From 088294d36e6061f4860db0d909e57650d7e4d157 Mon Sep 17 00:00:00 2001 From: Umputun Date: Sat, 6 Jul 2019 18:56:49 -0500 Subject: [PATCH] switch to go-pkgz/auth v0.7.2 with limited verification token --- backend/go.mod | 4 ++-- backend/go.sum | 8 ++++---- backend/vendor/github.com/go-pkgz/auth/provider/verify.go | 6 ++++++ backend/vendor/modules.txt | 4 ++-- 4 files changed, 14 insertions(+), 8 deletions(-) diff --git a/backend/go.mod b/backend/go.mod index 1c4b9f3c..658a35e1 100644 --- a/backend/go.mod +++ b/backend/go.mod @@ -14,7 +14,7 @@ require ( github.com/go-chi/chi v4.0.2+incompatible github.com/go-chi/cors v1.0.0 github.com/go-chi/render v1.0.1 - github.com/go-pkgz/auth v0.7.1 + github.com/go-pkgz/auth v0.7.2 github.com/go-pkgz/lcw v0.3.1 github.com/go-pkgz/lgr v0.6.3 github.com/go-pkgz/repeater v1.1.2 @@ -33,7 +33,7 @@ require ( github.com/stretchr/objx v0.2.0 // indirect github.com/stretchr/testify v1.3.0 golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 - golang.org/x/image v0.0.0-20190622003408-7e034cad6442 + golang.org/x/image v0.0.0-20190703141733-d6a02ce849c9 golang.org/x/net v0.0.0-20190628185345-da137c7871d7 golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb // indirect gopkg.in/russross/blackfriday.v2 v2.0.1 diff --git a/backend/go.sum b/backend/go.sum index 30d27359..9302d460 100644 --- a/backend/go.sum +++ b/backend/go.sum @@ -32,8 +32,8 @@ github.com/go-chi/cors v1.0.0 h1:e6x8k7uWbUwYs+aXDoiUzeQFT6l0cygBYyNhD7/1Tg0= github.com/go-chi/cors v1.0.0/go.mod h1:K2Yje0VW/SJzxiyMYu6iPQYa7hMjQX2i/F491VChg1I= github.com/go-chi/render v1.0.1 h1:4/5tis2cKaNdnv9zFLfXzcquC9HbeZgCnxGnKrltBS8= github.com/go-chi/render v1.0.1/go.mod h1:pq4Rr7HbnsdaeHagklXub+p6Wd16Af5l9koip1OvJns= -github.com/go-pkgz/auth v0.7.1 h1:Kv8NOvwY8iN9Hz47Q1kP7Dp43mLohWDAeWE8qS+ofY0= -github.com/go-pkgz/auth v0.7.1/go.mod h1:ibOpZYISiaOvAHe2bsKj2s3v4AkMam2WxxIFn+zhulo= +github.com/go-pkgz/auth v0.7.2 h1:+LvAgqwQtYuWphpZE8qLtspVd65+VgreJkFLsKrtmmk= +github.com/go-pkgz/auth v0.7.2/go.mod h1:ibOpZYISiaOvAHe2bsKj2s3v4AkMam2WxxIFn+zhulo= github.com/go-pkgz/lcw v0.3.1 h1:PhfB0xNUawLMlx5rXvOTIc7d5LMrr1GM9vIzmG96aUI= github.com/go-pkgz/lcw v0.3.1/go.mod h1:k+PY1CkCMTLXILtFoJOyK65Qqi9rkoTYunFH1vE/C0I= github.com/go-pkgz/lgr v0.2.2/go.mod h1:hBM1NM/SoYdlrykgdgJWGrZ/TM/XaZIjRbJfx7NkMm8= @@ -127,8 +127,8 @@ golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxT golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= golang.org/x/image v0.0.0-20190523035834-f03afa92d3ff h1:+2zgJKVDVAz/BWSsuniCmU1kLCjL88Z8/kv39xCI9NQ= golang.org/x/image v0.0.0-20190523035834-f03afa92d3ff/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js= -golang.org/x/image v0.0.0-20190622003408-7e034cad6442 h1:KHkZ9SH+rcDwdj29lcYkks2agONXqNa8YkEGwGhY6Sg= -golang.org/x/image v0.0.0-20190622003408-7e034cad6442/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= +golang.org/x/image v0.0.0-20190703141733-d6a02ce849c9 h1:uc17S921SPw5F2gJo7slQ3aqvr2RwpL7eb3+DZncu3s= +golang.org/x/image v0.0.0-20190703141733-d6a02ce849c9/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0= golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU= golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE= diff --git a/backend/vendor/github.com/go-pkgz/auth/provider/verify.go b/backend/vendor/github.com/go-pkgz/auth/provider/verify.go index 07a6005c..fe9bb269 100644 --- a/backend/vendor/github.com/go-pkgz/auth/provider/verify.go +++ b/backend/vendor/github.com/go-pkgz/auth/provider/verify.go @@ -47,6 +47,7 @@ func (f SenderFunc) Send(address string, text string) error { type VerifTokenService interface { Token(claims token.Claims) (string, error) Parse(tokenString string) (claims token.Claims, err error) + IsExpired(claims token.Claims) bool Set(w http.ResponseWriter, claims token.Claims) (token.Claims, error) Reset(w http.ResponseWriter) } @@ -73,6 +74,11 @@ func (e VerifyHandler) LoginHandler(w http.ResponseWriter, r *http.Request) { return } + if e.TokenService.IsExpired(confClaims) { + rest.SendErrorJSON(w, r, e.L, http.StatusForbidden, errors.New("expired"), "failed to verify confirmation token") + return + } + elems := strings.Split(confClaims.Handshake.ID, "::") if len(elems) != 2 { rest.SendErrorJSON(w, r, e.L, http.StatusBadRequest, errors.New(confClaims.Handshake.ID), "invalid handshake token") diff --git a/backend/vendor/modules.txt b/backend/vendor/modules.txt index b12227a3..33b0329c 100644 --- a/backend/vendor/modules.txt +++ b/backend/vendor/modules.txt @@ -30,7 +30,7 @@ github.com/go-chi/chi/middleware github.com/go-chi/cors # github.com/go-chi/render v1.0.1 github.com/go-chi/render -# github.com/go-pkgz/auth v0.7.1 +# github.com/go-pkgz/auth v0.7.2 github.com/go-pkgz/auth github.com/go-pkgz/auth/avatar github.com/go-pkgz/auth/provider @@ -93,7 +93,7 @@ github.com/stretchr/testify/require # golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4 golang.org/x/crypto/acme/autocert golang.org/x/crypto/acme -# golang.org/x/image v0.0.0-20190622003408-7e034cad6442 +# golang.org/x/image v0.0.0-20190703141733-d6a02ce849c9 golang.org/x/image/draw golang.org/x/image/math/f64 # golang.org/x/net v0.0.0-20190628185345-da137c7871d7