From 26636d5f2fa53c53e27f7379a640dd0f33ad2c08 Mon Sep 17 00:00:00 2001 From: BurnyLlama Date: Thu, 21 Apr 2022 20:48:02 +0200 Subject: [PATCH] Password changing now works! --- index.js | 6 +++--- package.json | 6 +++--- routes/auth.js | 41 ++++++++++++++++++++++++++++++++++-- static/index.html | 45 ---------------------------------------- views/pages/manager.njk | 24 +++++++++++++++++++-- views/pages/register.njk | 4 ++++ 6 files changed, 71 insertions(+), 55 deletions(-) delete mode 100644 static/index.html diff --git a/index.js b/index.js index 04e8885..b422e5b 100644 --- a/index.js +++ b/index.js @@ -30,10 +30,10 @@ APP.use('/', ROUTES) njk.configure( 'views', { - autoescape: true, + autoescape: true, lstripBlocks: true, - trimBlocks: true, - express: APP, + trimBlocks: true, + express: APP, } ) diff --git a/package.json b/package.json index 7c9ba61..8553bef 100644 --- a/package.json +++ b/package.json @@ -12,10 +12,10 @@ "dependencies": { "bcrypt": "^5.0.1", "cookie-parser": "^1.4.6", - "dotenv": "^12.0.3", - "express": "^4.17.2", + "dotenv": "^12.0.4", + "express": "^4.17.3", "jsonwebtoken": "^8.5.1", "nunjucks": "^3.2.3", - "pg": "^8.7.1" + "pg": "^8.7.3" } } diff --git a/routes/auth.js b/routes/auth.js index be36bec..9fef1b1 100644 --- a/routes/auth.js +++ b/routes/auth.js @@ -48,7 +48,7 @@ AUTH.post('/register', async (req, res) => { if ((await glauth.query("SELECT * FROM users WHERE name = $1::text", [ username ])).rowCount) return(res.send("User already exists")) - bcrypt.hash(password, 10).then( + bcrypt.hash(password, 12).then( hash => { const hexHash = hash2hex(hash) glauth.query( @@ -106,12 +106,49 @@ AUTH.post('/login', async (req, res) => { ) }) +AUTH.post('/changePass', async (req, res) => { + const { newPass, oldPass } = req.body + + // Was input sent? + if (!newPass|| !oldPass ) + return(res.send(`Not entered:${newPass ? '' : ' new password,'}${oldPass ? '' : ' old password'}`)) + + const token = jwt.verify(req.signedCookies["api-token"], SECRET) + + if (!token) + return res.send("Token error! Please sign in ag ain anusername = token.named retry...") + + const username = token.name + + const user = (await glauth.query("SELECT * FROM users WHERE name = $1::text", [ username ])).rows[0] + + if (!user) + return(res.send("User doesn't exist!")) + + bcrypt.compare(oldPass, user.qam_pass).then( + async match => { + if (!match) + return res.send("Password's is incorrect!") + + const newPassHash = await bcrypt.hash(newPass, 12) + const newPassHexHash = hash2hex(newPassHash) + + glauth.query("UPDATE users SET qam_pass = $1::text, passbcrypt = $2::text WHERE name = $3::text", [ newPassHash, newPassHexHash, username ]) + .then( + () => res.send("Successfully changed password!") + ).catch( + () => res.send("Database error while changing password!") + ) + } + ) +}) + AUTH.get('/captcha', async (req, res) => { const captcha = crypto.randomBytes(3).toString('hex') await execawait(`./captcha.sh ${captcha} > captcha.png`) // Make it valid for 10 minutes - valid[captcha] = new Date() + valid[captcha] = new Date(Date.now() + 10 * 60 * 1000) // Send the captcha image res.contentType('image/png') diff --git a/static/index.html b/static/index.html deleted file mode 100644 index 7e36df9..0000000 --- a/static/index.html +++ /dev/null @@ -1,45 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - qwik - - - - -
-
-
-
- -
- -
- -
- -
- - - - diff --git a/views/pages/manager.njk b/views/pages/manager.njk index a3d26dc..98a1b5c 100644 --- a/views/pages/manager.njk +++ b/views/pages/manager.njk @@ -9,7 +9,27 @@
Welcome {{ user.name }}! :D

This is your account manager!

- Currently no features are implemented, but we want to implement at least password changing. - It would also be nice to have proper account deletion. (For now, if you want to delete your account contact an admin!) + Here you can manage your account... +

+ +

Change password:

+
+ + + + + + + +
+ +

I want to change my username

+

+ That is sadly not doable through this manager. Try messaging BurnyLlama (XMPP: burnyllama@qwik.space) and see if there are any options. (You can also just create a new account...) +

+ +

I want to delete my account!

+

+ Contact mew, BurnyLlama (XMPP: burnyllama@qwik.space), and I will help you delete your account.

{% endblock %} \ No newline at end of file diff --git a/views/pages/register.njk b/views/pages/register.njk index cd20e89..b48f628 100644 --- a/views/pages/register.njk +++ b/views/pages/register.njk @@ -20,6 +20,10 @@

Enter the text you see in the image.

+

+ By registering you agree to qwik's Privacy Policy and Terms of Service. +

+ {% endblock %} \ No newline at end of file