code002lover/IPost
1
0
Fork 0
Code Issues 1 Pull Requests 8 Packages Projects Releases Wiki Activity

fix error + format

Browse Source
This commit is contained in:
code002lover
2025-04-29 00:29:00 +02:00
parent 3307f89d7d
commit 99f1890257
63 changed files with 9380 additions and 7015 deletions
Download Patch File Download Diff File Expand all files Collapse all files
routes/user_auth.js
+160 -132
View File
@@ -1,172 +1,200 @@
import {SHA256} from "../extra_modules/SHA.js";
import * as signature from "cookie-signature";
import getIP from "../extra_modules/getip.js";
import {readFileSync} from "fs"
import { SHA256 } from '../extra_modules/SHA.js'
import * as signature from 'cookie-signature'
import getIP from '../extra_modules/getip.js'
import { readFileSync } from 'fs'
const cookiesecret = readFileSync("cookiesecret.txt").toString();
const cookiesecret = readFileSync('cookiesecret.txt').toString()
export const setup = function (router, con, server) {
const config = server.config
const DID_I_FINALLY_ADD_HTTPS = server.DID_I_FINALLY_ADD_HTTPS
const increaseAPICall = server.increaseAPICall
const HASHES_DB = config.cookies.server_hashes;
const HASHES_COOKIE = config.cookies.client_hashes;
const HASHES_DIFF = HASHES_DB - HASHES_COOKIE;
const HASHES_DB = config.cookies.server_hashes
const HASHES_COOKIE = config.cookies.client_hashes
const HASHES_DIFF = HASHES_DB - HASHES_COOKIE
router.post("/register", function (req, res) {
for (let i = 0; i < 10; i++) { //don't want people spam registering
if (!increaseAPICall(req, res))
return;
router.post('/register', function (req, res) {
for (let i = 0; i < 10; i++) {
//don't want people spam registering
if (!increaseAPICall(req, res)) return
}
res.status(200);
if ((typeof req.body.user) !== "string") {
res.status(416);
res.json({ "error": "incorrect username" });
return;
res.status(200)
if (typeof req.body.user !== 'string') {
res.status(416)
res.json({ error: 'incorrect username' })
return
}
if ((typeof req.body.pass) !== "string") {
res.status(417);
res.json({ "error": "incorrect password" });
return;
if (typeof req.body.pass !== 'string') {
res.status(417)
res.json({ error: 'incorrect password' })
return
}
let username = req.body.user.toString();
username = username.replace(/\s/gi, "");
let password = req.body.pass.toString();
let username = req.body.user.toString()
username = username.replace(/\s/gi, '')
let password = req.body.pass.toString()
if (!username) {
res.status(410);
res.redirect("/register?success=false&reason=username");
return;
res.status(410)
res.redirect('/register?success=false&reason=username')
return
}
if (username === "") {
res.status(411);
res.redirect("/register?success=false&reason=username");
return;
if (username === '') {
res.status(411)
res.redirect('/register?success=false&reason=username')
return
}
if (password.length < 10) {
res.status(412);
res.send("password is too short");
return;
res.status(412)
res.send('password is too short')
return
}
if (username.length > 25) {
res.status(413);
res.send("username is too long");
return;
res.status(413)
res.send('username is too long')
return
}
if (username.search("@") !== -1) {
res.status(414);
res.send("username can't contain @-characters");
return;
if (username.search('@') !== -1) {
res.status(414)
res.send("username can't contain @-characters")
return
}
if (!password) {
res.status(415);
res.redirect("/register?success=false&reason=password");
return;
res.status(415)
res.redirect('/register?success=false&reason=password')
return
}
let userexistssql = `SELECT User_Name from ipost.users where User_Name = ?`;
con.query(userexistssql, [encodeURIComponent(username)], function (_error, result) {
if (result && result[0] && result[0].User_Name) {
res.status(418);
res.redirect("/register?success=false&reason=already_exists");
return;
}
let less_hashed_pw = SHA256(password, username, HASHES_DIFF);
let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE);
let ip = getIP(req);
let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
let cookiesigned = signature.sign(setTo, cookiesecret + ip);
ip = SHA256(ip, setTo, HASHES_DB);
const default_settings = {};
let values = [encodeURIComponent(username), hashed_pw, Date.now(), ip, ip, JSON.stringify(default_settings)];
let sql = `INSERT INTO ipost.users (User_Name, User_PW, User_CreationStamp, User_CreationIP, User_LastIP, User_Settings) VALUES (?, ?, ?, ?, ?, ?);`;
con.query(sql, values, function (err) {
if (err)
throw err;
res.cookie('AUTH_COOKIE', cookiesigned, { maxAge: Math.pow(10, 10), httpOnly: true, secure: DID_I_FINALLY_ADD_HTTPS });
if(req.body.r !== undefined) {
res.redirect(decodeURIComponent(req.body.r))
} else {
res.redirect("/user");
let userexistssql = `SELECT User_Name from ipost.users where User_Name = ?`
con.query(
userexistssql,
[encodeURIComponent(username)],
function (_error, result) {
if (result && result[0] && result[0].User_Name) {
res.status(418)
res.redirect(
'/register?success=false&reason=already_exists'
)
return
}
});
});
});
router.post("/login", function (req, res) {
if (!increaseAPICall(req, res))
return;
if ((typeof req.body.user) !== "string") {
res.status(416);
res.json({ "error": "incorrect username" });
return;
let less_hashed_pw = SHA256(password, username, HASHES_DIFF)
let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE)
let ip = getIP(req)
let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
let cookiesigned = signature.sign(setTo, cookiesecret + ip)
ip = SHA256(ip, setTo, HASHES_DB)
const default_settings = {}
let values = [
encodeURIComponent(username),
hashed_pw,
Date.now(),
ip,
ip,
JSON.stringify(default_settings),
]
let sql = `INSERT INTO ipost.users (User_Name, User_PW, User_CreationStamp, User_CreationIP, User_LastIP, User_Settings) VALUES (?, ?, ?, ?, ?, ?);`
con.query(sql, values, function (err) {
if (err) throw err
res.cookie('AUTH_COOKIE', cookiesigned, {
maxAge: Math.pow(10, 10),
httpOnly: true,
secure: DID_I_FINALLY_ADD_HTTPS,
})
if (req.body.r !== undefined) {
res.redirect(decodeURIComponent(req.body.r))
} else {
res.redirect('/user')
}
})
}
)
})
router.post('/login', function (req, res) {
if (!increaseAPICall(req, res)) return
if (typeof req.body.user !== 'string') {
res.status(416)
res.json({ error: 'incorrect username' })
return
}
if ((typeof req.body.pass) !== "string") {
res.status(417);
res.json({ "error": "incorrect password" });
return;
if (typeof req.body.pass !== 'string') {
res.status(417)
res.json({ error: 'incorrect password' })
return
}
if (!req.body.user) {
res.status(410);
res.send("no username given");
return;
res.status(410)
res.send('no username given')
return
}
if (!req.body.pass) {
res.status(411);
res.send("no password given");
return;
res.status(411)
res.send('no password given')
return
}
let username = req.body.user.toString();
username = username.replace(" ", "");
let password = req.body.pass.toString();
let username = req.body.user.toString()
username = username.replace(' ', '')
let password = req.body.pass.toString()
if (!username) {
res.status(412);
res.send("no username given");
return;
res.status(412)
res.send('no username given')
return
}
if (username.length > 25) {
res.status(413);
res.send("username is too long");
return;
res.status(413)
res.send('username is too long')
return
}
if (password.length < 10) {
res.status(414);
res.send("password is too short");
return;
res.status(414)
res.send('password is too short')
return
}
if (!password) {
res.status(415);
res.send("no password given");
return;
res.status(415)
res.send('no password given')
return
}
const no_ip_lock = username.endsWith("@unsafe")
username = username.replace("@unsafe","")
const no_ip_lock = username.endsWith('@unsafe')
username = username.replace('@unsafe', '')
let less_hashed_pw = SHA256(password, username, HASHES_DIFF);
let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE);
let userexistssql = `SELECT * from ipost.users where User_Name = ? and User_PW = ?;`;
con.query(userexistssql, [encodeURIComponent(username), hashed_pw], function (_error, result) {
if (result && result[0]) {
let ip = getIP(req);
let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
let cookiesigned = signature.sign(setTo, cookiesecret + (!no_ip_lock ? ip : ""));
res.cookie('AUTH_COOKIE', cookiesigned, { maxAge: Math.pow(10, 10), httpOnly: true, secure: DID_I_FINALLY_ADD_HTTPS });
ip = SHA256(ip, setTo, HASHES_DB);
if (result[0].User_LastIP !== ip) {
let sql = `update ipost.users set User_LastIP = ? where User_Name = ?;`;
con.query(sql, [ip, encodeURIComponent(username)], function (error) {
if (error)
throw error;
});
}
if(req.body.r !== undefined) {
res.redirect(decodeURIComponent(req.body.r))
let less_hashed_pw = SHA256(password, username, HASHES_DIFF)
let hashed_pw = SHA256(less_hashed_pw, username, HASHES_COOKIE)
let userexistssql = `SELECT * from ipost.users where User_Name = ? and User_PW = ?;`
con.query(
userexistssql,
[encodeURIComponent(username), hashed_pw],
function (_error, result) {
if (result && result[0]) {
let ip = getIP(req)
let setTo = `${username} ${SHA256(password, username, HASHES_COOKIE)}`
let cookiesigned = signature.sign(
setTo,
cookiesecret + (!no_ip_lock ? ip : '')
)
res.cookie('AUTH_COOKIE', cookiesigned, {
maxAge: Math.pow(10, 10),
httpOnly: true,
secure: DID_I_FINALLY_ADD_HTTPS,
})
ip = SHA256(ip, setTo, HASHES_DB)
if (result[0].User_LastIP !== ip) {
let sql = `update ipost.users set User_LastIP = ? where User_Name = ?;`
con.query(
sql,
[ip, encodeURIComponent(username)],
function (error) {
if (error) throw error
}
)
}
if (req.body.r !== undefined) {
res.redirect(decodeURIComponent(req.body.r))
} else {
res.redirect('/user')
}
} else {
res.redirect("/user");
console.log(5, 'login failed, username: ', username)
res.redirect('/login?success=false?reason=noUser')
}
}
else {
console.log(5,"login failed, username: ", username);
res.redirect("/login?success=false?reason=noUser");
}
});
});
}
)
})
}