-
Hi! You're almost done signing up.
-
We've sent you an email with a confirmation link. Please follow it to complete the registration process.
-
If for some reason the email doesn't arrive in a timely fashion and you also can't find it in your spam trap,
- you should feel free to contact the staff and ask us to activate you manually.
- You'll want to tell us the username you chose and preferably email us from the same address you used to sign up.
+
+
Verify your email
+
+ We've sent you an email with a confirmation link. Please follow it to complete the registration process.
+
+
+ If for some reason the email doesn't arrive in a timely fashion and you also can't find it in your spam trap, you should feel free to contact the staff and ask us to activate you manually.
+
+
+ Please tell us your username, and ideally email us from the same address you used to sign up.
+
{{ end }}
diff --git a/src/templates/src/email_password_reset.html b/src/templates/src/email_password_reset.html
index 6b25146b..3b8cdf31 100644
--- a/src/templates/src/email_password_reset.html
+++ b/src/templates/src/email_password_reset.html
@@ -1,12 +1,24 @@
-
Hello, {{ .Name }}
-
Someone has requested a password reset for your account.
-We hope it was you. If you didn't request it, we apologise. Kindly ignore this message.
-
To finish the password reset, visit: {{ .DoPasswordResetUrl }}
-This link will be valid for 24 hours (until {{ absolutedate .Expiration }} UTC)
-
Thanks,
-The Handmade Network staff.
+
+ Hello {{ .Name }},
+
+
+ Someone has requested a password reset for your Handmade Network account. To finish the password reset, visit the following link:
+
+
+ {{ .DoPasswordResetUrl }}
+
+
+ This link will be valid for 24 hours (until {{ absolutedate .Expiration }} UTC).
+
+
+ If you did not request this password reset, we apologize - please ignore this message.
+
+
+ Thanks,
+ The Handmade Network staff.
+
-
-You are receiving this email because someone requested a password reset for your account and supplied both your username and email address correctly.
+
+ You are receiving this email because someone requested a password reset for your account and supplied both your username and email address correctly.
diff --git a/src/templates/src/email_registration.html b/src/templates/src/email_registration.html
index 0b00ef30..7e82a964 100644
--- a/src/templates/src/email_registration.html
+++ b/src/templates/src/email_registration.html
@@ -1,11 +1,16 @@
-
Hello, {{ .Name }}
-
Welcome to Handmade Network.
-To complete the registration process, please use the following link: {{ .CompleteRegistrationUrl }}.
+
+ Hello {{ .Name }} - welcome to Handmade Network!
+
+
+ To complete the registration process, please use the following link:
+
+
+ {{ .CompleteRegistrationUrl }}.
+
Thanks,
The Handmade Network staff.
-
-You are receiving this email because someone registered with your email address at Handmade.Network.
-If that wasn't you, kindly ignore this email. If you do not complete the registration, your information will be deleted from our servers after 7 days.
+
+You are receiving this email because someone registered with your email address at handmade.network. If that wasn't you, kindly ignore this email. If you do not complete the registration, your information will be deleted from our servers after 7 days.
diff --git a/src/templates/src/project.css b/src/templates/src/project.css
index 5ca44745..11c07b4a 100644
--- a/src/templates/src/project.css
+++ b/src/templates/src/project.css
@@ -5,8 +5,9 @@
{{ $themeDimmer := eq .Theme "dark" | ternary (lightness 0.3 $c) (lightness 0.8 $c) | color2css }}
{{ $themeDimmest := eq .Theme "dark" | ternary (lightness 0.2 $c) (lightness 0.85 $c) | color2css }}
-{{/* Theme "dark" colors are always darker in value, regardless of light or dark theme. */}}
+{{/* Theme "dark" and "light" colors are always darker or lighter in value, regardless of theme. */}}
{{ $themeDark := eq .Theme "dark" | ternary (lightness 0.30 $c) (lightness 0.35 $c) | color2css }}
+{{ $themeLight := eq .Theme "dark" | ternary (lightness 0.55 $c) (lightness 0.55 $c) | color2css }}
{{ $linkColor := eq .Theme "dark" | ternary (lightness 0.55 $c) (lightness 0.35 $c) | color2css }}
{{ $linkHoverColor := eq .Theme "dark" | ternary (lightness 0.65 $c) (lightness 0.45 $c) | color2css }}
@@ -18,6 +19,7 @@
--theme-color-dimmest: {{ $themeDimmest }};
--theme-color-dark: {{ $themeDark }};
+ --theme-color-light: {{ $themeLight }};
--link-color: {{ $linkColor }};
--link-hover-color: {{ $linkHoverColor }};
@@ -89,6 +91,11 @@ a:hover, button:hover, .button:hover, input[type=button]:hover {
background-color: var(--theme-color-dark);
}
+.bg-theme-light {
+ background-color: {{ $themeLight }};
+ background-color: var(--theme-color-light);
+}
+
.b--theme {
border-color: {{ $c | color2css }};
border-color: var(--theme-color);
@@ -114,6 +121,11 @@ a:hover, button:hover, .button:hover, input[type=button]:hover {
border-color: var(--theme-color-dark);
}
+.b--theme-light {
+ border-color: {{ $themeLight }};
+ border-color: var(--theme-color-light);
+}
+
:root {
--background-even-background: {{ .PostBgColor }};
}
diff --git a/src/templates/src/user_settings.html b/src/templates/src/user_settings.html
index fa1bfe87..68ef0fcb 100644
--- a/src/templates/src/user_settings.html
+++ b/src/templates/src/user_settings.html
@@ -90,19 +90,13 @@
-
diff --git a/src/website/auth.go b/src/website/auth.go
index acfd1796..c926ea57 100644
--- a/src/website/auth.go
+++ b/src/website/auth.go
@@ -9,6 +9,7 @@ import (
"time"
"git.handmade.network/hmn/hmn/src/auth"
+ "git.handmade.network/hmn/hmn/src/config"
"git.handmade.network/hmn/hmn/src/db"
"git.handmade.network/hmn/hmn/src/email"
"git.handmade.network/hmn/hmn/src/hmnurl"
@@ -23,6 +24,7 @@ var UsernameRegex = regexp.MustCompile(`^[0-9a-zA-Z][\w-]{2,29}$`)
type LoginPageData struct {
templates.BaseData
RedirectUrl string
+ RegisterUrl string
ForgotPasswordUrl string
}
@@ -33,8 +35,9 @@ func LoginPage(c *RequestContext) ResponseData {
var res ResponseData
res.MustWriteTemplate("auth_login.html", LoginPageData{
- BaseData: getBaseDataAutocrumb(c, "Log in"),
+ BaseData: getBaseData(c, "Log in", nil),
RedirectUrl: c.Req.URL.Query().Get("redirect"),
+ RegisterUrl: hmnurl.BuildRegister(),
ForgotPasswordUrl: hmnurl.BuildRequestPasswordReset(),
}, c.Perf)
return res
@@ -47,12 +50,14 @@ func Login(c *RequestContext) ResponseData {
}
redirect := form.Get("redirect")
- if redirect == "" {
- redirect = "/"
+
+ destination := hmnurl.BuildHomepage()
+ if redirect != "" && urlIsLocal(redirect) {
+ destination = redirect
}
if c.CurrentUser != nil {
- res := c.Redirect(redirect, http.StatusSeeOther)
+ res := c.Redirect(destination, http.StatusSeeOther)
res.AddFutureNotice("warn", fmt.Sprintf("You are already logged in as %s.", c.CurrentUser.Username))
return res
}
@@ -65,7 +70,7 @@ func Login(c *RequestContext) ResponseData {
showLoginWithFailure := func(c *RequestContext, redirect string) ResponseData {
var res ResponseData
- baseData := getBaseDataAutocrumb(c, "Log in")
+ baseData := getBaseData(c, "Log in", nil)
baseData.AddImmediateNotice("failure", "Incorrect username or password")
res.MustWriteTemplate("auth_login.html", LoginPageData{
BaseData: baseData,
@@ -105,7 +110,7 @@ func Login(c *RequestContext) ResponseData {
return c.RejectRequest("You must validate your email address before logging in. You should've received an email shortly after registration. If you did not receive the email, please contact the staff.")
}
- res := c.Redirect(redirect, http.StatusSeeOther)
+ res := c.Redirect(destination, http.StatusSeeOther)
err = loginUser(c, user, &res)
if err != nil {
return c.ErrorResponse(http.StatusInternalServerError, err)
@@ -114,12 +119,14 @@ func Login(c *RequestContext) ResponseData {
}
func Logout(c *RequestContext) ResponseData {
- redir := c.Req.URL.Query().Get("redirect")
- if redir == "" {
- redir = "/"
+ redirect := c.Req.URL.Query().Get("redirect")
+
+ destination := hmnurl.BuildHomepage()
+ if redirect != "" && urlIsLocal(redirect) {
+ destination = redirect
}
- res := c.Redirect(redir, http.StatusSeeOther)
+ res := c.Redirect(destination, http.StatusSeeOther)
logoutUser(c, &res)
return res
}
@@ -128,9 +135,21 @@ func RegisterNewUser(c *RequestContext) ResponseData {
if c.CurrentUser != nil {
c.Redirect(hmnurl.BuildUserSettings(c.CurrentUser.Username), http.StatusSeeOther)
}
+
// TODO(asaf): Do something to prevent bot registration
+
+ type RegisterPageData struct {
+ templates.BaseData
+ DestinationURL string
+ }
+
+ tmpl := RegisterPageData{
+ BaseData: getBaseData(c, "Register", nil),
+ DestinationURL: c.Req.URL.Query().Get("destination"),
+ }
+
var res ResponseData
- res.MustWriteTemplate("auth_register.html", getBaseDataAutocrumb(c, "Register"), c.Perf)
+ res.MustWriteTemplate("auth_register.html", tmpl, c.Perf)
return res
}
@@ -144,7 +163,7 @@ func RegisterNewUserSubmit(c *RequestContext) ResponseData {
displayName := strings.TrimSpace(c.Req.Form.Get("displayname"))
emailAddress := strings.TrimSpace(c.Req.Form.Get("email"))
password := c.Req.Form.Get("password")
- password2 := c.Req.Form.Get("password2")
+ destination := strings.TrimSpace(c.Req.Form.Get("destination"))
if !UsernameRegex.Match([]byte(username)) {
return c.RejectRequest("Invalid username")
}
@@ -154,9 +173,6 @@ func RegisterNewUserSubmit(c *RequestContext) ResponseData {
if len(password) < 8 {
return c.RejectRequest("Password too short")
}
- if password != password2 {
- return c.RejectRequest("Password confirmation doesn't match password")
- }
c.Perf.StartBlock("SQL", "Check blacklist")
// TODO(asaf): Check email against blacklist
@@ -257,7 +273,14 @@ func RegisterNewUserSubmit(c *RequestContext) ResponseData {
if mailName == "" {
mailName = username
}
- err = email.SendRegistrationEmail(emailAddress, mailName, username, ott, c.Perf)
+ err = email.SendRegistrationEmail(
+ emailAddress,
+ mailName,
+ username,
+ ott,
+ destination,
+ c.Perf,
+ )
if err != nil {
return c.ErrorResponse(http.StatusInternalServerError, oops.New(err, "failed to send registration email"))
}
@@ -283,7 +306,7 @@ func RegisterNewUserSuccess(c *RequestContext) ResponseData {
var res ResponseData
res.MustWriteTemplate("auth_register_success.html", RegisterNewUserSuccessData{
- BaseData: getBaseDataAutocrumb(c, "Register"),
+ BaseData: getBaseData(c, "Register", nil),
ContactUsUrl: hmnurl.BuildContactPage(),
}, c.Perf)
return res
@@ -291,8 +314,9 @@ func RegisterNewUserSuccess(c *RequestContext) ResponseData {
type EmailValidationData struct {
templates.BaseData
- Token string
- Username string
+ Token string
+ Username string
+ DestinationURL string
}
func EmailConfirmation(c *RequestContext) ResponseData {
@@ -329,9 +353,10 @@ func EmailConfirmation(c *RequestContext) ResponseData {
var res ResponseData
res.MustWriteTemplate("auth_email_validation.html", EmailValidationData{
- BaseData: getBaseDataAutocrumb(c, "Register"),
- Token: token,
- Username: username,
+ BaseData: getBaseData(c, "Register", nil),
+ Token: token,
+ Username: username,
+ DestinationURL: c.Req.URL.Query().Get("destination"),
}, c.Perf)
return res
}
@@ -342,6 +367,7 @@ func EmailConfirmationSubmit(c *RequestContext) ResponseData {
token := c.Req.Form.Get("token")
username := c.Req.Form.Get("username")
password := c.Req.Form.Get("password")
+ destination := c.Req.Form.Get("destination")
validationResult := validateUsernameAndToken(c, username, token, models.TokenTypeRegistration)
if !validationResult.Match {
@@ -354,7 +380,7 @@ func EmailConfirmationSubmit(c *RequestContext) ResponseData {
return c.ErrorResponse(http.StatusInternalServerError, err)
} else if !success {
var res ResponseData
- baseData := getBaseDataAutocrumb(c, "Register")
+ baseData := getBaseData(c, "Register", nil)
// NOTE(asaf): We can report that the password is incorrect, because an attacker wouldn't have a valid token to begin with.
baseData.AddImmediateNotice("failure", "Incorrect password. Please try again.")
res.MustWriteTemplate("auth_email_validation.html", EmailValidationData{
@@ -401,7 +427,12 @@ func EmailConfirmationSubmit(c *RequestContext) ResponseData {
}
c.Perf.EndBlock()
- res := c.Redirect(hmnurl.BuildHomepage(), http.StatusSeeOther)
+ redirect := hmnurl.BuildHomepage()
+ if destination != "" && urlIsLocal(destination) {
+ redirect = destination
+ }
+
+ res := c.Redirect(redirect, http.StatusSeeOther)
res.AddFutureNotice("success", "You've completed your registration successfully!")
err = loginUser(c, validationResult.User, &res)
if err != nil {
@@ -432,7 +463,7 @@ func RequestPasswordReset(c *RequestContext) ResponseData {
return c.Redirect(hmnurl.BuildHomepage(), http.StatusSeeOther)
}
var res ResponseData
- res.MustWriteTemplate("auth_password_reset.html", getBaseDataAutocrumb(c, "Password Reset"), c.Perf)
+ res.MustWriteTemplate("auth_password_reset.html", getBaseData(c, "Password Reset", nil), c.Perf)
return res
}
@@ -550,7 +581,7 @@ func PasswordResetSent(c *RequestContext) ResponseData {
}
var res ResponseData
res.MustWriteTemplate("auth_password_reset_sent.html", PasswordResetSentData{
- BaseData: getBaseDataAutocrumb(c, "Password Reset"),
+ BaseData: getBaseData(c, "Password Reset", nil),
ContactUsUrl: hmnurl.BuildContactPage(),
}, c.Perf)
return res
@@ -584,7 +615,7 @@ func DoPasswordReset(c *RequestContext) ResponseData {
}
res.MustWriteTemplate("auth_do_password_reset.html", DoPasswordResetData{
- BaseData: getBaseDataAutocrumb(c, "Password Reset"),
+ BaseData: getBaseData(c, "Password Reset", nil),
Username: username,
Token: token,
}, c.Perf)
@@ -597,7 +628,6 @@ func DoPasswordResetSubmit(c *RequestContext) ResponseData {
token := c.Req.Form.Get("token")
username := c.Req.Form.Get("username")
password := c.Req.Form.Get("password")
- password2 := c.Req.Form.Get("password2")
validationResult := validateUsernameAndToken(c, username, token, models.TokenTypePasswordReset)
if !validationResult.Match {
@@ -611,9 +641,6 @@ func DoPasswordResetSubmit(c *RequestContext) ResponseData {
if len(password) < 8 {
return c.RejectRequest("Password too short")
}
- if password != password2 {
- return c.RejectRequest("Password confirmation doesn't match password")
- }
hashed := auth.HashPassword(password)
@@ -806,3 +833,7 @@ func validateUsernameAndToken(c *RequestContext, username string, token string,
return result
}
+
+func urlIsLocal(url string) bool {
+ return strings.HasPrefix(url, config.Config.BaseUrl)
+}
diff --git a/src/website/user.go b/src/website/user.go
index 228bfb8d..981662bd 100644
--- a/src/website/user.go
+++ b/src/website/user.go
@@ -405,10 +405,9 @@ func UserSettingsSave(c *RequestContext) ResponseData {
// Update password
oldPassword := form.Get("old_password")
- newPassword := form.Get("new_password1")
- newPasswordConfirmation := form.Get("new_password2")
+ newPassword := form.Get("new_password")
if oldPassword != "" && newPassword != "" {
- errorRes := updatePassword(c, tx, oldPassword, newPassword, newPasswordConfirmation)
+ errorRes := updatePassword(c, tx, oldPassword, newPassword)
if errorRes != nil {
return *errorRes
}
@@ -526,12 +525,7 @@ func UserProfileAdminNuke(c *RequestContext) ResponseData {
return res
}
-func updatePassword(c *RequestContext, tx pgx.Tx, old, new, confirm string) *ResponseData {
- if new != confirm {
- res := c.RejectRequest("Your password and password confirmation did not match.")
- return &res
- }
-
+func updatePassword(c *RequestContext, tx pgx.Tx, old, new string) *ResponseData {
oldHashedPassword, err := auth.ParsePasswordString(c.CurrentUser.Password)
if err != nil {
c.Logger.Warn().Err(err).Msg("failed to parse user's password string")