +03:00
2022-01-02 16:12:35 +03:00
ctx . Data [ "PageIsSignUp" ] = true
2022-01-20 20:46:10 +03:00
// Permission denied if DisableRegistration or AllowOnlyExternalRegistration options are true
2022-01-02 16:12:35 +03:00
if setting . Service . DisableRegistration || setting . Service . AllowOnlyExternalRegistration {
ctx . Error ( http . StatusForbidden )
return
}
if ctx . HasError ( ) {
ctx . HTML ( http . StatusOK , tplSignUp )
return
}
2022-11-23 00:13:18 +03:00
context . VerifyCaptcha ( ctx , tplSignUp , form )
if ctx . Written ( ) {
return
2022-01-02 16:12:35 +03:00
}
if ! form . IsEmailDomainAllowed ( ) {
ctx . RenderWithErr ( ctx . Tr ( "auth.email_domain_blacklisted" ) , tplSignUp , & form )
return
}
if form . Password != form . Retype {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.password_not_match" ) , tplSignUp , & form )
return
}
if len ( form . Password ) < setting . MinPasswordLength {
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( ctx . Tr ( "auth.password_too_short" , setting . MinPasswordLength ) , tplSignUp , & form )
return
}
if ! password . IsComplexEnough ( form . Password ) {
ctx . Data [ "Err_Password" ] = true
2023-05-08 12:36:54 +03:00
ctx . RenderWithErr ( password . BuildComplexityError ( ctx . Locale ) , tplSignUp , & form )
2022-01-02 16:12:35 +03:00
return
}
2024-02-04 16:29:09 +03:00
if err := password . IsPwned ( ctx , form . Password ) ; err != nil {
2022-01-02 16:12:35 +03:00
errMsg := ctx . Tr ( "auth.password_pwned" )
2024-02-04 16:29:09 +03:00
if password . IsErrIsPwnedRequest ( err ) {
2022-01-02 16:12:35 +03:00
log . Error ( err . Error ( ) )
errMsg = ctx . Tr ( "auth.password_pwned_err" )
}
ctx . Data [ "Err_Password" ] = true
ctx . RenderWithErr ( errMsg , tplSignUp , & form )
return
}
u := & user_model . User {
2022-04-29 22:38:11 +03:00
Name : form . UserName ,
Email : form . Email ,
Passwd : form . Password ,
2022-01-02 16:12:35 +03:00
}
2024-02-24 07:18:49 +03:00
if ! createAndHandleCreatedUser ( ctx , tplSignUp , form , u , nil , nil , false ) {
2022-01-02 16:12:35 +03:00
// error already handled
return
}
ctx . Flash . Success ( ctx . Tr ( "auth.sign_up_successful" ) )
handleSignIn ( ctx , u , false )
}
// createAndHandleCreatedUser calls createUserInContext and
// then handleUserCreated.
2024-02-24 07:18:49 +03:00
func createAndHandleCreatedUser ( ctx * context . Context , tpl base . TplName , form any , u * user_model . User , overwrites * user_model . CreateUserOverwriteOptions , gothUser * goth . User , allowLink bool ) bool {
if ! createUserInContext ( ctx , tpl , form , u , overwrites , gothUser , allowLink ) {
2022-01-02 16:12:35 +03:00
return false
}
2024-02-24 07:18:49 +03:00
return handleUserCreated ( ctx , u , gothUser )
2022-01-02 16:12:35 +03:00
}
// createUserInContext creates a user and handles errors within a given context.
// Optionally a template can be specified.
2024-02-24 07:18:49 +03:00
func createUserInContext ( ctx * context . Context , tpl base . TplName , form any , u * user_model . User , overwrites * user_model . CreateUserOverwriteOptions , gothUser * goth . User , allowLink bool ) ( ok bool ) {
2023-09-14 20:09:32 +03:00
if err := user_model . CreateUser ( ctx , u , overwrites ) ; err != nil {
2022-01-02 16:12:35 +03:00
if allowLink && ( user_model . IsErrUserAlreadyExist ( err ) || user_model . IsErrEmailAlreadyUsed ( err ) ) {
if setting . OAuth2Client . AccountLinking == setting . OAuth2AccountLinkingAuto {
var user * user_model . User
user = & user_model . User { Name : u . Name }
2023-09-14 20:09:32 +03:00
hasUser , err := user_model . GetUser ( ctx , user )
2022-01-02 16:12:35 +03:00
if ! hasUser || err != nil {
user = & user_model . User { Email : u . Email }
2023-09-14 20:09:32 +03:00
hasUser , err = user_model . GetUser ( ctx , user )
2022-01-02 16:12:35 +03:00
if ! hasUser || err != nil {
ctx . ServerError ( "UserLinkAccount" , err )
2023-07-07 08:31:56 +03:00
return false
2022-01-02 16:12:35 +03:00
}
}
// TODO: probably we should respect 'remember' user's choice...
2024-02-24 07:18:49 +03:00
linkAccount ( ctx , user , * gothUser , true )
2023-07-07 08:31:56 +03:00
return false // user is already created here, all redirects are handled
2022-01-02 16:12:35 +03:00
} else if setting . OAuth2Client . AccountLinking == setting . OAuth2AccountLinkingLogin {
2024-02-24 07:18:49 +03:00
showLinkingLogin ( ctx , * gothUser )
2023-07-07 08:31:56 +03:00
return false // user will be created only after linking login
2022-01-02 16:12:35 +03:00
}
}
// handle error without template
if len ( tpl ) == 0 {
ctx . ServerError ( "CreateUser" , err )
2023-07-07 08:31:56 +03:00
return false
2022-01-02 16:12:35 +03:00
}
// handle error with template
switch {
case user_model . IsErrUserAlreadyExist ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.username_been_taken" ) , tpl , form )
case user_model . IsErrEmailAlreadyUsed ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_been_used" ) , tpl , form )
2022-03-14 20:39:54 +03:00
case user_model . IsErrEmailCharIsNotSupported ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_invalid" ) , tpl , form )
2022-01-02 16:12:35 +03:00
case user_model . IsErrEmailInvalid ( err ) :
ctx . Data [ "Err_Email" ] = true
ctx . RenderWithErr ( ctx . Tr ( "form.email_invalid" ) , tpl , form )
case db . IsErrNameReserved ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_reserved" , err . ( db . ErrNameReserved ) . Name ) , tpl , form )
case db . IsErrNamePatternNotAllowed ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_pattern_not_allowed" , err . ( db . ErrNamePatternNotAllowed ) . Pattern ) , tpl , form )
case db . IsErrNameCharsNotAllowed ( err ) :
ctx . Data [ "Err_UserName" ] = true
ctx . RenderWithErr ( ctx . Tr ( "user.form.name_chars_not_allowed" , err . ( db . ErrNameCharsNotAllowed ) . Name ) , tpl , form )
default :
ctx . ServerError ( "CreateUser" , err )
}
2023-07-07 08:31:56 +03:00
return false
2022-01-02 16:12:35 +03:00
}
log . Trace ( "Account created: %s" , u . Name )
return true
}
// handleUserCreated does additional steps after a new user is created.
// It auto-sets admin for the only user, updates the optional external user and
// sends a confirmation email if required.
2024-02-24 07:18:49 +03:00
func handleUserCreated ( ctx * context . Context , u * user_model . User , gothUser * goth . User ) ( ok bool ) {
2022-01-02 16:12:35 +03:00
// Auto-set admin for the only user.
2023-09-14 20:09:32 +03:00
if user_model . CountUsers ( ctx , nil ) == 1 {
2024-02-04 16:29:09 +03:00
opts := & user_service . UpdateOptions {
IsActive : optional . Some ( true ) ,
IsAdmin : optional . Some ( true ) ,
SetLastLogin : true ,
}
if err := user_service . UpdateUser ( ctx , u , opts ) ; err != nil {
2022-01-02 16:12:35 +03:00
ctx . ServerError ( "UpdateUser" , err )
2023-07-07 08:31:56 +03:00
return false
2022-01-02 16:12:35 +03:00
}
}
// update external user information
if gothUser != nil {
2024-02-24 07:18:49 +03:00
if err := externalaccount . UpdateExternalUser ( ctx , u , * gothUser ) ; err != nil {
2022-10-19 22:07:21 +03:00
if ! errors . Is ( err , util . ErrNotExist ) {
log . Error ( "UpdateExternalUser failed: %v" , err )
}
2022-01-02 16:12:35 +03:00
}
}
2024-02-26 00:55:00 +03:00
// for active user or the first (admin) user, we don't need to send confirmation email
if u . IsActive || u . ID == 1 {
return true
}
2022-03-18 12:57:07 +03:00
2024-02-26 00:55:00 +03:00
if setting . Service . RegisterManualConfirm {
renderActivationPromptMessage ( ctx , ctx . Locale . Tr ( "auth.manual_activation_only" ) )
return false
}
2022-01-02 16:12:35 +03:00
2024-02-26 00:55:00 +03:00
sendActivateEmail ( ctx , u )
return false
}
2022-01-02 16:12:35 +03:00
2024-02-26 00:55:00 +03:00
func renderActivationPromptMessage ( ctx * context . Context , msg template . HTML ) {
ctx . Data [ "ActivationPromptMessage" ] = msg
ctx . HTML ( http . StatusOK , TplActivatePrompt )
}
func sendActivateEmail ( ctx * context . Context , u * user_model . User ) {
if ctx . Cache . IsExist ( "MailResendLimit_" + u . LowerName ) {
renderActivationPromptMessage ( ctx , ctx . Locale . Tr ( "auth.resent_limit_prompt" ) )
return
2022-01-02 16:12:35 +03:00
}
2024-02-26 00:55:00 +03:00
if err := ctx . Cache . Put ( "MailResendLimit_" + u . LowerName , u . LowerName , 180 ) ; err != nil {
log . Error ( "Set cache(MailResendLimit) fail: %v" , err )
renderActivationPromptMessage ( ctx , ctx . Locale . Tr ( "auth.resent_limit_prompt" ) )
return
}
mailer . SendActivateAccountMail ( ctx . Locale , u )
activeCodeLives := timeutil . MinutesToFriendly ( setting . Service . ActiveCodeLives , ctx . Locale )
2024-02-27 13:55:13 +03:00
msgHTML := ctx . Locale . Tr ( "auth.confirmation_mail_sent_prompt_ex" , u . Email , activeCodeLives )
2024-02-26 00:55:00 +03:00
renderActivationPromptMessage ( ctx , msgHTML )
}
func renderActivationVerifyPassword ( ctx * context . Context , code string ) {
ctx . Data [ "ActivationCode" ] = code
ctx . Data [ "NeedVerifyLocalPassword" ] = true
ctx . HTML ( http . StatusOK , TplActivate )
2022-01-02 16:12:35 +03:00
}
2024-02-27 13:55:13 +03:00
func renderActivationChangeEmail ( ctx * context . Context ) {
ctx . HTML ( http . StatusOK , TplActivate )
}
2022-01-02 16:12:35 +03:00
// Activate render activate user page
func Activate ( ctx * context . Context ) {
code := ctx . FormString ( "code" )
2024-02-26 00:55:00 +03:00
if code == "" {
if ctx . Doer == nil {
ctx . Redirect ( setting . AppSubURL + "/user/login" )
return
} else if ctx . Doer . IsActive {
ctx . Redirect ( setting . AppSubURL + "/" )
2022-01-02 16:12:35 +03:00
return
}
2024-02-26 00:55:00 +03:00
if setting . MailService == nil || ! setting . Service . RegisterEmailConfirm {
renderActivationPromptMessage ( ctx , ctx . Tr ( "auth.disable_register_mail" ) )
return
2022-01-02 16:12:35 +03:00
}
2024-02-26 00:55:00 +03:00
2024-02-27 13:55:13 +03:00
// Resend confirmation email. FIXME: ideally this should be in a POST request
2024-02-26 00:55:00 +03:00
sendActivateEmail ( ctx , ctx . Doer )
2022-01-02 16:12:35 +03:00
return
}
2024-02-26 00:55:00 +03:00
// TODO: ctx.Doer/ctx.Data["SignedUser"] could be nil or not the same user as the one being activated
2023-09-14 20:09:32 +03:00
user := user_model . VerifyUserActiveCode ( ctx , code )
2024-02-26 00:55:00 +03:00
if user == nil { // if code is wrong
renderActivationPromptMessage ( ctx , ctx . Locale . Tr ( "auth.invalid_code" ) )
2022-01-02 16:12:35 +03:00
return
}
// if account is local account, verify password
if user . LoginSource == 0 {
2024-02-26 00:55:00 +03:00
renderActivationVerifyPassword ( ctx , code )
2022-01-02 16:12:35 +03:00
return
}
handleAccountActivation ( ctx , user )
}
// ActivatePost handles account activation with password check
func ActivatePost ( ctx * context . Context ) {
code := ctx . FormString ( "code" )
2024-02-27 13:55:13 +03:00
if ctx . Doer != nil && ctx . Doer . IsActive {
ctx . Redirect ( setting . AppSubURL + "/user/activate" ) // it will redirect again to the correct page
return
}
if code == "" {
newEmail := strings . TrimSpace ( ctx . FormString ( "change_email" ) )
if ctx . Doer != nil && newEmail != "" && ! strings . EqualFold ( ctx . Doer . Email , newEmail ) {
if user_model . ValidateEmail ( newEmail ) != nil {
ctx . Flash . Error ( ctx . Locale . Tr ( "form.email_invalid" ) , true )
renderActivationChangeEmail ( ctx )
return
}
err := user_model . ChangeInactivePrimaryEmail ( ctx , ctx . Doer . ID , ctx . Doer . Email , newEmail )
if err != nil {
ctx . Flash . Error ( ctx . Locale . Tr ( "admin.emails.not_updated" , newEmail ) , true )
renderActivationChangeEmail ( ctx )
return
}
ctx . Doer . Email = newEmail
}
// FIXME: at the moment, GET request handles the "send confirmation email" action. But the old code does this redirect and then send a confirmation email.
2022-01-02 16:12:35 +03:00
ctx . Redirect ( setting . AppSubURL + "/user/activate" )
return
}
2024-02-26 00:55:00 +03:00
// TODO: ctx.Doer/ctx.Data["SignedUser"] could be nil or not the same user as the one being activated
2023-09-14 20:09:32 +03:00
user := user_model . VerifyUserActiveCode ( ctx , code )
2024-02-26 00:55:00 +03:00
if user == nil { // if code is wrong
renderActivationPromptMessage ( ctx , ctx . Locale . Tr ( "auth.invalid_code" ) )
2022-01-02 16:12:35 +03:00
return
}
// if account is local account, verify password
if user . LoginSource == 0 {
password := ctx . FormString ( "password" )
2024-02-26 00:55:00 +03:00
if password == "" {
renderActivationVerifyPassword ( ctx , code )
2022-01-02 16:12:35 +03:00
return
}
if ! user . ValidatePassword ( password ) {
2024-02-26 00:55:00 +03:00
ctx . Flash . Error ( ctx . Locale . Tr ( "auth.invalid_password" ) , true )
renderActivationVerifyPassword ( ctx , code )
2022-01-02 16:12:35 +03:00
return
}
}
handleAccountActivation ( ctx , user )
}
func handleAccountActivation ( ctx * context . Context , user * user_model . User ) {
user . IsActive = true
var err error
if user . Rands , err = user_model . GetUserSalt ( ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
return
}
2022-03-22 18:22:54 +03:00
if err := user_model . UpdateUserCols ( ctx , user , "is_active" , "rands" ) ; err != nil {
2022-01-02 16:12:35 +03:00
if user_model . IsErrUserNotExist ( err ) {
ctx . NotFound ( "UpdateUserCols" , err )
} else {
ctx . ServerError ( "UpdateUser" , err )
}
return
}
2023-09-14 20:09:32 +03:00
if err := user_model . ActivateUserEmail ( ctx , user . ID , user . Email , true ) ; err != nil {
2022-01-02 16:12:35 +03:00
log . Error ( "Unable to activate email for user: %-v with email: %s: %v" , user , user . Email , err )
ctx . ServerError ( "ActivateUserEmail" , err )
return
}
log . Trace ( "User activated: %s" , user . Name )
2023-07-04 21:36:08 +03:00
if err := updateSession ( ctx , nil , map [ string ] any {
2022-11-10 14:43:06 +03:00
"uid" : user . ID ,
"uname" : user . Name ,
} ) ; err != nil {
2022-01-02 16:12:35 +03:00
log . Error ( "Unable to regenerate session for user: %-v with email: %s: %v" , user , user . Email , err )
ctx . ServerError ( "ActivateUserEmail" , err )
return
}
if err := resetLocale ( ctx , user ) ; err != nil {
ctx . ServerError ( "resetLocale" , err )
return
}
2024-02-04 16:29:09 +03:00
if err := user_service . UpdateUser ( ctx , user , & user_service . UpdateOptions { SetLastLogin : true } ) ; err != nil {
ctx . ServerError ( "UpdateUser" , err )
2022-11-09 19:42:06 +03:00
return
}
2022-01-02 16:12:35 +03:00
ctx . Flash . Success ( ctx . Tr ( "auth.account_activated" ) )
2023-08-31 19:26:13 +03:00
if redirectTo := ctx . GetSiteCookie ( "redirect_to" ) ; len ( redirectTo ) > 0 {
middleware . DeleteRedirectToCookie ( ctx . Resp )
2024-03-21 15:02:34 +03:00
ctx . RedirectToCurrentSite ( redirectTo )
2023-08-31 19:26:13 +03:00
return
}
2022-01-02 16:12:35 +03:00
ctx . Redirect ( setting . AppSubURL + "/" )
}
// ActivateEmail render the activate email page
func ActivateEmail ( ctx * context . Context ) {
code := ctx . FormString ( "code" )
emailStr := ctx . FormString ( "email" )
// Verify code.
2023-09-14 20:09:32 +03:00
if email := user_model . VerifyActiveEmailCode ( ctx , code , emailStr ) ; email != nil {
if err := user_model . ActivateEmail ( ctx , email ) ; err != nil {
2022-01-02 16:12:35 +03:00
ctx . ServerError ( "ActivateEmail" , err )
2024-05-28 12:31:59 +03:00
return
2022-01-02 16:12:35 +03:00
}
log . Trace ( "Email activated: %s" , email . Email )
ctx . Flash . Success ( ctx . Tr ( "settings.add_email_success" ) )
2022-12-03 05:48:26 +03:00
if u , err := user_model . GetUserByID ( ctx , email . UID ) ; err != nil {
2022-01-02 16:12:35 +03:00
log . Warn ( "GetUserByID: %d" , email . UID )
2023-12-19 12:29:05 +03:00
} else {
2022-01-02 16:12:35 +03:00
// Allow user to validate more emails
_ = ctx . Cache . Delete ( "MailResendLimit_" + u . LowerName )
}
}
// FIXME: e-mail verification does not require the user to be logged in,
// so this could be redirecting to the login page.
// Should users be logged in automatically here? (consider 2FA requirements, etc.)
ctx . Redirect ( setting . AppSubURL + "/user/settings/account" )
}
2022-11-10 14:43:06 +03:00
2023-07-04 21:36:08 +03:00
func updateSession ( ctx * context . Context , deletes [ ] string , updates map [ string ] any ) error {
2022-11-10 14:43:06 +03:00
if _ , err := session . RegenerateSession ( ctx . Resp , ctx . Req ) ; err != nil {
return fmt . Errorf ( "regenerate session: %w" , err )
}
sess := ctx . Session
sessID := sess . ID ( )
for _ , k := range deletes {
if err := sess . Delete ( k ) ; err != nil {
return fmt . Errorf ( "delete %v in session[%s]: %w" , k , sessID , err )
}
}
for k , v := range updates {
if err := sess . Set ( k , v ) ; err != nil {
return fmt . Errorf ( "set %v in session[%s]: %w" , k , sessID , err )
}
}
if err := sess . Release ( ) ; err != nil {
return fmt . Errorf ( "store session[%s]: %w" , sessID , err )
}
return nil
}