auth.go 2.5 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. // Copyright 2014 The Gogs Authors. All rights reserved.
  2. // Use of this source code is governed by a MIT-style
  3. // license that can be found in the LICENSE file.
  4. package context
  5. import (
  6. "net/url"
  7. "github.com/go-macaron/csrf"
  8. "gopkg.in/macaron.v1"
  9. "github.com/gogits/gogs/pkg/auth"
  10. "github.com/gogits/gogs/pkg/setting"
  11. )
  12. type ToggleOptions struct {
  13. SignInRequired bool
  14. SignOutRequired bool
  15. AdminRequired bool
  16. DisableCSRF bool
  17. }
  18. func Toggle(options *ToggleOptions) macaron.Handler {
  19. return func(c *Context) {
  20. // Cannot view any page before installation.
  21. if !setting.InstallLock {
  22. c.Redirect(setting.AppSubURL + "/install")
  23. return
  24. }
  25. // Check prohibit login users.
  26. if c.IsLogged && c.User.ProhibitLogin {
  27. c.Data["Title"] = c.Tr("auth.prohibit_login")
  28. c.HTML(200, "user/auth/prohibit_login")
  29. return
  30. }
  31. // Check non-logged users landing page.
  32. if !c.IsLogged && c.Req.RequestURI == "/" && setting.LandingPageURL != setting.LANDING_PAGE_HOME {
  33. c.Redirect(setting.AppSubURL + string(setting.LandingPageURL))
  34. return
  35. }
  36. // Redirect to dashboard if user tries to visit any non-login page.
  37. if options.SignOutRequired && c.IsLogged && c.Req.RequestURI != "/" {
  38. c.Redirect(setting.AppSubURL + "/")
  39. return
  40. }
  41. if !options.SignOutRequired && !options.DisableCSRF && c.Req.Method == "POST" && !auth.IsAPIPath(c.Req.URL.Path) {
  42. csrf.Validate(c.Context, c.csrf)
  43. if c.Written() {
  44. return
  45. }
  46. }
  47. if options.SignInRequired {
  48. if !c.IsLogged {
  49. // Restrict API calls with error message.
  50. if auth.IsAPIPath(c.Req.URL.Path) {
  51. c.JSON(403, map[string]string{
  52. "message": "Only signed in user is allowed to call APIs.",
  53. })
  54. return
  55. }
  56. c.SetCookie("redirect_to", url.QueryEscape(setting.AppSubURL+c.Req.RequestURI), 0, setting.AppSubURL)
  57. c.Redirect(setting.AppSubURL + "/user/login")
  58. return
  59. } else if !c.User.IsActive && setting.Service.RegisterEmailConfirm {
  60. c.Data["Title"] = c.Tr("auth.active_your_account")
  61. c.HTML(200, "user/auth/activate")
  62. return
  63. }
  64. }
  65. // Redirect to log in page if auto-signin info is provided and has not signed in.
  66. if !options.SignOutRequired && !c.IsLogged && !auth.IsAPIPath(c.Req.URL.Path) &&
  67. len(c.GetCookie(setting.CookieUserName)) > 0 {
  68. c.SetCookie("redirect_to", url.QueryEscape(setting.AppSubURL+c.Req.RequestURI), 0, setting.AppSubURL)
  69. c.Redirect(setting.AppSubURL + "/user/login")
  70. return
  71. }
  72. if options.AdminRequired {
  73. if !c.User.IsAdmin {
  74. c.Error(403)
  75. return
  76. }
  77. c.Data["PageIsAdmin"] = true
  78. }
  79. }
  80. }