diff --git a/conf/nginx/site.conf b/conf/nginx/site.conf index ed9bff0..04c75ca 100644 --- a/conf/nginx/site.conf +++ b/conf/nginx/site.conf @@ -30,41 +30,13 @@ server { gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml image/x-icon; location /api/ { - - if ($request_method = 'OPTIONS') { - add_header 'Access-Control-Allow-Origin $http_origin' always; - # Om nom nom cookies - add_header 'Access-Control-Allow-Credentials' 'true'; - add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; - # Custom headers and headers various browsers *should* be OK with but aren't - add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; - # Tell client that this pre-flight info is valid for 20 days - add_header 'Access-Control-Max-Age' 1728000; - add_header 'Content-Type' 'text/plain charset=UTF-8'; - add_header 'Content-Length' 0; - return 204; - } - - if ($request_method = 'POST') { - add_header 'Access-Control-Allow-Origin $http_origin' always; - add_header 'Access-Control-Allow-Credentials' 'true'; - add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; - add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; - } - - if ($request_method = 'GET') { - add_header 'Access-Control-Allow-Origin $http_origin' always; - add_header 'Access-Control-Allow-Credentials' 'true'; - add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS'; - add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type'; - } - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_set_header Accept-Encoding ""; proxy_redirect off; default_type application/json; + add_header 'Access-Control-Allow-Origin' '*'; add_header Content-Location /api/$upstream_http_content_location; proxy_set_header Connection ""; proxy_http_version 1.1; @@ -72,21 +44,25 @@ server { } location /apidocs { + add_header 'Access-Control-Allow-Origin' '*'; proxy_http_version 1.1; proxy_pass http://swagger; } location /favicon.ico { + add_header 'Access-Control-Allow-Origin' '*'; root /opt/xssbook/public; add_header Cache-Control "public, max-age=108000"; } location /public { + add_header 'Access-Control-Allow-Origin' '*'; try_files $uri =404; add_header Cache-Control "public, max-age=108000"; } location / { + add_header 'Access-Control-Allow-Origin' '*'; root /opt/xssbook/web; include fastcgi_params; fastcgi_pass php:9000; diff --git a/src/db/rest/rest.sql b/src/db/rest/rest.sql index 2b71ebe..6c3fb7d 100644 --- a/src/db/rest/rest.sql +++ b/src/db/rest/rest.sql @@ -26,6 +26,7 @@ GRANT USAGE ON SCHEMA _api TO rest_anon, rest_user; \i /db/rest/user/api_user_insert.sql; \i /db/rest/user/api_user_update.sql; \i /db/rest/user/api_user_delete.sql; +\i /db/rest/user/api_update_password.sql; -- post \i /db/rest/post/api_post.sql; diff --git a/src/db/rest/user/api_update_password.sql b/src/db/rest/user/api_update_password.sql new file mode 100644 index 0000000..34cc1ac --- /dev/null +++ b/src/db/rest/user/api_update_password.sql @@ -0,0 +1,44 @@ +CREATE FUNCTION api.update_password( + current_password TEXT, + new_password TEXT +) +RETURNS void +LANGUAGE plpgsql VOLATILE +AS $BODY$ +DECLARE + _user_id INTEGER; + _real_password TEXT; +BEGIN + _user_id = _api.get_user_id(); + + PERFORM _api.validate_text( + _text => new_password, + _column => 'password', + _min => 1, + _max => 256 + ); + + SELECT password + INTO _real_password + FROM admin.user + WHERE id = _user_id; + + IF _real_password <> current_password THEN + PERFORM _api.raise( + _msg => 'api_invalid_password' + ); + END IF; + + UPDATE + admin.user + SET + "password" = new_password + WHERE + id = _user_id; +END +$BODY$; + +GRANT EXECUTE ON FUNCTION api.update_password(TEXT, TEXT) + TO rest_user; +GRANT SELECT, UPDATE ON TABLE admin.user + TO rest_user; diff --git a/src/db/rest/user/api_user_update.sql b/src/db/rest/user/api_user_update.sql index 2e7cd50..c26c680 100644 --- a/src/db/rest/user/api_user_update.sql +++ b/src/db/rest/user/api_user_update.sql @@ -32,25 +32,6 @@ BEGIN _changed = TRUE; END IF; - -- password - SELECT password - INTO OLD.password - FROM admin.user - WHERE id = OLD.id; - - NEW.password = COALESCE(NEW.password, OLD.password); - NEW.password := _api.trim(NEW.password); - PERFORM _api.validate_text( - _text => NEW.password, - _column => 'password', - _min => 1, - _max => 256 - ); - - IF NEW.password IS DISTINCT FROM OLD.password THEN - _changed = TRUE; - END IF; - -- first name NEW.first_name = COALESCE(NEW.first_name, OLD.first_name); NEW.first_name := _api.trim(NEW.first_name); @@ -138,7 +119,6 @@ BEGIN IF _changed THEN UPDATE admin.user SET username = NEW.username, - password = NEW.password, first_name = NEW.first_name, last_name = NEW.last_name, middle_name = NEW.middle_name, diff --git a/src/public/css/home.css b/src/public/css/home.css index 3fdc381..40e1063 100644 --- a/src/public/css/home.css +++ b/src/public/css/home.css @@ -13,7 +13,7 @@ font-size: 1.5rem; margin: 1rem 0; width: 100%; - height: 70%; + height: 10rem; flex-grow: 1; background-color: transparent; color: var(--text); diff --git a/src/web/_views/apps/settings/main.php b/src/web/_views/apps/settings/main.php index 0cdc4f2..00c1601 100644 --- a/src/web/_views/apps/settings/main.php +++ b/src/web/_views/apps/settings/main.php @@ -54,6 +54,23 @@ function handleSubmit(e) { } +function handlePassword(e) { + e.preventDefault(); + let el = e.target.elements; + let curr = el.curr_password.value; + let newp = el.new_password.value; + + $.ajax({ + url: '/api/rpc/update_password', + method: 'POST', + data: JSON.stringify({ + new_password: newp, + current_password: curr + }), + success: onSuccess + }) +} + const toBase64 = file => new Promise((resolve, reject) => { const reader = new FileReader(); reader.readAsDataURL(file); @@ -111,6 +128,37 @@ function resetMedia(media_type) {
+

+ +
+
+ + +
+
+ + +
+ +
+

diff --git a/src/web/_views/modal/about.php b/src/web/_views/modal/about.php index 746607e..d434908 100644 --- a/src/web/_views/modal/about.php +++ b/src/web/_views/modal/about.php @@ -2,11 +2,10 @@
-
-
- Source Code + Source Code +

For reports of abuse, please email contact@freyacat.org