2017-07-14 19:29:52 +02:00
|
|
|
package cyberman;
|
|
|
|
use Dancer2;
|
2017-07-15 20:24:05 +02:00
|
|
|
use Dancer2::Plugin::Database;
|
|
|
|
use Digest::Bcrypt;
|
|
|
|
use Math::Random::Secure qw(rand irand);
|
2017-07-14 19:29:52 +02:00
|
|
|
|
2017-07-15 20:24:05 +02:00
|
|
|
#####
|
|
|
|
# cyberman.pm
|
|
|
|
# index page and authentication
|
2017-07-15 23:08:11 +02:00
|
|
|
# maybe this could be split into another file at a later juncture
|
2017-07-15 20:24:05 +02:00
|
|
|
#####
|
|
|
|
|
|
|
|
# misc authentication subs
|
|
|
|
|
|
|
|
sub get_auth {
|
|
|
|
my $uid = shift;
|
|
|
|
my $token = shift;
|
|
|
|
|
|
|
|
my $result = database->quick_select("session", {"uid" => $uid, "token" => $token});
|
|
|
|
|
|
|
|
if ($result) {
|
|
|
|
return $uid;
|
|
|
|
} else {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
sub randstring {
|
|
|
|
my $len = shift;
|
|
|
|
|
|
|
|
my @chars = (0..9, "a".."z", "A".."Z");
|
|
|
|
my $ret;
|
|
|
|
|
|
|
|
for (1..$len) {
|
|
|
|
$ret .= $chars[irand(scalar(@chars))];
|
|
|
|
}
|
|
|
|
return $ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
prefix undef;
|
|
|
|
|
|
|
|
hook 'before' => sub {
|
|
|
|
sub cookieval {
|
|
|
|
my $name = shift;
|
|
|
|
my $cookie = cookie($name);
|
|
|
|
if ($cookie) {
|
|
|
|
return $cookie->value;
|
|
|
|
} else {
|
|
|
|
return undef;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2017-07-15 23:08:11 +02:00
|
|
|
my $uid = cookieval("id");
|
2017-07-15 20:24:05 +02:00
|
|
|
my $token = cookieval("token");
|
|
|
|
my $auth = 0;
|
|
|
|
if ($uid && $token) {
|
|
|
|
$auth = get_auth($uid, $token);
|
|
|
|
}
|
|
|
|
|
|
|
|
var auth => $auth;
|
|
|
|
};
|
2017-07-14 19:29:52 +02:00
|
|
|
|
2017-07-15 23:08:11 +02:00
|
|
|
get qr{^/(index)?$} => sub {
|
2017-07-15 20:24:05 +02:00
|
|
|
if (!vars->{auth}) {
|
2017-07-15 23:08:11 +02:00
|
|
|
return template 'index';
|
2017-07-15 20:24:05 +02:00
|
|
|
}
|
2017-07-15 23:08:11 +02:00
|
|
|
return "well done, you logged in, nothing to see yet";
|
2017-07-15 20:24:05 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
post '/register' => sub {
|
|
|
|
my %errs;
|
|
|
|
|
|
|
|
for my $param ("password", "password2", "email") {
|
|
|
|
if (!param($param)) {
|
|
|
|
$errs{"e_no_$param"} = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!exists $errs{"e_no_password"} || !exists $errs{"e_no_password2"}) {
|
|
|
|
if (param("password") ne param("password2")) {
|
|
|
|
$errs{"e_pass_match"} = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (length param("password") < 8) {
|
|
|
|
$errs{"e_pass_len"} = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (scalar(keys(%errs)) != 0) {
|
|
|
|
return template 'register' => {
|
|
|
|
error => 1,
|
|
|
|
params,
|
|
|
|
%errs,
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
# Hash password
|
|
|
|
my $salt = randstring(16);
|
|
|
|
|
|
|
|
my $b = new Digest::Bcrypt;
|
|
|
|
$b->cost(8);
|
|
|
|
$b->salt($salt);
|
|
|
|
$b->add(param "password");
|
|
|
|
|
|
|
|
# Create the account in the database
|
|
|
|
database->quick_insert(
|
|
|
|
"user",
|
|
|
|
{
|
|
|
|
"email" => param("email"),
|
|
|
|
"password" => $b->bcrypt_b64digest,
|
|
|
|
"salt" => $salt,
|
|
|
|
},
|
|
|
|
);
|
|
|
|
|
|
|
|
# TODO: send confirmation email
|
|
|
|
|
|
|
|
template 'login' => {
|
|
|
|
account_created => 1,
|
|
|
|
params,
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
post '/login' => sub {
|
|
|
|
my %errs;
|
|
|
|
|
|
|
|
my $user = database->quick_select(
|
|
|
|
"user",
|
|
|
|
{
|
|
|
|
"email" => param("email"),
|
|
|
|
},
|
|
|
|
);
|
|
|
|
|
|
|
|
if (!$user) {
|
|
|
|
$errs{"e_no_user"} = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (scalar(keys(%errs)) == 0) {
|
|
|
|
my $b = new Digest::Bcrypt;
|
|
|
|
$b->cost(8);
|
|
|
|
$b->salt($user->{"salt"});
|
|
|
|
$b->add(param "password");
|
|
|
|
|
|
|
|
$errs{"e_pass"} = 1 unless $b->bcrypt_b64digest eq $user->{"password"};
|
|
|
|
}
|
|
|
|
|
|
|
|
if (scalar(keys(%errs)) == 0) {
|
|
|
|
$errs{"e_not_confirmed"} = 1 unless $user->{"active"};
|
|
|
|
}
|
|
|
|
|
|
|
|
if (scalar(keys(%errs)) != 0) {
|
|
|
|
return template 'login' => {
|
|
|
|
error => 1,
|
|
|
|
%errs,
|
|
|
|
params,
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
# checks finished, we can create a session now
|
|
|
|
|
2017-07-15 23:08:11 +02:00
|
|
|
my $token = randstring(32);
|
|
|
|
|
|
|
|
database->quick_insert(
|
|
|
|
"session",
|
|
|
|
{
|
|
|
|
"token" => $token,
|
|
|
|
"uid" => $user->{"id"},
|
|
|
|
"since" => time,
|
|
|
|
},
|
|
|
|
);
|
|
|
|
|
|
|
|
cookie id => $user->{"id"};
|
|
|
|
cookie token => $token;
|
|
|
|
|
|
|
|
template redir => {
|
|
|
|
"redir" => "index",
|
|
|
|
};
|
2017-07-14 19:29:52 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
true;
|