Home Explore Help
Sign In
ghorsington
/
meidosafe
1
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Browse Source

token handling and verification

pitu 7 years ago
parent
0da43c4520
commit
bdfd512c10
8 changed files with 142 additions and 77 deletions
Split View Show Diff Stats
  1. 3 0
      config.sample.js
  2. 4 4
      controllers/galleryController.js
  3. 3 4
      controllers/uploadController.js
  4. 9 1
      pages/home.html
  5. 3 1
      public/css/style.css
  6. 68 44
      public/js/panel.js
  7. 28 21
      public/js/upload.js
  8. 24 2
      routes/api.js

+ 3 - 0
config.sample.js
View File 

@@ -6,6 +6,9 @@ module.exports = {
 
 		Ideally the only options you should change are port and basedomain.
 
 	*/
 
 
+	// Should this instance of loli-safe be private? If so, a client token will be needed for uploads
 
+	private: true,
 
+	
 	// Your base domain where the app is running. Remember to finish it with '/'
 
 	basedomain: 'https://i.kanacchi.moe/',

+ 4 - 4
controllers/galleryController.js
View File 

@@ -5,18 +5,18 @@ let galleryController = {}
 
 
 galleryController.list = function(req, res, next){
 
 	
-	if(config.TOKEN === true)
 
+	if(config.private === true)
 
 		if(req.headers.auth !== config.clientToken)
 
 			return res.status(401).send('not-authorized')
 
 
-	db.table('gallery').select('id', 'name').then((data) => {
 
-		res.json({ data })
 
+	db.table('gallery').select('id', 'name').then((galleries) => {
 
+		return res.json({ galleries })
 
 	})
 
 }
 
 
 galleryController.test = function(req, res, next){
 
 	
-	if(config.TOKEN === true)
 
+	if(config.private === true)
 
 		if(req.headers.auth !== config.clientToken)
 
 			return res.status(401).send('not-authorized')

+ 3 - 4
controllers/uploadController.js
View File 

@@ -22,7 +22,7 @@ const upload = multer({
 
 
 uploadsController.upload = function(req, res, next){
 
 
-	if(config.TOKEN === true)
 
+	if(config.private === true)
 
 		if(req.headers.auth !== config.clientToken)
 
 			return res.status(401).send('not-authorized')
 
 
@@ -70,9 +70,8 @@ uploadsController.upload = function(req, res, next){
 
 
 uploadsController.list = function(req, res){
 
 
-	if(config.TOKEN === true)
 
-		if(req.headers.auth !== config.clientToken)
 
-			return res.status(401).send('not-authorized')
 
+	if(req.headers.auth !== config.adminToken)
 
+		return res.status(401).send('not-authorized')
 
 
 	db.table('files').then((files) => {

+ 9 - 1
pages/home.html
View File 

@@ -9,7 +9,7 @@
 
     </head>
 
 
     <body>
 
-        <section class="hero is-fullheight has-text-centered">
 
+        <section class="hero is-fullheight has-text-centered" id="home">
 
             <div class="hero-body">
 
                 <div class="container">
 
                     <p id="b">
 
@@ -39,6 +39,14 @@
 
                         <div class="column"></div>
 
                     </div>
 
 
+                    <div class="columns">
 
+                        <div class="column"></div>
 
+                        <div class="column"><a href="https://chrome.google.com/webstore/detail/loli-safe-uploader/enkkmplljfjppcdaancckgilmgoiofnj/related" target="_blank" class="is-danger">Uploader Chrome extension</a></div>
 
+                        <div class="column"></div>
 
+                    </div>
 
+
 
+                    
+
 
                     <div id="uploads">
 
                         <div id="template" class="columns">
 
                             <div class="column">

+ 3 - 1
public/css/style.css
View File 

@@ -82,11 +82,13 @@ img.logo { height: 200px; margin-top: 20px; }
 
 ------------------ */
 
 
 section#dashboard { display: none }
 
+section#auth input { background: rgba(0, 0, 0, 0); }
 
 section#auth input, section#auth a {
 
 	border-left: 0px;
 
     border-top: 0px;
 
     border-right: 0px;
 
     border-radius: 0px;
 
-    background: rgba(0, 0, 0, 0);
 
     box-shadow: 0 0 0;
 
 }
 
+
 
+section#dashboard .table { font-size: 12px }

+ 68 - 44
public/js/panel.js
View File 

@@ -1,15 +1,11 @@
 
 window.onload = function () {
 
 
-	if(!localStorage.admintoken){
 
-		askForToken();
 
-		return;
 
-	}
 
+	var page;
 
 
-	var dashboard = document.getElementById('dashboard');
 
-	var page = document.getElementById('page');
 
+	if(!localStorage.admintoken)
 
+		return askForToken();
 
 
-	dashboard.style.display = 'block';
 
-	prepareMenu();
 
+	prepareDashboard();
 
 
 	function askForToken(){
 
 		document.getElementById('tokenSubmit').addEventListener('click', function(){
 
@@ -21,15 +17,35 @@ window.onload = function () {
 
 
 			xhr.onreadystatechange = function() {
 
 				if (xhr.readyState == XMLHttpRequest.DONE) {
 
+					try{
 
+						
+						var json = JSON.parse(xhr.responseText);
 
+						if(json.success === false)
 
+							return alert(json.description);
 
+
 
+						localStorage.admintoken = document.getElementById('token').value;
 
+						prepareDashboard();
 
+
 
+					}catch(e){
 
+						console.log(e);
 
+					}
 
+
 
+					console.log(xhr.responseText);
 
 					// xhr.responseText
 
 				}
 
 			}
 
-			xhr.open('POST', '/api/info', true);
 
+			xhr.open('GET', '/api/verify', true);
 
+			xhr.setRequestHeader('type', 'admin');
 
+			xhr.setRequestHeader('token', document.getElementById('token').value);
 
 			xhr.send(null);
 
 		}
 
 	}
 
 
-	function prepareMenu(){
 
+	function prepareDashboard(){
 
+		page = document.getElementById('page');
 
+		document.getElementById('auth').style.display = 'none';
 
+		document.getElementById('dashboard').style.display = 'block';
 
+
 
 		document.getElementById('itemUploads').addEventListener('click', function(){
 
 			getUploads();
 
 		});
 
@@ -45,44 +61,47 @@ window.onload = function () {
 
 
 		xhr.onreadystatechange = function() {
 
 			if(xhr.readyState == XMLHttpRequest.DONE){
 
-				if(xhr.responseText !== 'not-authorized'){
 
-					var json = JSON.parse(xhr.responseText);
 
-
 
-					var container = document.createElement('div');
 
-					container.innerHTML = `
 
-						<table class="table">
 
-					  		<thead>
 
-					    		<tr>
 
-								      <th>File</th>
 
-								      <th>Gallery</th>
 
-								      <th>Date</th>
 
-					    		</tr>
 
-					  		</thead>
 
-					  		<tbody id="table">
 
-					  		</tbody>
 
-					  	</table>`;
 
-					page.appendChild(container);
 
-
 
-					var table = document.getElementById('table');
 
-
 
-					for(var item of json){
 
-
 
-						var tr = document.createElement('tr');
 
-						tr.innerHTML = `
 
-							<tr>
 
-						    	<th><a href="${item.file}" target="_blank">${item.file}</a></th>
 
-						      	<th>${item.gallery}</th>
 
-						      	<td>${item.date}</td>
 
-						    </tr>
 
-						    `;
 
-
 
-						table.appendChild(tr);
 
-					}
 
+				
+				if(xhr.responseText === 'not-authorized')
 
+					return notAuthorized();
 
+
 
+				var json = JSON.parse(xhr.responseText);
 
+
 
+				var container = document.createElement('div');
 
+				container.innerHTML = `
 
+					<table class="table">
 
+				  		<thead>
 
+				    		<tr>
 
+							      <th>File</th>
 
+							      <th>Gallery</th>
 
+							      <th>Date</th>
 
+				    		</tr>
 
+				  		</thead>
 
+				  		<tbody id="table">
 
+				  		</tbody>
 
+				  	</table>`;
 
+				page.appendChild(container);
 
+
 
+				var table = document.getElementById('table');
 
+
 
+				for(var item of json){
 
+
 
+					var tr = document.createElement('tr');
 
+					tr.innerHTML = `
 
+						<tr>
 
+					    	<th><a href="${item.file}" target="_blank">${item.file}</a></th>
 
+					      	<th>${item.gallery}</th>
 
+					      	<td>${item.date}</td>
 
+					    </tr>
 
+					    `;
 
+
 
+					table.appendChild(tr);
 
 				}
 
+				
 			}
 
 		}
 
 		xhr.open('GET', '/api/uploads', true);
 
-		xhr.setRequestHeader('auth', localStorage.token);
 
+		xhr.setRequestHeader('auth', localStorage.admintoken);
 
 		xhr.send(null);
 
 	}
 
 
@@ -93,4 +112,9 @@ window.onload = function () {
 
 
 	}
 
 
+	function notAuthorized() {
 
+		localStorage.removeItem("admintoken");
 
+		location.reload();
 
+	}
 
+
 
 }

+ 28 - 21
public/js/upload.js
View File 

@@ -8,7 +8,7 @@ window.onload = function () {
 
 	var xhr = new XMLHttpRequest();
 
 	xhr.onreadystatechange = function() {
 
 		if (xhr.readyState == XMLHttpRequest.DONE) {
 
-			USINGTOKEN = JSON.parse(xhr.responseText).token;
 
+			USINGTOKEN = JSON.parse(xhr.responseText).private;
 
 			prepareTokenThing();
 
 		}
 
 	}
 
@@ -20,14 +20,14 @@ window.onload = function () {
 
 		if(!USINGTOKEN) return getInfo();
 
 
 		if(!localStorage.token){
 
-			document.getElementById('tokenContainer').style.display = 'flex'
 
 			document.getElementById('tokenSubmit').addEventListener('click', function(){
 
 				getInfo(document.getElementById('token').value)
 
 			});
 
-		}else{
 
-			getInfo(localStorage.token);
 
+			return document.getElementById('tokenContainer').style.display = 'flex';
 
 		}
 
 
+		getInfo(localStorage.token);
 
+
 
 	}
 
 
 	function prepareDropzone(){
 
@@ -91,23 +91,25 @@ window.onload = function () {
 
 
 		xhr.onreadystatechange = function() {
 
 			if (xhr.readyState == XMLHttpRequest.DONE) {
 
-				if(xhr.responseText !== 'not-authorized'){
 
-					
-					div = document.createElement('div');
 
-					div.id = 'dropzone';
 
-					div.innerHTML = 'Click here or drag and drop files';
 
-					div.style.display = 'flex';
 
-
 
-					document.getElementById('btnGithub').style.display = 'none';
 
-					document.getElementById('tokenContainer').style.display = 'none';
 
-					document.getElementById('uploadContainer').appendChild(div);
 
-					document.getElementById('panel').style.display = 'block';
 
-					
-					if(xhr.responseText.maxFileSize) maxSize = JSON.parse(xhr.responseText).maxFileSize;
 
-					if(token) localStorage.token = token;
 
-
 
-					prepareDropzone();
 
-				}
 
+				
+				if(xhr.responseText === 'not-authorized')
 
+					return notAuthorized();
 
+
 
+				div = document.createElement('div');
 
+				div.id = 'dropzone';
 
+				div.innerHTML = 'Click here or drag and drop files';
 
+				div.style.display = 'flex';
 
+
 
+				document.getElementById('btnGithub').style.display = 'none';
 
+				document.getElementById('tokenContainer').style.display = 'none';
 
+				document.getElementById('uploadContainer').appendChild(div);
 
+				document.getElementById('panel').style.display = 'block';
 
+				
+				if(xhr.responseText.maxFileSize) maxSize = JSON.parse(xhr.responseText).maxFileSize;
 
+				if(token) localStorage.token = token;
 
+
 
+				prepareDropzone();
 
+				
 			}
 
 		}
 
 		xhr.open('GET', '/api/info', true);
 
@@ -117,4 +119,9 @@ window.onload = function () {
 
 
 		xhr.send(null);
 
 	}
 
+
 
+	function notAuthorized() {
 
+		localStorage.removeItem("token");
 
+		location.reload();
 
+	}
 
 };

+ 24 - 2
routes/api.js
View File 

@@ -4,12 +4,34 @@ const uploadController = require('../controllers/uploadController')
 
 const galleryController = require('../controllers/galleryController')
 
 
 routes.get ('/check', (req, res, next) => {
 
-	return res.json({token: config.TOKEN})
 
+	return res.json({ private: config.private })
 
+})
 
+
 
+routes.get ('/verify', (req, res, next) => {
 
+	let type = req.headers.type
 
+	let token = req.headers.token
 
+
 
+	if(type === undefined) return res.json({ success: false, description: 'No type provided.' })
 
+	if(token === undefined) return res.json({ success: false, description: 'No token provided.' })
 
+	if(type !== 'client' && type !== 'admin') return res.json({ success: false, description: 'Wrong type provided.' })
 
+
 
+	if(type === 'client'){
 
+		if(token !== config.clientToken) return res.json({ success: false, description: 'Token mismatch.' })
 
+		return res.json({ success: true })
 
+	}
 
+
 
+	if(type === 'admin'){
 
+		if(token !== config.adminToken) return res.json({ success: false, description: 'Token mismatch.' })
 
+		return res.json({ success: true })
 
+	}
 
+
 
+	return res.json({ success: false, description: '(╯°□°）╯︵ ┻━┻' })
 
+
 
 })
 
 
 routes.get('/info', (req, res, next) => {
 
 
-	if(config.TOKEN === true)
 
+	if(config.private === true)
 
 		if(req.headers.auth !== config.clientToken)
 
 			return res.status(401).send('not-authorized')