Ghost/core/server/apps/private-blogging/lib/middleware.js
Fabien O'Carroll e392fe55ae
🐛 Fixed redirect issue with private sites (#9960)
closes #9959

This issue existed because the logic assumed that if there were no
query parameters then there would be no `query` object. However this is
not the case. What we really wanted to check was for the existence of an
"r" query param - the code has been refactor to explicitly do this now.
2018-10-08 16:31:08 +07:00

153 lines
5.1 KiB
JavaScript

const fs = require('fs-extra');
const url = require('url');
const session = require('cookie-session');
const crypto = require('crypto');
const path = require('path');
const config = require('../../../config');
const urlService = require('../../../services/url');
const constants = require('../../../lib/constants');
const common = require('../../../lib/common');
const settingsCache = require('../../../services/settings/cache');
// routeKeywords.private: 'private'
const privateRoute = '/private/';
function verifySessionHash(salt, hash) {
if (!salt || !hash) {
return false;
}
let hasher = crypto.createHash('sha256');
hasher.update(settingsCache.get('password') + salt, 'utf8');
return hasher.digest('hex') === hash;
}
function getRedirectUrl(query) {
const redirect = decodeURIComponent(query.r || '/');
try {
return new url.URL(redirect, urlService.utils.urlFor('home', true)).pathname;
} catch (e) {
return '/';
}
}
const privateBlogging = {
checkIsPrivate: function checkIsPrivate(req, res, next) {
let isPrivateBlog = settingsCache.get('is_private');
if (!isPrivateBlog) {
res.isPrivateBlog = false;
return next();
}
res.isPrivateBlog = true;
return session({
maxAge: constants.ONE_MONTH_MS,
signed: false
})(req, res, next);
},
filterPrivateRoutes: function filterPrivateRoutes(req, res, next) {
if (!res.isPrivateBlog || req.url.lastIndexOf(privateRoute, 0) === 0) {
return next();
}
if (req.url.lastIndexOf('/robots.txt', 0) === 0) {
return fs.readFile(path.resolve(__dirname, '../', 'robots.txt'), function readFile(err, buf) {
if (err) {
return next(err);
}
res.writeHead(200, {
'Content-Type': 'text/plain',
'Content-Length': buf.length,
'Cache-Control': 'public, max-age=' + config.get('caching:robotstxt:maxAge')
});
res.end(buf);
});
}
// CASE: Allow private RSS feed urls.
// Any url which contains the hash and the postfix /rss is allowed to access a private rss feed without
// a session. As soon as a path matches, we rewrite the url. Even Express uses rewriting when using `app.use()`.
if (req.url.indexOf(settingsCache.get('public_hash') + '/rss') !== -1) {
req.url = req.url.replace(settingsCache.get('public_hash') + '/', '');
return next();
}
// NOTE: Redirect to /private if the session does not exist.
privateBlogging.authenticatePrivateSession(req, res, function onSessionVerified() {
// CASE: RSS is disabled for private blogging e.g. they create overhead
if (req.path.match(/\/rss(\/?|\/\d+\/?)$/)) {
return next(new common.errors.NotFoundError({
message: common.i18n.t('errors.errors.pageNotFound')
}));
}
next();
});
},
authenticatePrivateSession: function authenticatePrivateSession(req, res, next) {
let hash = req.session.token || '',
salt = req.session.salt || '',
isVerified = verifySessionHash(salt, hash),
url;
if (isVerified) {
return next();
} else {
url = urlService.utils.urlFor({relativeUrl: privateRoute});
url += '?r=' + encodeURIComponent(req.url);
return res.redirect(url);
}
},
// This is here so a call to /private/ after a session is verified will redirect to home;
isPrivateSessionAuth: function isPrivateSessionAuth(req, res, next) {
if (!res.isPrivateBlog) {
return res.redirect(urlService.utils.urlFor('home', true));
}
let hash = req.session.token || '',
salt = req.session.salt || '',
isVerified = verifySessionHash(salt, hash);
if (isVerified) {
// redirect to home if user is already authenticated
return res.redirect(urlService.utils.urlFor('home', true));
} else {
return next();
}
},
authenticateProtection: function authenticateProtection(req, res, next) {
// if errors have been generated from the previous call
if (res.error) {
return next();
}
const bodyPass = req.body.password;
const pass = settingsCache.get('password');
const hasher = crypto.createHash('sha256');
const salt = Date.now().toString();
const forward = getRedirectUrl(req.query);
if (pass === bodyPass) {
hasher.update(bodyPass + salt, 'utf8');
req.session.token = hasher.digest('hex');
req.session.salt = salt;
return res.redirect(urlService.utils.urlFor({relativeUrl: forward}));
} else {
res.error = {
message: common.i18n.t('errors.middleware.privateblogging.wrongPassword')
};
return next();
}
}
};
module.exports = privateBlogging;