diff --git a/admin/accounthttp.go b/admin/accounthttp.go index 634bae6..113a17a 100644 --- a/admin/accounthttp.go +++ b/admin/accounthttp.go @@ -20,7 +20,7 @@ func accountHandler(app *model.AppState) http.Handler { mux.Handle("/account/totp-setup", totpSetupHandler(app)) mux.Handle("/account/totp-confirm", totpConfirmHandler(app)) - mux.Handle("/account/totp-delete/", http.StripPrefix("/totp-delete", totpDeleteHandler(app))) + mux.Handle("/account/totp-delete", totpDeleteHandler(app)) mux.Handle("/account/password", changePasswordHandler(app)) mux.Handle("/account/delete", deleteAccountHandler(app)) @@ -266,11 +266,6 @@ func totpConfirmHandler(app *model.AppState) http.Handler { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) return } - code := r.FormValue("totp") - if len(code) != controller.TOTP_CODE_LENGTH { - http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) - return - } totp, err := controller.GetTOTP(app.DB, session.Account.ID, name) if err != nil { @@ -290,23 +285,22 @@ func totpConfirmHandler(app *model.AppState) http.Handler { fmt.Fprintf(os.Stderr, "WARN: Failed to generate TOTP QR code: %v\n", err) } + code := r.FormValue("totp") confirmCode := controller.GenerateTOTP(totp.Secret, 0) - if code != confirmCode { - confirmCodeOffset := controller.GenerateTOTP(totp.Secret, 1) - if code != confirmCodeOffset { - session.Error = sql.NullString{ Valid: true, String: "Incorrect TOTP code. Please try again." } - err = templates.TOTPConfirmTemplate.Execute(w, totpConfirmData{ - adminPageData: adminPageData{ Path: r.URL.Path, Session: session }, - TOTP: totp, - NameEscaped: url.PathEscape(totp.Name), - QRBase64Image: qrBase64Image, - }) - if err != nil { - fmt.Fprintf(os.Stderr, "WARN: Failed to render TOTP setup page: %v\n", err) - http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError) - } - return + confirmCodeOffset := controller.GenerateTOTP(totp.Secret, 1) + if len(code) != controller.TOTP_CODE_LENGTH || (code != confirmCode && code != confirmCodeOffset) { + session.Error = sql.NullString{ Valid: true, String: "Incorrect TOTP code. Please try again." } + err = templates.TOTPConfirmTemplate.Execute(w, totpConfirmData{ + adminPageData: adminPageData{ Path: r.URL.Path, Session: session }, + TOTP: totp, + NameEscaped: url.PathEscape(totp.Name), + QRBase64Image: qrBase64Image, + }) + if err != nil { + fmt.Fprintf(os.Stderr, "WARN: Failed to render TOTP setup page: %v\n", err) + http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError) } + return } err = controller.ConfirmTOTP(app.DB, session.Account.ID, name) @@ -327,18 +321,23 @@ func totpConfirmHandler(app *model.AppState) http.Handler { func totpDeleteHandler(app *model.AppState) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - if r.Method != http.MethodGet { + if r.Method != http.MethodPost { http.NotFound(w, r) return } - if len(r.URL.Path) < 2 { + session := r.Context().Value("session").(*model.Session) + + err := r.ParseForm() + if err != nil { + http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) + return + } + name := r.FormValue("totp-name") + if len(name) == 0 { http.Error(w, http.StatusText(http.StatusBadRequest), http.StatusBadRequest) return } - name := r.URL.Path[1:] - - session := r.Context().Value("session").(*model.Session) totp, err := controller.GetTOTP(app.DB, session.Account.ID, name) if err != nil { diff --git a/admin/static/admin.css b/admin/static/admin.css index 7fafa03..60e06c2 100644 --- a/admin/static/admin.css +++ b/admin/static/admin.css @@ -309,6 +309,7 @@ header :is(h1, h2, h3) small, margin: 0 0 1em 0; padding: 1em; border-radius: 8px; + color: #101010; background: #ffffff; } #message { @@ -379,21 +380,25 @@ button:active, .button:active { form { width: 100%; display: block; + color: var(--fg-0); } form label { width: 100%; margin: 1rem 0 .5rem 0; display: block; - color: #10101080; } form input { - margin: .5rem 0; - padding: .3rem .5rem; + min-width: 20rem; + max-width: calc(100% - 1em)); + margin: .5em 0; + padding: .3em .5em; display: block; border-radius: 4px; + border: 1px solid #808080; font-size: inherit; font-family: inherit; color: inherit; + background-color: var(--bg-0); } input[disabled] { opacity: .5; diff --git a/admin/static/edit-account.css b/admin/static/edit-account.css index 9db3773..9ca4f05 100644 --- a/admin/static/edit-account.css +++ b/admin/static/edit-account.css @@ -11,7 +11,8 @@ label { align-items: center; color: inherit; } -input { +form#change-password input, +form#delete-account input { width: min(20rem, calc(100% - 1rem)); margin: .5rem 0; padding: .3rem .5rem; @@ -48,3 +49,7 @@ input { .mfa-device .mfa-device-name { font-weight: bold; } + +.mfa-device form input { + display: none; +} diff --git a/admin/templates/html/artists.html b/admin/templates/html/artists.html index 7652d78..8364143 100644 --- a/admin/templates/html/artists.html +++ b/admin/templates/html/artists.html @@ -1,7 +1,6 @@ {{define "head"}} Artists - ari melody 💫 - {{end}} diff --git a/admin/templates/html/edit-account.html b/admin/templates/html/edit-account.html index a081995..a4c8196 100644 --- a/admin/templates/html/edit-account.html +++ b/admin/templates/html/edit-account.html @@ -28,6 +28,8 @@ +
+ @@ -44,7 +46,10 @@

Added: {{.CreatedAtString}}

- Delete +
+ + +
{{end}} @@ -67,13 +72,15 @@ This action is irreversible. You will need to enter your password and TOTP below.

-
+ +
+
diff --git a/admin/templates/html/index.html b/admin/templates/html/index.html index 4387c31..1e788d5 100644 --- a/admin/templates/html/index.html +++ b/admin/templates/html/index.html @@ -1,7 +1,6 @@ {{define "head"}} Admin - ari melody 💫 - diff --git a/admin/templates/html/login-totp.html b/admin/templates/html/login-totp.html index 33e8c88..e2fa5ee 100644 --- a/admin/templates/html/login-totp.html +++ b/admin/templates/html/login-totp.html @@ -1,7 +1,6 @@ {{define "head"}} Login - ari melody 💫 - {{end}} {{define "content"}}
+

Two-Factor Authentication

+ {{if .Session.Error.Valid}}

{{html .Session.Error.String}}

{{end}} @@ -40,7 +48,14 @@ code {

{{.TOTP.Secret}}

- + diff --git a/admin/templates/html/totp-setup.html b/admin/templates/html/totp-setup.html index e74c970..9fcda9d 100644 --- a/admin/templates/html/totp-setup.html +++ b/admin/templates/html/totp-setup.html @@ -1,11 +1,12 @@ {{define "head"}} TOTP Setup - ari melody 💫 - {{end}} {{define "content"}}
+

Two-Factor Authentication

+ {{if .Session.Error.Valid}}

{{html .Session.Error.String}}

{{end}} diff --git a/admin/templates/html/tracks.html b/admin/templates/html/tracks.html index c470297..7fe9fd2 100644 --- a/admin/templates/html/tracks.html +++ b/admin/templates/html/tracks.html @@ -1,7 +1,6 @@ {{define "head"}} Releases - ari melody 💫 - {{end}}