2013-12-06 12:51:35 +04:00
|
|
|
var config = require('../config'),
|
2014-02-05 12:40:30 +04:00
|
|
|
_ = require('lodash'),
|
2013-09-24 14:46:30 +04:00
|
|
|
path = require('path'),
|
2013-11-22 07:17:38 +04:00
|
|
|
when = require('when'),
|
2013-09-24 14:46:30 +04:00
|
|
|
api = require('../api'),
|
2013-11-28 06:45:01 +04:00
|
|
|
mailer = require('../mail'),
|
2013-09-24 14:46:30 +04:00
|
|
|
errors = require('../errorHandling'),
|
2013-11-07 20:00:39 +04:00
|
|
|
storage = require('../storage'),
|
2014-01-03 19:50:03 +04:00
|
|
|
updateCheck = require('../update-check'),
|
2013-09-24 14:46:30 +04:00
|
|
|
|
2013-06-25 15:43:15 +04:00
|
|
|
adminNavbar,
|
2013-08-22 23:48:36 +04:00
|
|
|
adminControllers,
|
|
|
|
loginSecurity = [];
|
2013-05-11 20:44:25 +04:00
|
|
|
|
2013-06-25 15:43:15 +04:00
|
|
|
adminNavbar = {
|
|
|
|
content: {
|
|
|
|
name: 'Content',
|
|
|
|
navClass: 'content',
|
|
|
|
key: 'admin.navbar.content',
|
2013-09-11 18:38:09 +04:00
|
|
|
path: '/'
|
2013-06-25 15:43:15 +04:00
|
|
|
},
|
|
|
|
add: {
|
|
|
|
name: 'New Post',
|
|
|
|
navClass: 'editor',
|
|
|
|
key: 'admin.navbar.editor',
|
|
|
|
path: '/editor/'
|
|
|
|
},
|
|
|
|
settings: {
|
|
|
|
name: 'Settings',
|
|
|
|
navClass: 'settings',
|
|
|
|
key: 'admin.navbar.settings',
|
|
|
|
path: '/settings/'
|
|
|
|
}
|
|
|
|
};
|
2013-05-11 20:44:25 +04:00
|
|
|
|
2013-08-22 23:48:36 +04:00
|
|
|
|
2013-06-25 20:58:26 +04:00
|
|
|
// TODO: make this a util or helper
|
2013-06-25 15:43:15 +04:00
|
|
|
function setSelected(list, name) {
|
|
|
|
_.each(list, function (item, key) {
|
|
|
|
item.selected = key === name;
|
2013-05-29 04:10:39 +04:00
|
|
|
});
|
2013-06-25 15:43:15 +04:00
|
|
|
return list;
|
|
|
|
}
|
2013-05-29 04:10:39 +04:00
|
|
|
|
2013-06-25 15:43:15 +04:00
|
|
|
adminControllers = {
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: index
|
|
|
|
// Path: /ghost/
|
|
|
|
// Method: GET
|
|
|
|
'index': function (req, res) {
|
|
|
|
/*jslint unparam:true*/
|
|
|
|
function renderIndex() {
|
|
|
|
res.render('content', {
|
|
|
|
bodyClass: 'manage',
|
|
|
|
adminNav: setSelected(adminNavbar, 'content')
|
|
|
|
});
|
|
|
|
}
|
|
|
|
|
|
|
|
when.join(
|
|
|
|
updateCheck(res),
|
|
|
|
when(renderIndex())
|
|
|
|
// an error here should just get logged
|
|
|
|
).otherwise(errors.logError);
|
|
|
|
},
|
|
|
|
'content': function (req, res) {
|
|
|
|
/*jslint unparam:true*/
|
|
|
|
res.render('content', {
|
|
|
|
bodyClass: 'manage',
|
|
|
|
adminNav: setSelected(adminNavbar, 'content')
|
|
|
|
});
|
|
|
|
},
|
|
|
|
// Route: editor
|
|
|
|
// Path: /ghost/editor(/:id)?/
|
|
|
|
// Method: GET
|
|
|
|
'editor': function (req, res) {
|
|
|
|
if (req.params.id !== undefined) {
|
|
|
|
res.render('editor', {
|
|
|
|
bodyClass: 'editor',
|
|
|
|
adminNav: setSelected(adminNavbar, 'content')
|
|
|
|
});
|
|
|
|
} else {
|
|
|
|
res.render('editor', {
|
|
|
|
bodyClass: 'editor',
|
|
|
|
adminNav: setSelected(adminNavbar, 'add')
|
|
|
|
});
|
|
|
|
}
|
|
|
|
},
|
|
|
|
// Route: settings
|
|
|
|
// path: /ghost/settings/(*/)?
|
|
|
|
// Method: GET
|
|
|
|
'settings': function (req, res, next) {
|
|
|
|
// TODO: Centralise list/enumeration of settings panes, so we don't run into trouble in future.
|
2014-03-02 15:46:03 +04:00
|
|
|
var allowedSections = ['', 'general', 'user', 'apps'],
|
2014-02-25 14:51:12 +04:00
|
|
|
section = req.url.replace(/(^\/ghost\/settings[\/]*|\/$)/ig, '');
|
|
|
|
|
|
|
|
if (allowedSections.indexOf(section) < 0) {
|
|
|
|
return next();
|
|
|
|
}
|
|
|
|
|
|
|
|
res.render('settings', {
|
|
|
|
bodyClass: 'settings',
|
|
|
|
adminNav: setSelected(adminNavbar, 'settings')
|
|
|
|
});
|
|
|
|
},
|
|
|
|
// Route: debug
|
|
|
|
// path: /ghost/debug/
|
|
|
|
// Method: GET
|
|
|
|
'debug': {
|
|
|
|
index: function (req, res) {
|
|
|
|
/*jslint unparam:true*/
|
|
|
|
res.render('debug', {
|
|
|
|
bodyClass: 'settings',
|
|
|
|
adminNav: setSelected(adminNavbar, 'settings')
|
|
|
|
});
|
2014-02-27 19:48:38 +04:00
|
|
|
},
|
|
|
|
// frontend route for downloading a file
|
|
|
|
exportContent: function (req, res) {
|
|
|
|
/*jslint unparam:true*/
|
|
|
|
api.db.exportContent().then(function (exportData) {
|
|
|
|
// send a file to the client
|
|
|
|
res.set('Content-Disposition', 'attachment; filename="GhostData.json"');
|
|
|
|
res.json(exportData);
|
|
|
|
}).otherwise(function (err) {
|
|
|
|
var notification = {
|
|
|
|
type: 'error',
|
|
|
|
message: 'Your export file could not be generated.',
|
|
|
|
status: 'persistent',
|
|
|
|
id: 'errorexport'
|
|
|
|
};
|
|
|
|
|
|
|
|
errors.logError(err, 'admin.js', "Your export file could not be generated.");
|
|
|
|
|
|
|
|
return api.notifications.add(notification).then(function () {
|
|
|
|
res.redirect(config().paths.subdir + '/ghost/debug');
|
|
|
|
});
|
|
|
|
});
|
2014-02-25 14:51:12 +04:00
|
|
|
}
|
|
|
|
},
|
|
|
|
// Route: upload
|
|
|
|
// Path: /ghost/upload/
|
|
|
|
// Method: POST
|
|
|
|
'upload': function (req, res) {
|
2013-09-28 17:54:26 +04:00
|
|
|
var type = req.files.uploadimage.type,
|
2013-08-14 00:04:07 +04:00
|
|
|
ext = path.extname(req.files.uploadimage.name).toLowerCase(),
|
2013-11-07 20:00:39 +04:00
|
|
|
store = storage.get_storage();
|
2013-09-28 17:54:26 +04:00
|
|
|
|
2013-11-12 22:37:54 +04:00
|
|
|
if ((type !== 'image/jpeg' && type !== 'image/png' && type !== 'image/gif' && type !== 'image/svg+xml')
|
|
|
|
|| (ext !== '.jpg' && ext !== '.jpeg' && ext !== '.png' && ext !== '.gif' && ext !== '.svg' && ext !== '.svgz')) {
|
2013-09-28 17:54:26 +04:00
|
|
|
return res.send(415, 'Unsupported Media Type');
|
|
|
|
}
|
2013-08-05 21:31:29 +04:00
|
|
|
|
2013-11-07 20:00:39 +04:00
|
|
|
store
|
|
|
|
.save(req.files.uploadimage)
|
2013-09-28 17:54:26 +04:00
|
|
|
.then(function (url) {
|
2013-11-07 20:00:39 +04:00
|
|
|
return res.send(url);
|
2013-09-28 17:54:26 +04:00
|
|
|
})
|
|
|
|
.otherwise(function (e) {
|
2014-01-11 17:40:21 +04:00
|
|
|
errors.logError(e);
|
|
|
|
return res.send(500, e.message);
|
2013-08-05 21:31:29 +04:00
|
|
|
});
|
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: signout
|
|
|
|
// Path: /ghost/signout/
|
|
|
|
// Method: GET
|
|
|
|
'signout': function (req, res) {
|
|
|
|
req.session.destroy();
|
|
|
|
|
|
|
|
var notification = {
|
|
|
|
type: 'success',
|
|
|
|
message: 'You were successfully signed out',
|
|
|
|
status: 'passive',
|
|
|
|
id: 'successlogout'
|
|
|
|
};
|
|
|
|
|
|
|
|
return api.notifications.add(notification).then(function () {
|
|
|
|
res.redirect(config().paths.subdir + '/ghost/signin/');
|
|
|
|
});
|
|
|
|
},
|
|
|
|
// Route: signin
|
|
|
|
// Path: /ghost/signin/
|
|
|
|
// Method: GET
|
|
|
|
'signin': function (req, res) {
|
2013-10-31 22:02:34 +04:00
|
|
|
/*jslint unparam:true*/
|
2013-09-12 12:59:58 +04:00
|
|
|
res.render('login', {
|
2013-06-25 15:43:15 +04:00
|
|
|
bodyClass: 'ghost-login',
|
|
|
|
hideNavbar: true,
|
|
|
|
adminNav: setSelected(adminNavbar, 'login')
|
2013-05-11 20:44:25 +04:00
|
|
|
});
|
2013-06-25 15:43:15 +04:00
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: doSignin
|
|
|
|
// Path: /ghost/signin/
|
|
|
|
// Method: POST
|
|
|
|
'doSignin': function (req, res) {
|
2013-12-06 12:51:35 +04:00
|
|
|
var currentTime = process.hrtime()[0],
|
2014-01-05 06:46:15 +04:00
|
|
|
remoteAddress = req.connection.remoteAddress,
|
2013-08-22 23:48:36 +04:00
|
|
|
denied = '';
|
|
|
|
loginSecurity = _.filter(loginSecurity, function (ipTime) {
|
|
|
|
return (ipTime.time + 2 > currentTime);
|
|
|
|
});
|
|
|
|
denied = _.find(loginSecurity, function (ipTime) {
|
2014-01-05 06:46:15 +04:00
|
|
|
return (ipTime.ip === remoteAddress);
|
2013-06-25 15:43:15 +04:00
|
|
|
});
|
2013-08-22 23:48:36 +04:00
|
|
|
|
|
|
|
if (!denied) {
|
2014-01-05 06:46:15 +04:00
|
|
|
loginSecurity.push({ip: remoteAddress, time: currentTime});
|
2013-08-22 23:48:36 +04:00
|
|
|
api.users.check({email: req.body.email, pw: req.body.password}).then(function (user) {
|
2013-11-24 18:29:36 +04:00
|
|
|
req.session.regenerate(function (err) {
|
|
|
|
if (!err) {
|
|
|
|
req.session.user = user.id;
|
2014-01-05 10:40:53 +04:00
|
|
|
var redirect = config().paths.subdir + '/ghost/';
|
2013-11-27 06:31:27 +04:00
|
|
|
if (req.body.redirect) {
|
|
|
|
redirect += decodeURIComponent(req.body.redirect);
|
|
|
|
}
|
2014-01-20 01:08:39 +04:00
|
|
|
// If this IP address successfully logs in we
|
2014-01-05 06:46:15 +04:00
|
|
|
// can remove it from the array of failed login attempts.
|
|
|
|
loginSecurity = _.reject(loginSecurity, function (ipTime) {
|
|
|
|
return ipTime.ip === remoteAddress;
|
|
|
|
});
|
2013-11-27 06:31:27 +04:00
|
|
|
res.json(200, {redirect: redirect});
|
2013-11-24 18:29:36 +04:00
|
|
|
}
|
|
|
|
});
|
2013-08-22 23:48:36 +04:00
|
|
|
}, function (error) {
|
|
|
|
res.json(401, {error: error.message});
|
|
|
|
});
|
|
|
|
} else {
|
|
|
|
res.json(401, {error: 'Slow down, there are way too many login attempts!'});
|
|
|
|
}
|
2013-06-25 15:43:15 +04:00
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: signup
|
|
|
|
// Path: /ghost/signup/
|
|
|
|
// Method: GET
|
2013-06-25 15:43:15 +04:00
|
|
|
'signup': function (req, res) {
|
2013-10-31 22:02:34 +04:00
|
|
|
/*jslint unparam:true*/
|
2013-06-25 15:43:15 +04:00
|
|
|
res.render('signup', {
|
2013-09-12 12:59:58 +04:00
|
|
|
bodyClass: 'ghost-signup',
|
2013-06-25 15:43:15 +04:00
|
|
|
hideNavbar: true,
|
|
|
|
adminNav: setSelected(adminNavbar, 'login')
|
|
|
|
});
|
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: doSignup
|
|
|
|
// Path: /ghost/signup/
|
|
|
|
// Method: POST
|
|
|
|
'doSignup': function (req, res) {
|
2013-12-06 12:51:35 +04:00
|
|
|
var name = req.body.name,
|
2013-09-08 23:16:40 +04:00
|
|
|
email = req.body.email,
|
2013-06-25 15:43:15 +04:00
|
|
|
password = req.body.password;
|
2013-05-11 20:44:25 +04:00
|
|
|
|
2013-08-19 01:50:42 +04:00
|
|
|
api.users.add({
|
2013-09-12 02:04:49 +04:00
|
|
|
name: name,
|
|
|
|
email: email,
|
2013-08-19 01:50:42 +04:00
|
|
|
password: password
|
|
|
|
}).then(function (user) {
|
2013-09-17 06:08:36 +04:00
|
|
|
api.settings.edit('email', email).then(function () {
|
2013-12-29 01:42:52 +04:00
|
|
|
var message = {
|
|
|
|
to: email,
|
|
|
|
subject: 'Your New Ghost Blog',
|
|
|
|
html: '<p><strong>Hello!</strong></p>' +
|
|
|
|
'<p>Good news! You\'ve successfully created a brand new Ghost blog over on ' + config().url + '</p>' +
|
|
|
|
'<p>You can log in to your admin account with the following details:</p>' +
|
|
|
|
'<p> Email Address: ' + email + '<br>' +
|
|
|
|
'Password: The password you chose when you signed up</p>' +
|
|
|
|
'<p>Keep this email somewhere safe for future reference, and have fun!</p>' +
|
|
|
|
'<p>xoxo</p>' +
|
|
|
|
'<p>Team Ghost<br>' +
|
|
|
|
'<a href="https://ghost.org">https://ghost.org</a></p>'
|
|
|
|
};
|
|
|
|
mailer.send(message).otherwise(function (error) {
|
2014-01-13 01:49:24 +04:00
|
|
|
errors.logError(
|
|
|
|
error.message,
|
|
|
|
"Unable to send welcome email, your blog will continue to function.",
|
|
|
|
"Please see http://docs.ghost.org/mail/ for instructions on configuring email."
|
|
|
|
);
|
2013-12-29 01:42:52 +04:00
|
|
|
});
|
|
|
|
|
2013-11-24 18:29:36 +04:00
|
|
|
req.session.regenerate(function (err) {
|
|
|
|
if (!err) {
|
|
|
|
if (req.session.user === undefined) {
|
|
|
|
req.session.user = user.id;
|
|
|
|
}
|
2014-01-05 10:40:53 +04:00
|
|
|
res.json(200, {redirect: config().paths.subdir + '/ghost/'});
|
2013-11-24 18:29:36 +04:00
|
|
|
}
|
|
|
|
});
|
2013-09-17 06:08:36 +04:00
|
|
|
});
|
|
|
|
}).otherwise(function (error) {
|
2013-08-19 01:50:42 +04:00
|
|
|
res.json(401, {error: error.message});
|
|
|
|
});
|
2013-06-25 15:43:15 +04:00
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: forgotten
|
|
|
|
// Path: /ghost/forgotten/
|
|
|
|
// Method: GET
|
2013-09-01 02:20:12 +04:00
|
|
|
'forgotten': function (req, res) {
|
2013-10-31 22:02:34 +04:00
|
|
|
/*jslint unparam:true*/
|
2013-09-12 12:59:58 +04:00
|
|
|
res.render('forgotten', {
|
2013-09-01 02:20:12 +04:00
|
|
|
bodyClass: 'ghost-forgotten',
|
|
|
|
hideNavbar: true,
|
|
|
|
adminNav: setSelected(adminNavbar, 'login')
|
|
|
|
});
|
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: doForgotten
|
|
|
|
// Path: /ghost/forgotten/
|
|
|
|
// Method: POST
|
|
|
|
'doForgotten': function (req, res) {
|
2013-12-06 12:51:35 +04:00
|
|
|
var email = req.body.email;
|
2013-09-01 02:20:12 +04:00
|
|
|
|
2013-11-22 07:17:38 +04:00
|
|
|
api.users.generateResetToken(email).then(function (token) {
|
2013-11-20 17:58:52 +04:00
|
|
|
var siteLink = '<a href="' + config().url + '">' + config().url + '</a>',
|
2013-12-05 00:58:59 +04:00
|
|
|
resetUrl = config().url.replace(/\/$/, '') + '/ghost/reset/' + token + '/',
|
2013-11-22 07:17:38 +04:00
|
|
|
resetLink = '<a href="' + resetUrl + '">' + resetUrl + '</a>',
|
|
|
|
message = {
|
2013-09-01 02:20:12 +04:00
|
|
|
to: email,
|
2013-11-22 07:17:38 +04:00
|
|
|
subject: 'Reset Password',
|
|
|
|
html: '<p><strong>Hello!</strong></p>' +
|
|
|
|
'<p>A request has been made to reset the password on the site ' + siteLink + '.</p>' +
|
|
|
|
'<p>Please follow the link below to reset your password:<br><br>' + resetLink + '</p>' +
|
|
|
|
'<p>Ghost</p>'
|
2013-09-01 02:20:12 +04:00
|
|
|
};
|
|
|
|
|
2013-11-28 06:45:01 +04:00
|
|
|
return mailer.send(message);
|
2013-09-04 17:57:41 +04:00
|
|
|
}).then(function success() {
|
|
|
|
var notification = {
|
|
|
|
type: 'success',
|
2013-11-22 07:17:38 +04:00
|
|
|
message: 'Check your email for further instructions',
|
2013-09-04 17:57:41 +04:00
|
|
|
status: 'passive',
|
|
|
|
id: 'successresetpw'
|
|
|
|
};
|
|
|
|
|
|
|
|
return api.notifications.add(notification).then(function () {
|
2014-01-05 10:40:53 +04:00
|
|
|
res.json(200, {redirect: config().paths.subdir + '/ghost/signin/'});
|
2013-09-04 17:57:41 +04:00
|
|
|
});
|
2013-09-01 02:20:12 +04:00
|
|
|
|
2013-09-04 17:57:41 +04:00
|
|
|
}, function failure(error) {
|
2013-11-22 07:17:38 +04:00
|
|
|
// TODO: This is kind of sketchy, depends on magic string error.message from Bookshelf.
|
|
|
|
if (error && error.message === 'EmptyResponse') {
|
|
|
|
error.message = "Invalid email address";
|
|
|
|
}
|
|
|
|
|
2013-09-01 02:20:12 +04:00
|
|
|
res.json(401, {error: error.message});
|
2013-11-22 07:17:38 +04:00
|
|
|
});
|
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: reset
|
|
|
|
// Path: /ghost/reset/:token
|
|
|
|
// Method: GET
|
2013-11-22 07:17:38 +04:00
|
|
|
'reset': function (req, res) {
|
2013-12-06 12:51:35 +04:00
|
|
|
// Validate the request token
|
|
|
|
var token = req.params.token;
|
2013-11-22 07:17:38 +04:00
|
|
|
|
|
|
|
api.users.validateToken(token).then(function () {
|
|
|
|
// Render the reset form
|
|
|
|
res.render('reset', {
|
|
|
|
bodyClass: 'ghost-reset',
|
|
|
|
hideNavbar: true,
|
|
|
|
adminNav: setSelected(adminNavbar, 'reset')
|
|
|
|
});
|
|
|
|
}).otherwise(function (err) {
|
|
|
|
// Redirect to forgotten if invalid token
|
|
|
|
var notification = {
|
|
|
|
type: 'error',
|
|
|
|
message: 'Invalid or expired token',
|
|
|
|
status: 'persistent',
|
|
|
|
id: 'errorinvalidtoken'
|
|
|
|
};
|
|
|
|
|
|
|
|
errors.logError(err, 'admin.js', "Please check the provided token for validity and expiration.");
|
|
|
|
|
|
|
|
return api.notifications.add(notification).then(function () {
|
2014-01-05 10:40:53 +04:00
|
|
|
res.redirect(config().paths.subdir + '/ghost/forgotten');
|
2013-11-22 07:17:38 +04:00
|
|
|
});
|
|
|
|
});
|
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: doReset
|
|
|
|
// Path: /ghost/reset/:token
|
|
|
|
// Method: POST
|
|
|
|
'doReset': function (req, res) {
|
2013-12-06 12:51:35 +04:00
|
|
|
var token = req.params.token,
|
2013-11-22 07:17:38 +04:00
|
|
|
newPassword = req.param('newpassword'),
|
|
|
|
ne2Password = req.param('ne2password');
|
|
|
|
|
|
|
|
api.users.resetPassword(token, newPassword, ne2Password).then(function () {
|
|
|
|
var notification = {
|
|
|
|
type: 'success',
|
|
|
|
message: 'Password changed successfully.',
|
|
|
|
status: 'passive',
|
|
|
|
id: 'successresetpw'
|
|
|
|
};
|
|
|
|
|
|
|
|
return api.notifications.add(notification).then(function () {
|
2014-01-05 10:40:53 +04:00
|
|
|
res.json(200, {redirect: config().paths.subdir + '/ghost/signin/'});
|
2013-11-22 07:17:38 +04:00
|
|
|
});
|
|
|
|
}).otherwise(function (err) {
|
|
|
|
res.json(401, {error: err.message});
|
|
|
|
});
|
2013-09-01 02:20:12 +04:00
|
|
|
},
|
2014-02-25 14:51:12 +04:00
|
|
|
// Route: doChangePassword
|
|
|
|
// Path: /ghost/changepw/
|
|
|
|
// Method: POST
|
|
|
|
'doChangePassword': function (req, res) {
|
|
|
|
return api.users.changePassword({
|
|
|
|
currentUser: req.session.user,
|
|
|
|
oldpw: req.body.password,
|
|
|
|
newpw: req.body.newpassword,
|
|
|
|
ne2pw: req.body.ne2password
|
|
|
|
}).then(function () {
|
|
|
|
res.json(200, {msg: 'Password changed successfully'});
|
|
|
|
}, function (error) {
|
|
|
|
res.send(401, {error: error.message});
|
2013-09-05 00:05:36 +04:00
|
|
|
});
|
2013-06-25 15:43:15 +04:00
|
|
|
}
|
|
|
|
};
|
2013-05-11 20:44:25 +04:00
|
|
|
|
2013-08-09 05:22:49 +04:00
|
|
|
module.exports = adminControllers;
|