From 6a5649db483769755f88892342c16f39777d0185 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sat, 13 Apr 2019 20:06:18 +0000 Subject: [PATCH 1/8] Make captcha and password optional for external accounts --- modules/auth/user_form.go | 3 +- modules/setting/service.go | 4 +++ routers/user/auth.go | 52 ++++++++++++++++++++------- templates/user/auth/signin_inner.tmpl | 2 ++ templates/user/auth/signup_inner.tmpl | 19 +++++----- 5 files changed, 59 insertions(+), 21 deletions(-) diff --git a/modules/auth/user_form.go b/modules/auth/user_form.go index 38ee5415d954f..bddcdd334871f 100644 --- a/modules/auth/user_form.go +++ b/modules/auth/user_form.go @@ -78,7 +78,7 @@ func (f *InstallForm) Validate(ctx *macaron.Context, errs binding.Errors) bindin type RegisterForm struct { UserName string `binding:"Required;AlphaDashDot;MaxSize(40)"` Email string `binding:"Required;Email;MaxSize(254)"` - Password string `binding:"Required;MaxSize(255)"` + Password string `binding:"MaxSize(255)"` Retype string GRecaptchaResponse string `form:"g-recaptcha-response"` } @@ -128,6 +128,7 @@ func (f *MustChangePasswordForm) Validate(ctx *macaron.Context, errs binding.Err // SignInForm form for signing in with user/password type SignInForm struct { UserName string `binding:"Required;MaxSize(254)"` + // TODO remove required from password for SecondFactorAuthentication Password string `binding:"Required;MaxSize(255)"` Remember bool } diff --git a/modules/setting/service.go b/modules/setting/service.go index 7e4fb8d7d9c96..35f72fe16741a 100644 --- a/modules/setting/service.go +++ b/modules/setting/service.go @@ -27,6 +27,8 @@ var Service struct { EnableReverseProxyAutoRegister bool EnableReverseProxyEmail bool EnableCaptcha bool + RequireExternalRegistrationCaptcha bool + RequireExternalRegistrationPassword bool CaptchaType string RecaptchaSecret string RecaptchaSitekey string @@ -61,6 +63,8 @@ func newService() { Service.EnableReverseProxyAutoRegister = sec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool() Service.EnableReverseProxyEmail = sec.Key("ENABLE_REVERSE_PROXY_EMAIL").MustBool() Service.EnableCaptcha = sec.Key("ENABLE_CAPTCHA").MustBool(false) + Service.RequireExternalRegistrationCaptcha = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA").MustBool() + Service.RequireExternalRegistrationPassword = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_PASSWORD").MustBool() Service.CaptchaType = sec.Key("CAPTCHA_TYPE").MustString(ImageCaptcha) Service.RecaptchaSecret = sec.Key("RECAPTCHA_SECRET").MustString("") Service.RecaptchaSitekey = sec.Key("RECAPTCHA_SITEKEY").MustString("") diff --git a/routers/user/auth.go b/routers/user/auth.go index b8f697b3ca4cd..c2d78e7f082aa 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -6,6 +6,8 @@ package user import ( + "crypto/rand" + "encoding/hex" "errors" "fmt" "net/http" @@ -116,6 +118,7 @@ func SignIn(ctx *context.Context) { return } + ctx.Data["AllowPassword"] = true orderedOAuth2Names, oauth2Providers, err := models.GetActiveOAuth2Providers() if err != nil { ctx.ServerError("UserSignIn", err) @@ -135,6 +138,7 @@ func SignIn(ctx *context.Context) { func SignInPost(ctx *context.Context, form auth.SignInForm) { ctx.Data["Title"] = ctx.Tr("sign_in") + ctx.Data["AllowPassword"] = true orderedOAuth2Names, oauth2Providers, err := models.GetActiveOAuth2Providers() if err != nil { ctx.ServerError("UserSignIn", err) @@ -658,9 +662,10 @@ func oAuth2UserLoginCallback(loginSource *models.LoginSource, request *http.Requ // LinkAccount shows the page where the user can decide to login or create a new account func LinkAccount(ctx *context.Context) { + ctx.Data["AllowPassword"] = setting.Service.RequireExternalRegistrationPassword && !setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true - ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -707,10 +712,11 @@ func LinkAccount(ctx *context.Context) { // LinkAccountPostSignIn handle the coupling of external account with another account using signIn func LinkAccountPostSignIn(ctx *context.Context, signInForm auth.SignInForm) { + ctx.Data["AllowPassword"] = !setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true ctx.Data["LinkAccountModeSignIn"] = true - ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -776,10 +782,13 @@ func LinkAccountPostSignIn(ctx *context.Context, signInForm auth.SignInForm) { // LinkAccountPostRegister handle the creation of a new account for an external account using signUp func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterForm) { + // TODO Make insecure passwords optional for local accounts also, + // once email-based Second-Factor Auth is available + ctx.Data["AllowPassword"] = setting.Service.RequireExternalRegistrationPassword && !setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true ctx.Data["LinkAccountModeRegister"] = true - ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -821,15 +830,30 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au } } - if (len(strings.TrimSpace(form.Password)) > 0 || len(strings.TrimSpace(form.Retype)) > 0) && form.Password != form.Retype { - ctx.Data["Err_Password"] = true - ctx.RenderWithErr(ctx.Tr("form.password_not_match"), tplLinkAccount, &form) - return - } - if len(strings.TrimSpace(form.Password)) > 0 && len(form.Password) < setting.MinPasswordLength { - ctx.Data["Err_Password"] = true - ctx.RenderWithErr(ctx.Tr("auth.password_too_short", setting.MinPasswordLength), tplLinkAccount, &form) - return + if setting.Service.AllowOnlyExternalRegistration || !setting.Service.RequireExternalRegistrationPassword { + // Generating a random password a stop-gap shim to get around the password requirement. + // Eventually the database should be changed to indicate "Second Factor"-enabled accounts + // (accounts that do not introduce the security vulnerabilities of a password). + // If a user decides to circumvent second-factor security, and purposefully create a password, + // they can still do so using the "Recover Account" option. + bytes := make([]byte, 16) + _, err := rand.Read(bytes) + if nil != err { + ctx.ServerError("CreateUser", err) + return + } + form.Password = hex.EncodeToString(bytes) + } else { + if (len(strings.TrimSpace(form.Password)) > 0 || len(strings.TrimSpace(form.Retype)) > 0) && form.Password != form.Retype { + ctx.Data["Err_Password"] = true + ctx.RenderWithErr(ctx.Tr("form.password_not_match"), tplLinkAccount, &form) + return + } + if len(strings.TrimSpace(form.Password)) > 0 && len(form.Password) < setting.MinPasswordLength { + ctx.Data["Err_Password"] = true + ctx.RenderWithErr(ctx.Tr("auth.password_too_short", setting.MinPasswordLength), tplLinkAccount, &form) + return + } } loginSource, err := models.GetActiveOAuth2LoginSourceByName(gothUser.(goth.User).Provider) @@ -916,6 +940,8 @@ func SignOut(ctx *context.Context) { // SignUp render the register page func SignUp(ctx *context.Context) { + ctx.Data["AllowPassword"] = true + ctx.Data["Title"] = ctx.Tr("sign_up") ctx.Data["SignUpLink"] = setting.AppSubURL + "/user/sign_up" @@ -932,6 +958,8 @@ func SignUp(ctx *context.Context) { // SignUpPost response for sign up information submission func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterForm) { + ctx.Data["AllowPassword"] = true + ctx.Data["Title"] = ctx.Tr("sign_up") ctx.Data["SignUpLink"] = setting.AppSubURL + "/user/sign_up" diff --git a/templates/user/auth/signin_inner.tmpl b/templates/user/auth/signin_inner.tmpl index 3e67aa7b32139..a35b8da494863 100644 --- a/templates/user/auth/signin_inner.tmpl +++ b/templates/user/auth/signin_inner.tmpl @@ -15,10 +15,12 @@ + {{if .AllowPassword}}
+ {{end}} {{if not .LinkAccountMode}}
diff --git a/templates/user/auth/signup_inner.tmpl b/templates/user/auth/signup_inner.tmpl index 25b50dad8669d..40a0ddd36a1e5 100644 --- a/templates/user/auth/signup_inner.tmpl +++ b/templates/user/auth/signup_inner.tmpl @@ -25,14 +25,17 @@
-
- - -
-
- - -
+ + {{if .AllowPassword}} +
+ + +
+
+ + +
+ {{end}} {{if and .EnableCaptcha (eq .CaptchaType "image")}}
From d2e0def0762d07700a67b06a28f226c210a2d3f1 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sat, 13 Apr 2019 20:14:46 +0000 Subject: [PATCH 2/8] add docs for REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA and REQUIRE_EXTERNAL_REGISTRATION_PASSWORD --- docs/content/doc/advanced/config-cheat-sheet.en-us.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md index 5c37f4f1c44a5..77645c74ab6d2 100644 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md @@ -202,6 +202,9 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`. Requires `Mailer` to be enabled. - `DISABLE_REGISTRATION`: **false**: Disable registration, after which only admin can create accounts for users. +- `REQUIRE_EXTERNAL_REGISTRATION_PASSWORD`: **false**: Enable this to force externally created + accounts (via GitHub, OpenID Connect, etc) to create a password. Warning: enabling this will + decrease security, so you should only enable it if you know what you're doing. - `REQUIRE_SIGNIN_VIEW`: **false**: Enable this to force users to log in to view any page. - `ENABLE_NOTIFY_MAIL`: **false**: Enable this to send e-mail to watchers of a repository when something happens, like creating issues. Requires `Mailer` to be enabled. @@ -211,6 +214,8 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`. - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a provided email rather than a generated email. - `ENABLE_CAPTCHA`: **false**: Enable this to use captcha validation for registration. +- `REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA`: **false**: Enable this to force captcha validation + even for External Accounts (i.e. GitHub, OpenID Connect, etc). - `CAPTCHA_TYPE`: **image**: \[image, recaptcha\] - `RECAPTCHA_SECRET`: **""**: Go to https://www.google.com/recaptcha/admin to get a secret for recaptcha. - `RECAPTCHA_SITEKEY`: **""**: Go to https://www.google.com/recaptcha/admin to get a sitekey for recaptcha. From 900e8250f21629a96100e89037a7a5198089c108 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sat, 13 Apr 2019 21:01:57 +0000 Subject: [PATCH 3/8] whitespace fix --- modules/setting/service.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/setting/service.go b/modules/setting/service.go index 35f72fe16741a..5353d07546c12 100644 --- a/modules/setting/service.go +++ b/modules/setting/service.go @@ -27,8 +27,8 @@ var Service struct { EnableReverseProxyAutoRegister bool EnableReverseProxyEmail bool EnableCaptcha bool - RequireExternalRegistrationCaptcha bool - RequireExternalRegistrationPassword bool + RequireExternalRegistrationCaptcha bool + RequireExternalRegistrationPassword bool CaptchaType string RecaptchaSecret string RecaptchaSitekey string From ac5e5cae8698a51b0b084c8c124b803d9946d523 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sun, 14 Apr 2019 09:23:20 +0000 Subject: [PATCH 4/8] swap EnableCaptcha for RequireExternalRegistrationCaptcha for LinkedAccounts --- routers/user/auth.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/routers/user/auth.go b/routers/user/auth.go index c2d78e7f082aa..29e3c02d174f4 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -815,13 +815,13 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au return } - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha && !cpt.VerifyReq(ctx.Req) { + if setting.Service.RequireExternalRegistrationCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha && !cpt.VerifyReq(ctx.Req) { ctx.Data["Err_Captcha"] = true ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplLinkAccount, &form) return } - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ReCaptcha { + if setting.Service.RequireExternalRegistrationCaptcha && setting.Service.CaptchaType == setting.ReCaptcha { valid, _ := recaptcha.Verify(form.GRecaptchaResponse) if !valid { ctx.Data["Err_Captcha"] = true From fba60a7aa7503c9e825e5c3316d10f343fbaa79f Mon Sep 17 00:00:00 2001 From: Lauris BH Date: Thu, 18 Apr 2019 02:05:50 -0600 Subject: [PATCH 5/8] Update modules/setting/service.go agreed Co-Authored-By: solderjs --- modules/setting/service.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/setting/service.go b/modules/setting/service.go index 5353d07546c12..97babc5aaf215 100644 --- a/modules/setting/service.go +++ b/modules/setting/service.go @@ -63,7 +63,7 @@ func newService() { Service.EnableReverseProxyAutoRegister = sec.Key("ENABLE_REVERSE_PROXY_AUTO_REGISTRATION").MustBool() Service.EnableReverseProxyEmail = sec.Key("ENABLE_REVERSE_PROXY_EMAIL").MustBool() Service.EnableCaptcha = sec.Key("ENABLE_CAPTCHA").MustBool(false) - Service.RequireExternalRegistrationCaptcha = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA").MustBool() + Service.RequireExternalRegistrationCaptcha = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA").MustBool(Service.EnableCaptcha) Service.RequireExternalRegistrationPassword = sec.Key("REQUIRE_EXTERNAL_REGISTRATION_PASSWORD").MustBool() Service.CaptchaType = sec.Key("CAPTCHA_TYPE").MustString(ImageCaptcha) Service.RecaptchaSecret = sec.Key("RECAPTCHA_SECRET").MustString("") From fca88434afd781035b9d8fb694c23db1d1fdbc83 Mon Sep 17 00:00:00 2001 From: AJ ONeal Date: Sat, 4 May 2019 11:45:37 -0600 Subject: [PATCH 6/8] note dependency on ENABLE_CAPTCHA --- docs/content/doc/advanced/config-cheat-sheet.en-us.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md index 77645c74ab6d2..3bdc3b3d509b0 100644 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ b/docs/content/doc/advanced/config-cheat-sheet.en-us.md @@ -215,7 +215,7 @@ Values containing `#` or `;` must be quoted using `` ` `` or `"""`. provided email rather than a generated email. - `ENABLE_CAPTCHA`: **false**: Enable this to use captcha validation for registration. - `REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA`: **false**: Enable this to force captcha validation - even for External Accounts (i.e. GitHub, OpenID Connect, etc). + even for External Accounts (i.e. GitHub, OpenID Connect, etc). You must `ENABLE_CAPTCHA` also. - `CAPTCHA_TYPE`: **image**: \[image, recaptcha\] - `RECAPTCHA_SECRET`: **""**: Go to https://www.google.com/recaptcha/admin to get a secret for recaptcha. - `RECAPTCHA_SITEKEY`: **""**: Go to https://www.google.com/recaptcha/admin to get a sitekey for recaptcha. @@ -401,7 +401,7 @@ NB: You must `REDIRECT_MACARON_LOG` and have `DISABLE_ROUTER_LOG` set to `false` ## Metrics (`metrics`) -- `ENABLED`: **false**: Enables /metrics endpoint for prometheus. +- `ENABLED`: **false**: Enables /metrics endpoint for prometheus. - `TOKEN`: **\**: You need to specify the token, if you want to include in the authorization the metrics . The same token need to be used in prometheus parameters `bearer_token` or `bearer_token_file`. ## API (`api`) From 5394e9b187bc716d5dd581c74af63f6d6dee6608 Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Mon, 1 Jul 2019 20:26:55 +0100 Subject: [PATCH 7/8] Address @kolaente issues --- routers/user/auth.go | 54 ++++++++++++++------------- routers/user/auth_openid.go | 26 +++++++------ templates/user/auth/signin_inner.tmpl | 2 +- templates/user/auth/signup_inner.tmpl | 2 +- 4 files changed, 45 insertions(+), 39 deletions(-) diff --git a/routers/user/auth.go b/routers/user/auth.go index 94becf6359ba7..1ec8445fb3195 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -124,7 +124,6 @@ func SignIn(ctx *context.Context) { return } - ctx.Data["AllowPassword"] = true orderedOAuth2Names, oauth2Providers, err := models.GetActiveOAuth2Providers() if err != nil { ctx.ServerError("UserSignIn", err) @@ -144,7 +143,6 @@ func SignIn(ctx *context.Context) { func SignInPost(ctx *context.Context, form auth.SignInForm) { ctx.Data["Title"] = ctx.Tr("sign_in") - ctx.Data["AllowPassword"] = true orderedOAuth2Names, oauth2Providers, err := models.GetActiveOAuth2Providers() if err != nil { ctx.ServerError("UserSignIn", err) @@ -701,10 +699,10 @@ func oAuth2UserLoginCallback(loginSource *models.LoginSource, request *http.Requ // LinkAccount shows the page where the user can decide to login or create a new account func LinkAccount(ctx *context.Context) { - ctx.Data["AllowPassword"] = setting.Service.RequireExternalRegistrationPassword && !setting.Service.AllowOnlyExternalRegistration + ctx.Data["DisablePassword"] = !setting.Service.RequireExternalRegistrationCaptcha || setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true - ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -751,11 +749,11 @@ func LinkAccount(ctx *context.Context) { // LinkAccountPostSignIn handle the coupling of external account with another account using signIn func LinkAccountPostSignIn(ctx *context.Context, signInForm auth.SignInForm) { - ctx.Data["AllowPassword"] = !setting.Service.AllowOnlyExternalRegistration + ctx.Data["DisablePassword"] = setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true ctx.Data["LinkAccountModeSignIn"] = true - ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -832,11 +830,11 @@ func LinkAccountPostSignIn(ctx *context.Context, signInForm auth.SignInForm) { func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterForm) { // TODO Make insecure passwords optional for local accounts also, // once email-based Second-Factor Auth is available - ctx.Data["AllowPassword"] = setting.Service.RequireExternalRegistrationPassword && !setting.Service.AllowOnlyExternalRegistration + ctx.Data["DisablePassword"] = !setting.Service.RequireExternalRegistrationCaptcha || setting.Service.AllowOnlyExternalRegistration ctx.Data["Title"] = ctx.Tr("link_account") ctx.Data["LinkAccountMode"] = true ctx.Data["LinkAccountModeRegister"] = true - ctx.Data["EnableCaptcha"] = setting.Service.RequireExternalRegistrationCaptcha + ctx.Data["EnableCaptcha"] = setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha ctx.Data["RecaptchaURL"] = setting.Service.RecaptchaURL ctx.Data["CaptchaType"] = setting.Service.CaptchaType ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey @@ -863,14 +861,18 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au return } - if setting.Service.RequireExternalRegistrationCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha && !cpt.VerifyReq(ctx.Req) { - ctx.Data["Err_Captcha"] = true - ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplLinkAccount, &form) - return - } + if setting.Service.EnableCaptcha && setting.Service.RequireExternalRegistrationCaptcha { + var valid bool + switch setting.Service.CaptchaType { + case setting.ImageCaptcha: + valid = cpt.VerifyReq(ctx.Req) + case setting.ReCaptcha: + valid, _ = recaptcha.Verify(form.GRecaptchaResponse) + default: + ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) + return + } - if setting.Service.RequireExternalRegistrationCaptcha && setting.Service.CaptchaType == setting.ReCaptcha { - valid, _ := recaptcha.Verify(form.GRecaptchaResponse) if !valid { ctx.Data["Err_Captcha"] = true ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplLinkAccount, &form) @@ -988,8 +990,6 @@ func SignOut(ctx *context.Context) { // SignUp render the register page func SignUp(ctx *context.Context) { - ctx.Data["AllowPassword"] = true - ctx.Data["Title"] = ctx.Tr("sign_up") ctx.Data["SignUpLink"] = setting.AppSubURL + "/user/sign_up" @@ -1006,8 +1006,6 @@ func SignUp(ctx *context.Context) { // SignUpPost response for sign up information submission func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterForm) { - ctx.Data["AllowPassword"] = true - ctx.Data["Title"] = ctx.Tr("sign_up") ctx.Data["SignUpLink"] = setting.AppSubURL + "/user/sign_up" @@ -1028,14 +1026,18 @@ func SignUpPost(ctx *context.Context, cpt *captcha.Captcha, form auth.RegisterFo return } - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha && !cpt.VerifyReq(ctx.Req) { - ctx.Data["Err_Captcha"] = true - ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplSignUp, &form) - return - } + if setting.Service.EnableCaptcha { + var valid bool + switch setting.Service.CaptchaType { + case setting.ImageCaptcha: + valid = cpt.VerifyReq(ctx.Req) + case setting.ReCaptcha: + valid, _ = recaptcha.Verify(form.GRecaptchaResponse) + default: + ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) + return + } - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ReCaptcha { - valid, _ := recaptcha.Verify(form.GRecaptchaResponse) if !valid { ctx.Data["Err_Captcha"] = true ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplSignUp, &form) diff --git a/routers/user/auth_openid.go b/routers/user/auth_openid.go index f98c07acd79f8..d6baf0d92b8e7 100644 --- a/routers/user/auth_openid.go +++ b/routers/user/auth_openid.go @@ -357,19 +357,23 @@ func RegisterOpenIDPost(ctx *context.Context, cpt *captcha.Captcha, form auth.Si ctx.Data["RecaptchaSitekey"] = setting.Service.RecaptchaSitekey ctx.Data["OpenID"] = oid - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ImageCaptcha && !cpt.VerifyReq(ctx.Req) { - ctx.Data["Err_Captcha"] = true - ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplSignUpOID, &form) - return - } - - if setting.Service.EnableCaptcha && setting.Service.CaptchaType == setting.ReCaptcha { - err := ctx.Req.ParseForm() - if err != nil { - ctx.ServerError("", err) + if setting.Service.EnableCaptcha { + var valid bool + switch setting.Service.CaptchaType { + case setting.ImageCaptcha: + valid = cpt.VerifyReq(ctx.Req) + case setting.ReCaptcha: + err := ctx.Req.ParseForm() + if err != nil { + ctx.ServerError("", err) + return + } + valid, _ = recaptcha.Verify(form.GRecaptchaResponse) + default: + ctx.ServerError("Unknown Captcha Type", fmt.Errorf("Unknown Captcha Type: %s", setting.Service.CaptchaType)) return } - valid, _ := recaptcha.Verify(form.GRecaptchaResponse) + if !valid { ctx.Data["Err_Captcha"] = true ctx.RenderWithErr(ctx.Tr("form.captcha_incorrect"), tplSignUpOID, &form) diff --git a/templates/user/auth/signin_inner.tmpl b/templates/user/auth/signin_inner.tmpl index a35b8da494863..07f85c954f614 100644 --- a/templates/user/auth/signin_inner.tmpl +++ b/templates/user/auth/signin_inner.tmpl @@ -15,7 +15,7 @@
- {{if .AllowPassword}} + {{if not .DisablePassword}}
diff --git a/templates/user/auth/signup_inner.tmpl b/templates/user/auth/signup_inner.tmpl index 40a0ddd36a1e5..cdacd910d9b2a 100644 --- a/templates/user/auth/signup_inner.tmpl +++ b/templates/user/auth/signup_inner.tmpl @@ -26,7 +26,7 @@
- {{if .AllowPassword}} + {{if not .DisablePassword}}
From 00e8d8b0cfe00a828944f3b03fdd97910e3f766b Mon Sep 17 00:00:00 2001 From: Andrew Thornton Date: Mon, 1 Jul 2019 20:59:33 +0100 Subject: [PATCH 8/8] Just set password to empty to disable login --- routers/user/auth.go | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/routers/user/auth.go b/routers/user/auth.go index 1ec8445fb3195..532da4c02c7ba 100644 --- a/routers/user/auth.go +++ b/routers/user/auth.go @@ -6,8 +6,6 @@ package user import ( - "crypto/rand" - "encoding/hex" "errors" "fmt" "net/http" @@ -881,18 +879,12 @@ func LinkAccountPostRegister(ctx *context.Context, cpt *captcha.Captcha, form au } if setting.Service.AllowOnlyExternalRegistration || !setting.Service.RequireExternalRegistrationPassword { - // Generating a random password a stop-gap shim to get around the password requirement. + // In models.User an empty password is classed as not set, so we set form.Password to empty. // Eventually the database should be changed to indicate "Second Factor"-enabled accounts // (accounts that do not introduce the security vulnerabilities of a password). // If a user decides to circumvent second-factor security, and purposefully create a password, // they can still do so using the "Recover Account" option. - bytes := make([]byte, 16) - _, err := rand.Read(bytes) - if nil != err { - ctx.ServerError("CreateUser", err) - return - } - form.Password = hex.EncodeToString(bytes) + form.Password = "" } else { if (len(strings.TrimSpace(form.Password)) > 0 || len(strings.TrimSpace(form.Retype)) > 0) && form.Password != form.Retype { ctx.Data["Err_Password"] = true