diff options
author | Christopher Speller <crspeller@gmail.com> | 2017-04-27 10:55:03 -0400 |
---|---|---|
committer | Joram Wilander <jwawilander@gmail.com> | 2017-04-27 10:55:03 -0400 |
commit | 9a87bb3af68216b53ee8f89d6604c715c7b85b2d (patch) | |
tree | 8c06aed890f388b228f3aefb8e398309bc73c0b9 /api4/user.go | |
parent | 0e007e344bf10993529711f14c4168365c3504c3 (diff) | |
download | chat-9a87bb3af68216b53ee8f89d6604c715c7b85b2d.tar.gz chat-9a87bb3af68216b53ee8f89d6604c715c7b85b2d.tar.bz2 chat-9a87bb3af68216b53ee8f89d6604c715c7b85b2d.zip |
Creating common token store and moving email invites and verification to it (#6213)
Diffstat (limited to 'api4/user.go')
-rw-r--r-- | api4/user.go | 55 |
1 files changed, 23 insertions, 32 deletions
diff --git a/api4/user.go b/api4/user.go index 1d117ce07..18e549a64 100644 --- a/api4/user.go +++ b/api4/user.go @@ -768,23 +768,23 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) { func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) { props := model.MapFromJson(r.Body) - code := props["code"] - if len(code) != model.PASSWORD_RECOVERY_CODE_SIZE { - c.SetInvalidParam("code") + token := props["token"] + if len(token) != model.TOKEN_SIZE { + c.SetInvalidParam("token") return } newPassword := props["new_password"] - c.LogAudit("attempt - code=" + code) + c.LogAudit("attempt - token=" + token) - if err := app.ResetPasswordFromCode(code, newPassword); err != nil { - c.LogAudit("fail - code=" + code) + if err := app.ResetPasswordFromToken(token, newPassword); err != nil { + c.LogAudit("fail - token=" + token) c.Err = err return } - c.LogAudit("success - code=" + code) + c.LogAudit("success - token=" + token) ReturnStatusOK(w) } @@ -985,32 +985,21 @@ func getUserAudits(c *Context, w http.ResponseWriter, r *http.Request) { func verifyUserEmail(c *Context, w http.ResponseWriter, r *http.Request) { props := model.MapFromJson(r.Body) - userId := props["user_id"] - if len(userId) != 26 { - c.SetInvalidParam("user_id") + token := props["token"] + if len(token) != model.TOKEN_SIZE { + c.SetInvalidParam("token") return } - hashedId := props["hash_id"] - if len(hashedId) == 0 { - c.SetInvalidParam("hash_id") + if err := app.VerifyEmailFromToken(token); err != nil { + c.Err = model.NewLocAppError("verifyUserEmail", "api.user.verify_email.bad_link.app_error", nil, err.Error()) + c.Err.StatusCode = http.StatusBadRequest + return + } else { + c.LogAudit("Email Verified") + ReturnStatusOK(w) return } - - hashed := model.HashPassword(hashedId) - if model.ComparePassword(hashed, userId+utils.Cfg.EmailSettings.InviteSalt) { - if c.Err = app.VerifyUserEmail(userId); c.Err != nil { - return - } else { - c.LogAudit("Email Verified") - ReturnStatusOK(w) - return - } - } - - c.Err = model.NewLocAppError("verifyUserEmail", "api.user.verify_email.bad_link.app_error", nil, "") - c.Err.StatusCode = http.StatusBadRequest - return } func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) { @@ -1029,10 +1018,12 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) { return } - if _, err := app.GetStatus(user.Id); err != nil { - go app.SendVerifyEmail(user.Id, user.Email, user.Locale, utils.GetSiteURL()) - } else { - go app.SendEmailChangeVerifyEmail(user.Id, user.Email, user.Locale, utils.GetSiteURL()) + app.SendEmailVerification(user) + if err != nil { + // Don't want to leak whether the email is valid or not + l4g.Error("Unable to create email verification token: " + err.Error()) + ReturnStatusOK(w) + return } ReturnStatusOK(w) |