diff options
| -rw-r--r-- | roseh.moe.go | 41 |
1 files changed, 36 insertions, 5 deletions
diff --git a/roseh.moe.go b/roseh.moe.go index 161c157..bcadd3e 100644 --- a/roseh.moe.go +++ b/roseh.moe.go @@ -19,6 +19,7 @@ import ( "net/http" "os" "path/filepath" + "strconv" "strings" "sync" "time" @@ -207,6 +208,30 @@ func cookieAuth(w http.ResponseWriter, r *http.Request) (string, bool) { return csrfToken, true } +type redirectPath int + +const ( + redirectInvalid redirectPath = iota + redirectNotepad +) + +func parseRedirectPath(formVal string) redirectPath { + i, err := strconv.Atoi(formVal) + if err != nil { + return redirectInvalid + } + return redirectPath(i) +} + +func (r redirectPath) Path() (string, bool) { + switch r { + case redirectNotepad: + return "/notepad", true + default: + return "", false + } +} + var ( //go:embed templates/login.html.template loginString string @@ -215,17 +240,23 @@ var ( type loginTemplateArgs struct { Error bool - Redirect string + Redirect redirectPath } func login(w http.ResponseWriter, r *http.Request) { + redirectPathEnum := parseRedirectPath(r.FormValue("redirect")) + redirectPath, ok := redirectPathEnum.Path() + if !ok { + http.Error(w, "Invalid redirect path", http.StatusBadRequest) + return + } key, pwHash, err := pwhash.Hash(r.FormValue("password"), notepadPasswordSalt) if err != nil { http.Error(w, fmt.Sprintf("Unable to hash password: %s", err), http.StatusInternalServerError) return } if subtle.ConstantTimeCompare(pwHash[:], notepadPassword) == 0 { - if err := loginTemplate.Execute(w, loginTemplateArgs{Error: true, Redirect: r.FormValue("redirect")}); err != nil { + if err := loginTemplate.Execute(w, loginTemplateArgs{Error: true, Redirect: redirectPathEnum}); err != nil { log.Printf("Warning: login: %s", err) } return @@ -236,7 +267,7 @@ func login(w http.ResponseWriter, r *http.Request) { } encryptionKeyMu.Unlock() attachCookie(w) - http.Redirect(w, r, r.FormValue("redirect"), http.StatusSeeOther) + http.Redirect(w, r, redirectPath, http.StatusSeeOther) } func readNotepad(key []byte) (string, error) { @@ -273,7 +304,7 @@ type notepadTemplateArgs struct { func notepad(w http.ResponseWriter, r *http.Request) { csrfToken, ok := cookieAuth(w, r) if !ok { - if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: "/notepad"}); err != nil { + if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: redirectNotepad}); err != nil { log.Printf("Warning: login: %s", err) } return @@ -282,7 +313,7 @@ func notepad(w http.ResponseWriter, r *http.Request) { key := encryptionKey encryptionKeyMu.Unlock() if key == nil { - if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: "/notepad"}); err != nil { + if err := loginTemplate.Execute(w, loginTemplateArgs{Redirect: redirectNotepad}); err != nil { log.Printf("Warning: login: %s", err) } return |