From 47092bfa9bc7bddde04d20c48527382cc14ded52 Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Thu, 26 May 2022 16:27:44 +0200 Subject: [PATCH] Implement flash messages - configure session cookie security - setup flash message handling in newTemplateData - show flash message in base.html - add flash message for new motion --- cmd/boardvoting/handlers.go | 5 +- cmd/boardvoting/main.go | 2 + cmd/boardvoting/routes.go | 9 ++-- ui/html/base.html | 94 ++++++++++++++++++------------------- 4 files changed, 56 insertions(+), 54 deletions(-) diff --git a/cmd/boardvoting/handlers.go b/cmd/boardvoting/handlers.go index 5b9af8e..374239e 100644 --- a/cmd/boardvoting/handlers.go +++ b/cmd/boardvoting/handlers.go @@ -109,7 +109,7 @@ type templateData struct { Motion *models.MotionForDisplay Motions []*models.MotionForDisplay Request *http.Request - Flashes []string + Flash string Form any ActiveNav topLevelNavItem ActiveSubNav subLevelNavItem @@ -130,6 +130,7 @@ func (app *application) newTemplateData( User: user, ActiveNav: nav, ActiveSubNav: subNav, + Flash: app.sessionManager.PopString(r.Context(), "flash"), } } @@ -434,7 +435,7 @@ func (app *application) newMotionSubmit(w http.ResponseWriter, r *http.Request) decision: &models.NewMotion{Decision: decision, Proposer: user}, } - // TODO: add flash message for new motion + app.sessionManager.Put(r.Context(), "flash", fmt.Sprintf("Started new motion %s: %s", decision.Tag, decision.Title)) http.Redirect(w, r, fmt.Sprintf("/motions/%s", decision.Tag), http.StatusSeeOther) } diff --git a/cmd/boardvoting/main.go b/cmd/boardvoting/main.go index 5eee7dd..0728bd0 100644 --- a/cmd/boardvoting/main.go +++ b/cmd/boardvoting/main.go @@ -99,6 +99,8 @@ func main() { sessionManager := scs.New() sessionManager.Store = sqlite3store.New(db.DB) sessionManager.Lifetime = sessionHours * time.Hour + sessionManager.Cookie.SameSite = http.SameSiteStrictMode + sessionManager.Cookie.Secure = true app := &application{ errorLog: errorLog, diff --git a/cmd/boardvoting/routes.go b/cmd/boardvoting/routes.go index 8e0e49f..013b8d5 100644 --- a/cmd/boardvoting/routes.go +++ b/cmd/boardvoting/routes.go @@ -61,15 +61,16 @@ func (app *application) routes() http.Handler { ) router.Handler(http.MethodGet, "/static/*filepath", http.StripPrefix("/static", fileServer)) + csrfHandler := csrf.Protect(app.csrfKey, csrf.SameSite(csrf.SameSiteStrictMode)) + dynamic := alice.New( app.sessionManager.LoadAndSave, - csrf.Protect(app.csrfKey, csrf.SameSite(csrf.SameSiteStrictMode)), app.tryAuthenticate, ) - canVote := dynamic.Append(app.userCanVote) - canEditVote := dynamic.Append(app.userCanEditVote) - canManageUsers := dynamic.Append(app.userCanChangeVoters) + canVote := dynamic.Append(app.userCanVote, csrfHandler) + canEditVote := dynamic.Append(app.userCanEditVote, csrfHandler) + canManageUsers := dynamic.Append(app.userCanChangeVoters, csrfHandler) router.Handler(http.MethodGet, "/motions/", dynamic.ThenFunc(app.motionList)) router.Handler(http.MethodGet, "/motions/:tag", dynamic.ThenFunc(app.motionDetails)) diff --git a/ui/html/base.html b/ui/html/base.html index 502a704..be12bbf 100644 --- a/ui/html/base.html +++ b/ui/html/base.html @@ -1,54 +1,52 @@ {{ define "base" }} - - - - - {{ template "title" . }} - CAcert Board Voting System - - - - - -
-
-
- CAcert -
-
-

- {{ template "title" . }} - {{ if .User }} - Authenticated as {{ .User.Name }} <{{ .User.Reminder }}> + + + + + {{ template "title" . }} - CAcert Board Voting System + + + + + +
+
+
+ CAcert +
+
+

+ {{ template "title" . }} + {{ if .User }} + Authenticated as {{ .User.Name }} <{{ .User.Reminder }}> - {{ end }} -

-
-
-
-{{ template "nav" . }} -
- {{ template "main" . }} - {{ with .Flashes }} -
-
- -
- {{ range . }} -
{{ . }}
{{ end }} -
+

- {{ end }} - -
-
- © 2017-2022 CAcert Inc. -
-
- - - - - +
+ {{ template "nav" . }} +
+ {{ with .Flash }} +
+
+ +
+
{{ . }}
+
+
+
+ {{ end }} + {{ template "main" . }} +
+ + + + + + {{ end }} \ No newline at end of file