aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--conf/app.ini4
-rw-r--r--modules/auth/auth.go1
-rw-r--r--modules/base/conf.go8
-rw-r--r--modules/middleware/context.go43
-rw-r--r--routers/user/user.go42
-rw-r--r--templates/user/signin.tmpl11
6 files changed, 108 insertions, 1 deletions
diff --git a/conf/app.ini b/conf/app.ini
index ec5fcb23b3..7f283012fd 100644
--- a/conf/app.ini
+++ b/conf/app.ini
@@ -34,6 +34,10 @@ PATH = data/gogs.db
[security]
; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
SECRET_KEY = !#@FDEWREWR&*(
+; Auto-login remember days
+LOGIN_REMEMBER_DAYS = 7
+COOKIE_USERNAME = gogs_awesome
+COOKIE_REMEMBER_NAME = gogs_incredible
[service]
ACTIVE_CODE_LIVE_MINUTES = 180
diff --git a/modules/auth/auth.go b/modules/auth/auth.go
index 0e87168891..2e0555f6df 100644
--- a/modules/auth/auth.go
+++ b/modules/auth/auth.go
@@ -61,6 +61,7 @@ func (f *RegisterForm) Validate(errors *binding.Errors, req *http.Request, conte
type LogInForm struct {
UserName string `form:"username" binding:"Required;AlphaDash;MaxSize(30)"`
Password string `form:"passwd" binding:"Required;MinSize(6);MaxSize(30)"`
+ Remember string `form:"remember"`
}
func (f *LogInForm) Name(field string) string {
diff --git a/modules/base/conf.go b/modules/base/conf.go
index 7c8ed93654..cdbe2b36ce 100644
--- a/modules/base/conf.go
+++ b/modules/base/conf.go
@@ -38,6 +38,10 @@ var (
RunUser string
RepoRootPath string
+ LogInRememberDays int
+ CookieUserName string
+ CookieRememberName string
+
Cfg *goconfig.ConfigFile
MailService *Mailer
@@ -252,6 +256,10 @@ func NewConfigContext() {
SecretKey = Cfg.MustValue("security", "SECRET_KEY")
RunUser = Cfg.MustValue("", "RUN_USER")
+ LogInRememberDays = Cfg.MustInt("security", "LOGIN_REMEMBER_DAYS")
+ CookieUserName = Cfg.MustValue("security", "COOKIE_USERNAME")
+ CookieRememberName = Cfg.MustValue("security", "COOKIE_REMEMBER_NAME")
+
PictureService = Cfg.MustValue("picture", "SERVICE")
PictureRootPath = Cfg.MustValue("picture", "PATH")
diff --git a/modules/middleware/context.go b/modules/middleware/context.go
index 5727b4f094..d81ab999bf 100644
--- a/modules/middleware/context.go
+++ b/modules/middleware/context.go
@@ -5,9 +5,14 @@
package middleware
import (
+ "crypto/hmac"
+ "crypto/sha1"
+ "encoding/base64"
"fmt"
"html/template"
"net/http"
+ "strconv"
+ "strings"
"time"
"github.com/codegangsta/martini"
@@ -155,6 +160,44 @@ func (ctx *Context) SetCookie(name string, value string, others ...interface{})
ctx.Res.Header().Add("Set-Cookie", cookie.String())
}
+// Get secure cookie from request by a given key.
+func (ctx *Context) GetSecureCookie(Secret, key string) (string, bool) {
+ val := ctx.GetCookie(key)
+ if val == "" {
+ return "", false
+ }
+
+ parts := strings.SplitN(val, "|", 3)
+
+ if len(parts) != 3 {
+ return "", false
+ }
+
+ vs := parts[0]
+ timestamp := parts[1]
+ sig := parts[2]
+
+ h := hmac.New(sha1.New, []byte(Secret))
+ fmt.Fprintf(h, "%s%s", vs, timestamp)
+
+ if fmt.Sprintf("%02x", h.Sum(nil)) != sig {
+ return "", false
+ }
+ res, _ := base64.URLEncoding.DecodeString(vs)
+ return string(res), true
+}
+
+// Set Secure cookie for response.
+func (ctx *Context) SetSecureCookie(Secret, name, value string, others ...interface{}) {
+ vs := base64.URLEncoding.EncodeToString([]byte(value))
+ timestamp := strconv.FormatInt(time.Now().UnixNano(), 10)
+ h := hmac.New(sha1.New, []byte(Secret))
+ fmt.Fprintf(h, "%s%s", vs, timestamp)
+ sig := fmt.Sprintf("%02x", h.Sum(nil))
+ cookie := strings.Join([]string{vs, timestamp, sig}, "|")
+ ctx.SetCookie(name, cookie, others...)
+}
+
func (ctx *Context) CsrfToken() string {
if len(ctx.csrfToken) > 0 {
return ctx.csrfToken
diff --git a/routers/user/user.go b/routers/user/user.go
index 2244697714..56bc5f8e37 100644
--- a/routers/user/user.go
+++ b/routers/user/user.go
@@ -77,7 +77,39 @@ func SignIn(ctx *middleware.Context, form auth.LogInForm) {
ctx.Data["Title"] = "Log In"
if ctx.Req.Method == "GET" {
- ctx.HTML(200, "user/signin")
+ // Check auto-login.
+ userName := ctx.GetCookie(base.CookieUserName)
+ if len(userName) == 0 {
+ ctx.HTML(200, "user/signin")
+ return
+ }
+
+ isSucceed := false
+ defer func() {
+ if !isSucceed {
+ log.Trace("%s auto-login cookie cleared: %s", ctx.Req.RequestURI, userName)
+ ctx.SetCookie(base.CookieUserName, "", -1)
+ ctx.SetCookie(base.CookieRememberName, "", -1)
+ }
+ }()
+
+ user, err := models.GetUserByName(userName)
+ if err != nil {
+ ctx.HTML(200, "user/signin")
+ return
+ }
+
+ secret := base.EncodeMd5(user.Rands + user.Passwd)
+ value, _ := ctx.GetSecureCookie(secret, base.CookieRememberName)
+ if value != user.Name {
+ ctx.HTML(200, "user/signin")
+ return
+ }
+
+ isSucceed = true
+ ctx.Session.Set("userId", user.Id)
+ ctx.Session.Set("userName", user.Name)
+ ctx.Redirect("/")
return
}
@@ -89,6 +121,7 @@ func SignIn(ctx *middleware.Context, form auth.LogInForm) {
user, err := models.LoginUserPlain(form.UserName, form.Password)
if err != nil {
if err == models.ErrUserNotExist {
+ log.Trace("%s Log in failed: %s/%s", ctx.Req.RequestURI, form.UserName, form.Password)
ctx.RenderWithErr("Username or password is not correct", "user/signin", &form)
return
}
@@ -97,6 +130,13 @@ func SignIn(ctx *middleware.Context, form auth.LogInForm) {
return
}
+ if form.Remember == "on" {
+ secret := base.EncodeMd5(user.Rands + user.Passwd)
+ days := 86400 * base.LogInRememberDays
+ ctx.SetCookie(base.CookieUserName, user.Name, days)
+ ctx.SetSecureCookie(secret, base.CookieRememberName, user.Name, days)
+ }
+
ctx.Session.Set("userId", user.Id)
ctx.Session.Set("userName", user.Name)
ctx.Redirect("/")
diff --git a/templates/user/signin.tmpl b/templates/user/signin.tmpl
index 8dc7292ff8..1cd3275cce 100644
--- a/templates/user/signin.tmpl
+++ b/templates/user/signin.tmpl
@@ -20,6 +20,17 @@
</div>
<div class="form-group">
+ <div class="col-md-6 col-md-offset-4">
+ <div class="checkbox">
+ <label>
+ <input type="checkbox" name="remember" {{if .remember}}checked{{end}}>
+ <strong>Remember me</strong>
+ </label>
+ </div>
+ </div>
+ </div>
+
+ <div class="form-group">
<div class="col-md-offset-4 col-md-6">
<button type="submit" class="btn btn-lg btn-primary">Log In</button>
<a href="/forget-password/">Forgot your password?</a>
generated by cgit v1.2.3 (git 2.39.1) at 2025-03-03 20:27:46 +0000