nahakubuilder/gobsidian
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix view

Browse Source
This commit is contained in:
nahakubuilde
2025-08-26 21:43:47 +01:00
parent e8658f5aab
commit 090d491dd6
9 changed files with 168 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -13,3 +13,5 @@ __pycache__/
*.sqlite3
*.log
*.bak
./gobsidian

BIN
gobsidian
View File

Binary file not shown.

79
internal/handlers/auth.go
View File

@@ -14,6 +14,7 @@ import (
"time"
"github.com/gin-gonic/gin"
"gobsidian/internal/utils"
)
const sessionCookieName = "gobsidian_session"
@@ -26,9 +27,12 @@ func (h *Handlers) LoginPage(c *gin.Context) {
return
}
token, _ := c.Get("csrf_token")
// propagate return_to if provided
returnTo := c.Query("return_to")
c.HTML(http.StatusOK, "login", gin.H{
"app_name": h.config.AppName,
"csrf_token": token,
"return_to": returnTo,
"ContentTemplate": "login_content",
"ScriptsTemplate": "login_scripts",
"Page": "login",
@@ -192,8 +196,17 @@ func (h *Handlers) MFALoginVerify(c *gin.Context) {
// success: set user_id and clear mfa_user_id
delete(session.Values, "mfa_user_id")
session.Values["user_id"] = uid
// use return_to if set in session
var dest string
if v, ok := session.Values["return_to"].(string); ok {
dest = sanitizeReturnTo(h.config.URLPrefix, v)
delete(session.Values, "return_to")
}
_ = session.Save(c.Request, c.Writer)
c.Redirect(http.StatusFound, h.config.URLPrefix+"/")
if dest == "" {
dest = h.config.URLPrefix + "/"
}
c.Redirect(http.StatusFound, dest)
}
// ProfileMFASetupPage shows QR and input to verify during enrollment
@@ -223,9 +236,16 @@ func (h *Handlers) ProfileMFASetupPage(c *gin.Context) {
label := url.PathEscape(fmt.Sprintf("%s:%s", issuer, username))
otpauth := fmt.Sprintf("otpauth://totp/%s?secret=%s&issuer=%s&digits=6&period=30&algorithm=SHA1", label, secret, url.QueryEscape(issuer))
// Render simple page (uses base.html shell)
// Build sidebar tree for consistent UI and pass auth flags
notesTree, _ := utils.BuildTreeStructure(h.config.NotesDir, h.config.NotesDirHideSidepane, h.config)
c.HTML(http.StatusOK, "mfa_setup", gin.H{
"app_name": h.config.AppName,
"notes_tree": notesTree,
"active_path": []string{},
"current_note": nil,
"breadcrumbs": utils.GenerateBreadcrumbs(""),
"Authenticated": true,
"IsAdmin": isAdmin(c),
"Secret": secret,
"OTPAuthURI": otpauth,
"ContentTemplate": "mfa_setup_content",
@@ -313,6 +333,7 @@ func verifyTOTP(base32Secret, code string, t time.Time) bool {
func (h *Handlers) LoginPost(c *gin.Context) {
username := c.PostForm("username")
password := c.PostForm("password")
returnTo := strings.TrimSpace(c.PostForm("return_to"))
user, err := h.authSvc.Authenticate(username, password)
if err != nil {
@@ -323,6 +344,7 @@ func (h *Handlers) LoginPost(c *gin.Context) {
"app_name": h.config.AppName,
"csrf_token": token,
"error": err.Error(),
"return_to": returnTo,
"ContentTemplate": "login_content",
"ScriptsTemplate": "login_scripts",
"Page": "login",
@@ -333,28 +355,30 @@ func (h *Handlers) LoginPost(c *gin.Context) {
if user.MFASecret.Valid && user.MFASecret.String != "" {
session, _ := h.store.Get(c.Request, sessionCookieName)
session.Values["mfa_user_id"] = user.ID
if rt := sanitizeReturnTo(h.config.URLPrefix, returnTo); rt != "" {
session.Values["return_to"] = rt
}
_ = session.Save(c.Request, c.Writer)
c.Redirect(http.StatusFound, h.config.URLPrefix+"/editor/mfa")
return
}
// If admin created an enrollment for this user, force MFA setup after login
var pending int
if err := h.authSvc.DB.QueryRow(`SELECT 1 FROM mfa_enrollments WHERE user_id = ?`, user.ID).Scan(&pending); err == nil {
// normal login, then redirect to setup
session, _ := h.store.Get(c.Request, sessionCookieName)
session.Values["user_id"] = user.ID
_ = session.Save(c.Request, c.Writer)
c.Redirect(http.StatusFound, h.config.URLPrefix+"/editor/profile/mfa/setup")
return
}
// Do NOT automatically force MFA setup just because an enrollment row exists.
// Some deployments may leave stale enrollment rows; we only require MFA when
// the user actually has MFA enabled (mfa_secret set) or when they explicitly
// navigate to setup from profile.
// Create normal session
session, _ := h.store.Get(c.Request, sessionCookieName)
session.Values["user_id"] = user.ID
_ = session.Save(c.Request, c.Writer)
// Redirect to requested page if provided and safe; otherwise home
if rt := sanitizeReturnTo(h.config.URLPrefix, returnTo); rt != "" {
c.Redirect(http.StatusFound, rt)
} else {
c.Redirect(http.StatusFound, h.config.URLPrefix+"/")
}
}
// LogoutPost clears the session
@@ -364,3 +388,34 @@ func (h *Handlers) LogoutPost(c *gin.Context) {
_ = session.Save(c.Request, c.Writer)
c.Redirect(http.StatusFound, h.config.URLPrefix+"/editor/login")
}
// sanitizeReturnTo ensures the provided return_to is a safe in-app path.
// It rejects absolute URLs and protocol-relative URLs. When URLPrefix is set,
// it enforces that the destination stays within that prefix; if a bare
// "/..." path is provided, it will be rewritten to include the prefix.
func sanitizeReturnTo(prefix, v string) string {
v = strings.TrimSpace(v)
if v == "" {
return ""
}
// Disallow absolute and protocol-relative URLs
if strings.HasPrefix(v, "//") {
return ""
}
if u, err := url.Parse(v); err != nil || (u != nil && u.IsAbs()) {
return ""
}
// Must be a path
if !strings.HasPrefix(v, "/") {
v = "/" + v
}
// Enforce prefix containment when configured
if prefix != "" {
if strings.HasPrefix(v, prefix+"/") || v == prefix || v == prefix+"/" {
return v
}
// If it's a root-relative path without prefix, rewrite into prefix
return prefix + v
}
return v
}

24
internal/server/middleware.go
View File

@@ -5,6 +5,7 @@ import (
"database/sql"
"encoding/base64"
"net/http"
"net/url"
"time"
"github.com/gin-gonic/gin"
@@ -84,7 +85,17 @@ func (s *Server) CSRFRequire() gin.HandlerFunc {
func (s *Server) RequireAuth() gin.HandlerFunc {
return func(c *gin.Context) {
if _, exists := c.Get("user_id"); !exists {
c.Redirect(http.StatusFound, s.config.URLPrefix+"/editor/login")
// Attach return_to so user can be redirected back after login
requested := c.Request.URL.RequestURI()
q := url.Values{}
if requested != "" {
q.Set("return_to", requested)
}
loginURL := s.config.URLPrefix + "/editor/login"
if qs := q.Encode(); qs != "" {
loginURL = loginURL + "?" + qs
}
c.Redirect(http.StatusFound, loginURL)
c.Abort()
return
}
@@ -96,7 +107,16 @@ func (s *Server) RequireAuth() gin.HandlerFunc {
func (s *Server) RequireAdmin() gin.HandlerFunc {
return func(c *gin.Context) {
if _, exists := c.Get("user_id"); !exists {
c.Redirect(http.StatusFound, s.config.URLPrefix+"/editor/login")
requested := c.Request.URL.RequestURI()
q := url.Values{}
if requested != "" {
q.Set("return_to", requested)
}
loginURL := s.config.URLPrefix + "/editor/login"
if qs := q.Encode(); qs != "" {
loginURL = loginURL + "?" + qs
}
c.Redirect(http.StatusFound, loginURL)
c.Abort()
return
}

13
web/templates/base.html
View File

@@ -328,13 +328,18 @@
<!-- Breadcrumbs -->
{{if .breadcrumbs}}
<div class="bg-slate-800 border-b border-gray-700 px-6 py-3">
<nav class="flex items-center space-x-2 text-sm">
<nav class="flex items-center flex-wrap gap-1.5 text-sm">
{{range $i, $crumb := .breadcrumbs}}
{{if $i}}<i class="fas fa-chevron-right text-gray-500 text-xs"></i>{{end}}
{{if $i}}<i class="fas fa-chevron-right text-gray-500 text-xs mx-1"></i>{{end}}
{{if $crumb.URL}}
<a href="{{url $crumb.URL}}" class="text-blue-400 hover:text-blue-300 transition-colors">{{$crumb.Name}}</a>
<a href="{{url $crumb.URL}}" class="inline-flex items-center px-2.5 py-1 rounded-md border border-slate-600 bg-slate-700/40 text-blue-300 hover:bg-slate-700 hover:text-blue-200 transition-colors" aria-label="Breadcrumb: {{$crumb.Name}}">
{{if and (eq $i 0) (eq $crumb.Name "/")}}<i class="fas fa-folder-tree mr-1.5"></i>{{end}}
<span class="leading-none">{{$crumb.Name}}</span>
</a>
{{else}}
<span class="text-gray-300">{{$crumb.Name}}</span>
<span class="inline-flex items-center px-2.5 py-1 rounded-md border border-slate-600 bg-slate-700/60 text-gray-200">
<span class="leading-none">{{$crumb.Name}}</span>
</span>
{{end}}
{{end}}
</nav>

7
web/templates/create.html
View File

@@ -263,7 +263,12 @@ console.log('Hello, World!');
formData.append('path', uploadPath);
try {
const resp = await fetch(window.prefix('/upload'), { method: 'POST', body: formData });
const csrf = (document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1] ? decodeURIComponent((document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1]) : '';
const resp = await fetch(window.prefix('/editor/upload'), {
method: 'POST',
headers: csrf ? { 'X-CSRF-Token': csrf } : {},
body: formData
});
const data = await resp.json();
if (!resp.ok || !data.success) throw new Error(data.error || 'Upload failed');

7
web/templates/edit.html
View File

@@ -300,7 +300,12 @@
formData.append('path', uploadPath);
try {
const resp = await fetch(window.prefix('/upload'), { method: 'POST', body: formData });
const csrf = (document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1] ? decodeURIComponent((document.cookie.match(/(?:^|; )csrf_token=([^;]+)/)||[])[1]) : '';
const resp = await fetch(window.prefix('/editor/upload'), {
method: 'POST',
headers: csrf ? { 'X-CSRF-Token': csrf } : {},
body: formData
});
const data = await resp.json();
if (!resp.ok || !data.success) throw new Error(data.error || 'Upload failed');

16
web/templates/folder.html
View File

@@ -22,6 +22,7 @@
{{end}}
</p>
</div>
{{if .Authenticated}}
<div class="flex items-center space-x-3">
<button id="upload-btn" class="btn-primary">
<i class="fas fa-upload mr-2"></i>Upload File
@@ -30,6 +31,7 @@
<i class="fas fa-plus mr-2"></i>New Note
</a>
</div>
{{end}}
</div>
<!-- Upload Area (hidden by default) -->
@@ -69,6 +71,7 @@
</div>
</div>
<div class="flex items-center space-x-2">
{{if $.Authenticated}}
{{if eq .Type "md"}}
<a href="{{url (print "/editor/edit/" .Path)}}" class="text-blue-400 hover:text-blue-300 p-2" title="Edit">
<i class="fas fa-edit"></i>
@@ -79,6 +82,7 @@
<i class="fas fa-edit"></i>
</a>
{{end}}
{{end}}
{{if eq .Type "image"}}
<a href="{{url (print "/serve_attached_image/" .Path)}}" target="_blank" class="text-yellow-400 hover:text-yellow-300 p-2" title="View">
<i class="fas fa-eye"></i>
@@ -89,9 +93,11 @@
<i class="fas fa-download"></i>
</a>
{{end}}
{{if $.Authenticated}}
<button class="text-red-400 hover:text-red-300 p-2 delete-btn" data-path="{{.Path}}" title="Delete">
<i class="fas fa-trash"></i>
</button>
{{end}}
</div>
</div>
</div>
@@ -132,22 +138,29 @@
let deleteTarget = null;
// Toggle upload area
if (uploadBtn) {
uploadBtn.addEventListener('click', function() {
uploadArea.classList.toggle('hidden');
uploadArea && uploadArea.classList.toggle('hidden');
});
}
// File selection
if (selectFilesBtn && fileInput) {
selectFilesBtn.addEventListener('click', function() {
fileInput.click();
});
}
if (fileInput) {
fileInput.addEventListener('change', function() {
if (this.files.length > 0) {
uploadFiles(this.files);
}
});
}
// Drag and drop
if (uploadArea) {
uploadArea.addEventListener('dragover', function(e) {
e.preventDefault();
this.classList.add('dragover');
@@ -165,6 +178,7 @@
uploadFiles(e.dataTransfer.files);
}
});
}
// Upload files function
function uploadFiles(files) {

3
web/templates/login.html
View File

@@ -10,6 +10,9 @@
{{end}}
<form method="POST" action="{{url "/editor/login"}}" class="space-y-4">
<input type="hidden" name="csrf_token" value="{{.csrf_token}}" />
{{if .return_to}}
<input type="hidden" name="return_to" value="{{.return_to}}" />
{{end}}
<div>
<label class="block text-sm text-gray-300 mb-1" for="username">Username or Email</label>
<input id="username" name="username" type="text" required class="w-full bg-gray-700 border border-gray-600 rounded px-3 py-2 text-white" />