1
0
mirror of https://github.com/hrfee/jfa-go.git synced 2025-01-06 00:10:11 +00:00

Compare commits

...

2 Commits

Author SHA1 Message Date
561c461a18
PWR: TrimPrefix instead of Replace for PWR links 2021-05-30 00:07:18 +01:00
953a66ec47
Password Resets: Ignore magic link visits from bots
For #108. Literally just searches the useragent for "Bot", seems good
enough for Telegram atleast.
2021-05-29 19:24:00 +01:00
3 changed files with 34 additions and 24 deletions

View File

@ -535,7 +535,7 @@ func (emailer *Emailer) resetValues(pwr PasswordReset, app *appContext, noSub bo
if inviteLink != "" {
// Strip /invite form end of this URL, ik its ugly.
template["link_reset"] = true
pinLink := fmt.Sprintf("%s/reset?pin=%s", strings.Replace(inviteLink, "/invite", "", 1), pwr.Pin)
pinLink := fmt.Sprintf("%s/reset?pin=%s", strings.TrimPrefix(inviteLink, "/invite"), pwr.Pin)
template["pin"] = pinLink
// Only used in html email.
template["pin_code"] = pwr.Pin

View File

@ -54,10 +54,12 @@ func pwrMonitor(app *appContext, watcher *fsnotify.Watcher) {
var pwr PasswordReset
data, err := os.ReadFile(event.Name)
if err != nil {
app.debug.Printf("PWR: Failed to read file: %v", err)
return
}
err = json.Unmarshal(data, &pwr)
if len(pwr.Pin) == 0 || err != nil {
app.debug.Printf("PWR: Failed to read PIN: %v", err)
return
}
app.info.Printf("New password reset for user \"%s\"", pwr.Username)

View File

@ -137,6 +137,7 @@ func (app *appContext) AdminPage(gc *gin.Context) {
}
func (app *appContext) ResetPassword(gc *gin.Context) {
isBot := strings.Contains(gc.Request.Header.Get("User-Agent"), "Bot")
pin := gc.Query("pin")
if pin == "" {
app.NoRouteHandler(gc)
@ -151,32 +152,39 @@ func (app *appContext) ResetPassword(gc *gin.Context) {
"success": false,
"ombiEnabled": app.config.Section("ombi").Key("enabled").MustBool(false),
}
resp, status, err := app.jf.ResetPassword(pin)
if status == 200 && err == nil && resp.Success {
data["success"] = true
data["pin"] = pin
} else {
app.err.Printf("Password Reset failed (%d): %v", status, err)
}
defer gcHTML(gc, http.StatusOK, "password-reset.html", data)
if app.config.Section("ombi").Key("enabled").MustBool(false) {
jfUser, status, err := app.jf.UserByName(resp.UsersReset[0], false)
if status != 200 || err != nil {
app.err.Printf("Failed to get user \"%s\" from jellyfin/emby (%d): %v", resp.UsersReset[0], status, err)
return
// If it's a bot, pretend to be a success so the preview is nice.
if isBot {
app.debug.Println("PWR: Ignoring magic link visit from bot")
data["success"] = true
data["pin"] = "NO-BO-TS"
} else {
resp, status, err := app.jf.ResetPassword(pin)
if status == 200 && err == nil && resp.Success {
data["success"] = true
data["pin"] = pin
} else {
app.err.Printf("Password Reset failed (%d): %v", status, err)
}
ombiUser, status, err := app.getOmbiUser(jfUser.ID)
if status != 200 || err != nil {
app.err.Printf("Failed to get user \"%s\" from ombi (%d): %v", resp.UsersReset[0], status, err)
return
if app.config.Section("ombi").Key("enabled").MustBool(false) {
jfUser, status, err := app.jf.UserByName(resp.UsersReset[0], false)
if status != 200 || err != nil {
app.err.Printf("Failed to get user \"%s\" from jellyfin/emby (%d): %v", resp.UsersReset[0], status, err)
return
}
ombiUser, status, err := app.getOmbiUser(jfUser.ID)
if status != 200 || err != nil {
app.err.Printf("Failed to get user \"%s\" from ombi (%d): %v", resp.UsersReset[0], status, err)
return
}
ombiUser["password"] = pin
status, err = app.ombi.ModifyUser(ombiUser)
if status != 200 || err != nil {
app.err.Printf("Failed to set password for ombi user \"%s\" (%d): %v", ombiUser["userName"], status, err)
return
}
app.debug.Printf("Reset password for ombi user \"%s\"", ombiUser["userName"])
}
ombiUser["password"] = pin
status, err = app.ombi.ModifyUser(ombiUser)
if status != 200 || err != nil {
app.err.Printf("Failed to set password for ombi user \"%s\" (%d): %v", ombiUser["userName"], status, err)
return
}
app.debug.Printf("Reset password for ombi user \"%s\"", ombiUser["userName"])
}
}