IT4Change/gradido
3
0
Fork 0
mirror of https://github.com/IT4Change/gradido.git synced 2025-12-13 07:45:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

compare extern referer with actual host instead of default url, check by login if user came from correct community server

Browse Source
This commit is contained in:
einhornimmond 2021-04-09 14:09:23 +02:00
parent 79332c58e4
commit a9975d4bac
6 changed files with 67 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
login_server/src/cpp/HTTPInterface/LoginPage.cpp
View File

@ -155,6 +155,12 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
if(email != "" && password != "") {
UserState user_state;
auto host = request.find("Host");
std::string host_string = "";
if (host != request.end()) {
host_string = host->second;
}
try {
user_state = mSession->loadUser(email, password);
} catch (Poco::Exception& ex) {
@ -171,9 +177,18 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
user_state = USER_DISABLED;
}
}
} else {
//printf("pubkey exist: %p\n",user->getModel()->getPublicKey());
}
// check if user group belong to host
if(!user.isNull() && host_string != "") {
auto group = user->getGroup();
if(!group.isNull()) {
if(group->getHost() != host_string) {
printf("group host: %s, host string: %s\n", group->getHost().data(), host_string.data());
user_state = USER_WRONG_HOST;
}
}
}
getErrors(mSession);
auto lastExternReferer = mSession->getLastReferer();
@ -183,6 +198,7 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
switch(user_state) {
case USER_EMPTY:
case USER_PASSWORD_INCORRECT:
case USER_WRONG_HOST:
addError(new Error(langCatalog->gettext("Login"), langCatalog->gettext("E-Mail or password isn't right, please try again!")), false);
if(mSession) {
getErrors(mSession);
@ -342,11 +358,11 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
responseStream << " </div>";
// end include header.cpsp
responseStream << "\n";
#line 268 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 284 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( getErrorsHtml() );
responseStream << "\n";
responseStream << "<!--<input type=\"hidden\" name=\"lang\" value=\"";
#line 269 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 285 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( LanguageManager::keyForLanguage(lang) );
responseStream << "\">-->\n";
responseStream << "<div class=\"center-form-container\">\n";
@ -380,22 +396,22 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
responseStream << "\n";
responseStream << " <div class=\"center-form-form\">\n";
responseStream << "\t\t<form action=\"";
#line 273 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 289 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( form_action_url );
responseStream << "\" method=\"POST\">\n";
responseStream << "\t\t\t<input class=\"form-control\" type=\"text\" name=\"login-email\" placeholder=\"";
#line 274 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 290 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext("E-Mail") );
responseStream << "\" value=\"";
#line 274 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 290 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( presetEmail );
responseStream << "\"/>\n";
responseStream << "\t\t\t<input class=\"form-control\" type=\"password\" name=\"login-password\" placeholder=\"";
#line 275 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 291 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext("Password") );
responseStream << "\" />\n";
responseStream << "\t\t <button type=\"submit\" name=\"submit\" class=\"center-form-submit form-button\">";
#line 276 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 292 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext(" Login ") );
responseStream << "</button>\n";
responseStream << "\t\t</form>\n";
@ -403,22 +419,22 @@ void LoginPage::handleRequest(Poco::Net::HTTPServerRequest& request, Poco::Net::
responseStream << " <div class=\"center-form-bottom\">\n";
responseStream << " <div class=\"signup-link\">\n";
responseStream << "\t <p>";
#line 281 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 297 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext("You haven't any account yet? Please follow the link to create one.") );
responseStream << "</p>\n";
responseStream << "\t <a href=\"https://elopage.com/s/gradido/registration-de/payment?locale=de\">\n";
responseStream << "\t\t\t";
#line 283 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 299 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext("Create New Account") );
responseStream << "\n";
responseStream << "\t\t </a>\n";
responseStream << "\t </div>\n";
responseStream << "\t\t<div class=\"reset-pwd-link\">\n";
responseStream << "\t\t\t<a href=\"";
#line 287 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 303 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( getBaseUrl() );
responseStream << "/resetPassword\">";
#line 287 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
#line 303 "F:\\Gradido\\gradido_stage2_local\\login_server\\src\\cpsp\\login.cpsp"
responseStream << ( langCatalog->gettext("Passwort vergessen") );
responseStream << "</a>\n";
responseStream << "\t\t</div>\n";

7
login_server/src/cpp/HTTPInterface/PageRequestHandlerFactory.cpp
View File

@ -77,10 +77,12 @@ Poco::Net::HTTPRequestHandler* PageRequestHandlerFactory::createRequestHandler(c
if (uri != "/favicon.ico") {
//printf("[PageRequestHandlerFactory] uri: %s, first part: %s\n", uri.data(), url_first_part.data());
auto referer = request.find("Referer");
if (referer != request.end()) {
auto host = request.find("Host");
if (referer != request.end() && host != request.end()) {
//printf("referer: %s\n", referer->second.data());
auto refererString = referer->second;
if (refererString.find(ServerConfig::g_serverPath) == refererString.npos) {
auto hostString = host->second;
if (refererString.find(hostString) == refererString.npos) {
externReferer = refererString;
}
}//*/
@ -154,6 +156,7 @@ Poco::Net::HTTPRequestHandler* PageRequestHandlerFactory::createRequestHandler(c
}
if (s) {
if (externReferer != "") {
s->setLastReferer(externReferer);
}
model::table::User* userModel = nullptr;

12
login_server/src/cpp/controller/Group.cpp
View File

@ -1,6 +1,8 @@
#include "Group.h"
#include "Poco/URI.h"
namespace controller {
Group::Group(model::table::Group* dbModel)
@ -95,5 +97,15 @@ namespace controller {
return JsonRequest(model->getUrl(), port);
}
std::string Group::getHost()
{
auto model = getModel();
auto url = model->getUrl();
if (url.find("http") != url.npos) {
auto uri = Poco::URI(url);
return uri.getHost();
}
return url;
}
}

2
login_server/src/cpp/controller/Group.h
View File

@ -26,6 +26,8 @@ namespace controller {
inline Poco::AutoPtr<model::table::Group> getModel() { return _getModel<model::table::Group>(); }
JsonRequest createJsonRequest();
std::string getHost();
protected:
Group(model::table::Group* dbModel);

1
login_server/src/cpp/controller/User.h
View File

@ -20,6 +20,7 @@ enum UserState
USER_NO_KEYS,
USER_NO_PRIVATE_KEY,
USER_NO_GROUP,
USER_WRONG_HOST,
USER_KEYS_DONT_MATCH,
USER_COMPLETE,
USER_DISABLED

20
login_server/src/cpsp/login.cpsp
View File

@ -134,6 +134,12 @@
if(email != "" && password != "") {
UserState user_state;
auto host = request.find("Host");
std::string host_string = "";
if (host != request.end()) {
host_string = host->second;
}
try {
user_state = mSession->loadUser(email, password);
} catch (Poco::Exception& ex) {
@ -150,9 +156,18 @@
user_state = USER_DISABLED;
}
}
} else {
//printf("pubkey exist: %p\n",user->getModel()->getPublicKey());
}
// check if user group belong to host
if(!user.isNull() && host_string != "") {
auto group = user->getGroup();
if(!group.isNull()) {
if(group->getHost() != host_string) {
printf("group host: %s, host string: %s\n", group->getHost().data(), host_string.data());
user_state = USER_WRONG_HOST;
}
}
}
getErrors(mSession);
auto lastExternReferer = mSession->getLastReferer();
@ -162,6 +177,7 @@
switch(user_state) {
case USER_EMPTY:
case USER_PASSWORD_INCORRECT:
case USER_WRONG_HOST:
addError(new Error(langCatalog->gettext("Login"), langCatalog->gettext("E-Mail or password isn't right, please try again!")), false);
if(mSession) {
getErrors(mSession);