diff --git a/app/http/endpoints/manage/logs.go b/app/http/endpoints/manage/logs.go index d70635d..7b68ec8 100644 --- a/app/http/endpoints/manage/logs.go +++ b/app/http/endpoints/manage/logs.go @@ -98,6 +98,7 @@ func LogsHandler(ctx *gin.Context) { utils.Respond(ctx, template.TemplateLogs.Render(map[string]interface{}{ "name": store.Get("name").(string), "guildId": guildIdStr, + "avatar": store.Get("avatar").(string), "baseUrl": config.Conf.Server.BaseUrl, "isPageOne": page == 1, "previousPage": page - 1, diff --git a/app/http/endpoints/manage/settings.go b/app/http/endpoints/manage/settings.go index a6fa4b8..78627c4 100644 --- a/app/http/endpoints/manage/settings.go +++ b/app/http/endpoints/manage/settings.go @@ -3,7 +3,6 @@ package manage import ( "encoding/base64" "encoding/json" - "fmt" "github.com/TicketsBot/GoPanel/app/http/template" "github.com/TicketsBot/GoPanel/config" "github.com/TicketsBot/GoPanel/database/table" @@ -54,9 +53,12 @@ func SettingsHandler(ctx *gin.Context) { return } + // Get CSRF token + csrfCorrect := ctx.Query("csrf") == store.Get("csrf").(string) + // Get prefix prefix := ctx.Query("prefix") - if prefix == "" { + if prefix == "" || len(prefix) > 8 || !csrfCorrect { prefix = table.GetPrefix(guildId) } else { table.UpdatePrefix(guildId, prefix) @@ -64,7 +66,7 @@ func SettingsHandler(ctx *gin.Context) { // Get welcome message welcomeMessage := ctx.Query("welcomeMessage") - if welcomeMessage == "" { + if welcomeMessage == "" || len(welcomeMessage) > 1000 || !csrfCorrect { welcomeMessage = table.GetWelcomeMessage(guildId) } else { table.UpdateWelcomeMessage(guildId, welcomeMessage) @@ -80,8 +82,13 @@ func SettingsHandler(ctx *gin.Context) { } // Update limit, or get current limit if user input is invalid - if limitStr == "" || !utils.IsInt(limitStr) { + invalidTicketLimit := false + if limitStr == "" || !utils.IsInt(limitStr) || limit > 10 || limit < 1 || !csrfCorrect { limit = table.GetTicketLimit(guildId) + + if limitStr != "" { // User wasn't setting anything + invalidTicketLimit = true + } } else { table.UpdateTicketLimit(guildId, limit) } @@ -120,7 +127,9 @@ func SettingsHandler(ctx *gin.Context) { if err != nil { log.Error(err.Error()) } else { - table.UpdateGuilds(userIdStr, base64.StdEncoding.EncodeToString(marshalled)) + if csrfCorrect { + table.UpdateGuilds(userIdStr, base64.StdEncoding.EncodeToString(marshalled)) + } } } } @@ -144,7 +153,7 @@ func SettingsHandler(ctx *gin.Context) { } // Update category, or get current category if user input is invalid - if categoryStr == "" || !utils.IsInt(categoryStr) || !utils.Contains(categoryIds, categoryStr) { + if categoryStr == "" || !utils.IsInt(categoryStr) || !utils.Contains(categoryIds, categoryStr) || !csrfCorrect { category = table.GetChannelCategory(guildId) } else { table.UpdateChannelCategory(guildId, category) @@ -175,7 +184,7 @@ func SettingsHandler(ctx *gin.Context) { archiveChannel, _ = strconv.ParseInt(archiveChannelStr, 10, 64) } - if archiveChannelStr == "" || !utils.IsInt(archiveChannelStr) || !utils.Contains(channelIds, archiveChannelStr) { + if archiveChannelStr == "" || !utils.IsInt(archiveChannelStr) || !utils.Contains(channelIds, archiveChannelStr) || !csrfCorrect { archiveChannel = table.GetArchiveChannel(guildId) } else { table.UpdateArchiveChannel(guildId, archiveChannel) @@ -184,9 +193,6 @@ func SettingsHandler(ctx *gin.Context) { // Format channels for templating var formattedChannels []map[string]interface{} for _, c := range guild.Channels { - if c.Id == strconv.Itoa(int(archiveChannel)) { - fmt.Println(c.Name) - } if c.Type == 0 { formattedChannels = append(formattedChannels, map[string]interface{}{ "channelid": c.Id, @@ -199,11 +205,16 @@ func SettingsHandler(ctx *gin.Context) { utils.Respond(ctx, template.TemplateSettings.Render(map[string]interface{}{ "name": store.Get("name").(string), "guildId": guildIdStr, + "avatar": store.Get("avatar").(string), "prefix": prefix, "welcomeMessage": welcomeMessage, "ticketLimit": limit, "categories": formattedCategories, "channels": formattedChannels, + "invalidPrefix": len(ctx.Query("prefix")) > 8, + "invalidWelcomeMessage": len(ctx.Query("welcomeMessage")) > 1000, + "invalidTicketLimit": invalidTicketLimit, + "csrf": store.Get("csrf").(string), })) } else { ctx.Redirect(302, "/login") diff --git a/app/http/endpoints/root/callback.go b/app/http/endpoints/root/callback.go index c6145f6..47f5fca 100644 --- a/app/http/endpoints/root/callback.go +++ b/app/http/endpoints/root/callback.go @@ -3,6 +3,7 @@ package root import ( "encoding/base64" "encoding/json" + "fmt" "github.com/TicketsBot/GoPanel/config" "github.com/TicketsBot/GoPanel/database/table" "github.com/TicketsBot/GoPanel/utils" @@ -69,8 +70,11 @@ func CallbackHandler(ctx *gin.Context) { return } + store.Set("csrf", utils.RandStringRunes(32)) + store.Set("userid", currentUser.Id) store.Set("name", currentUser.Username) + store.Set("avatar", fmt.Sprintf("https://cdn.discordapp.com/avatars/%s/%s.webp", currentUser.Id, currentUser.Avatar)) if err = store.Save(); err != nil { log.Error(err.Error()) } diff --git a/app/http/endpoints/root/index.go b/app/http/endpoints/root/index.go index 5ef8808..2416bbd 100644 --- a/app/http/endpoints/root/index.go +++ b/app/http/endpoints/root/index.go @@ -55,6 +55,8 @@ func IndexHandler(ctx *gin.Context) { "baseurl": config.Conf.Server.BaseUrl, "servers": servers, "empty": len(servers) == 0, + "isIndex": true, + "avatar": store.Get("avatar").(string), })) } else { ctx.Redirect(302, "/login") diff --git a/app/http/template/template.go b/app/http/template/template.go index 74eb450..4d79bde 100644 --- a/app/http/template/template.go +++ b/app/http/template/template.go @@ -16,6 +16,7 @@ type Template struct { var ( LayoutMain Layout + LayoutManage Layout TemplateIndex Template TemplateLogs Template @@ -30,6 +31,9 @@ func LoadLayouts() { LayoutMain = Layout{ compiled: loadLayout("main"), } + LayoutManage = Layout{ + compiled: loadLayout("manage"), + } } func LoadTemplates() { @@ -39,11 +43,11 @@ func LoadTemplates() { } TemplateLogs = Template{ compiled: loadTemplate("logs"), - Layout: LayoutMain, + Layout: LayoutManage, } TemplateSettings = Template{ compiled: loadTemplate("settings"), - Layout: LayoutMain, + Layout: LayoutManage, } } diff --git a/config/config.go b/config/config.go index deb60fa..49b625c 100644 --- a/config/config.go +++ b/config/config.go @@ -18,7 +18,6 @@ type ( Host string BaseUrl string MainSite string - CsrfKey string Ratelimit Ratelimit Session Session } diff --git a/public/templates/layouts/main.mustache b/public/templates/layouts/main.mustache index d5d0f37..ad91e16 100644 --- a/public/templates/layouts/main.mustache +++ b/public/templates/layouts/main.mustache @@ -12,31 +12,80 @@ - - - - + + + + + + + + + + - - {{{content}}} +
+ {{{content}}} +
+ diff --git a/public/templates/layouts/manage.mustache b/public/templates/layouts/manage.mustache new file mode 100644 index 0000000..6bef5a4 --- /dev/null +++ b/public/templates/layouts/manage.mustache @@ -0,0 +1,117 @@ + + + + Tickets | A Discord Support Manager Bot + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + + +
+
+ +
+ + + {{{content}}} +
+
+ + diff --git a/public/templates/views/index.mustache b/public/templates/views/index.mustache index 509295b..aff634a 100644 --- a/public/templates/views/index.mustache +++ b/public/templates/views/index.mustache @@ -1,24 +1,45 @@ -
+
+
-
+
+
+
+

Servers

+ {{^empty}} +

Select a server to manage below

+ {{/empty}} +
+
{{#empty}} -

- You are not the admin of any guilds that the bot is in. Click below to invite the bot: -
- Invite -

+

+ You are not the admin of any guilds that the bot is in. Click below to invite the bot: +
+ Invite +

{{/empty}} {{^empty}} -

- Select a server to manage below -

- -
+
+
diff --git a/public/templates/views/logs.mustache b/public/templates/views/logs.mustache index 03d1776..dd24615 100644 --- a/public/templates/views/logs.mustache +++ b/public/templates/views/logs.mustache @@ -1,4 +1,89 @@ -
+
+
+
+
+
+
+ +
+
+
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+
+
+ +
+
+
+
+
+
+
+
+
+
+
+
+
+
+

Logs

+
+
+
+ + + + + + + + + + + {{#logs}} + + + + + + + {{/logs}} + +
Ticket IDUsernameUser IDLog URL
{{ticketid}}{{username}}{{userid}}{{uuid}}
+
+
+
+
+
+
+
+ + + diff --git a/public/templates/views/settings.mustache b/public/templates/views/settings.mustache index d9be40c..54beca8 100644 --- a/public/templates/views/settings.mustache +++ b/public/templates/views/settings.mustache @@ -1,100 +1,125 @@ - - -
+
+
-
- +
+
+
+

Settings

+ {{^empty}} +

Select a server to manage below

+ {{/empty}} +
+
+
+
+
+
+ + +
+
+
+
+ + +
+
+
+ +
+
+ + +
+
+ +
+
+ +
+
+
#
+
+ +
+
+ +
+
+ + +
+
+
+ + +
+
+
+ +
+
+
+
+
+
-
-
-
-

Prefix

- -
-
+
-
-
-

Welcome Message

- -
+
+
+ {{#invalidPrefix}} + + {{/invalidPrefix}} + {{#invalidWelcomeMessage}} + + {{/invalidWelcomeMessage}} + {{#invalidTicketLimit}} + + {{/invalidTicketLimit}} +
+
-
-
-

Ticket Limit

-

- -

-

Limit: -1

-
-
- -
-
-

Channel Category

- -
-
- -
-
-

Archive Channel

- -
-
- -
-
- -
-
- +
- - diff --git a/utils/sessionutils.go b/utils/sessionutils.go index a3ecdb5..d328c86 100644 --- a/utils/sessionutils.go +++ b/utils/sessionutils.go @@ -6,7 +6,13 @@ import ( ) func IsLoggedIn(store sessions.Session) bool { - return store.Get("access_token") != nil && store.Get("expiry") != nil && store.Get("refresh_token") != nil && store.Get("userid") != nil && store.Get("name") != nil + return store.Get("access_token") != nil && + store.Get("expiry") != nil && + store.Get("refresh_token") != nil && + store.Get("userid") != nil && + store.Get("name") != nil && + store.Get("avatar") != nil && + store.Get("csrf") != nil } func GetUserId(store sessions.Session) (int64, error) {