Skip to content

Commit e72c5e3

Browse files
MaKleSoftMaKleSoft
committed
Merge branch 'dev'
* dev: (75 commits) Optionally enable Cross-Origin Resource Sharing via flag Move notices into dedicated section at the top of the page; show notice when device access revoked successfully Switch from godep to govendor; update dependencies Extract client version from X-Client-Version header and store with auth token Clean up web auth tokens immediately after they expire Show note with app download link if not devices are connected Allow query string in redirect parameter to auth request endpoint Confirm delete store within dashboard instead of using separate page Remove unused delete-store-success template Define csp directives as a template block so they can be customized for specific pages Remove activate auth token success page for api token; Log in and redirect to dashboard instead Various changes to improve extensibility Make message field of BadRequest exported so it can be used from other packages Use time.Ticker for StorageCleaner scheduling Implement static and root routes as Handler structs Rafactor way endpoints are registered Move handler, middleware functions out of server struct and into own file Clean out old auth requests every 24 hrs Add 'Created' field to Account Replace Storage::List method with Storage::Iterator method that returns an iterator instead of a string slice ...
2 parents c4994d7 + 9d5cf5a commit e72c5e3

File tree

363 files changed

+11262
-124225
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

363 files changed

+11262
-124225
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
padlock-cloud
2+
db

‎Godeps/Godeps.json

-136
This file was deleted.

‎Godeps/Readme

-5
This file was deleted.

‎README.md

+11-12
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ server:
6262
port: 5555
6363
tls_cert: cert.crt
6464
tls_key: cert.key
65-
host: cloud.padlock.io
65+
base_url: https://cloud.padlock.io
6666
leveldb:
6767
path: path/to/db
6868
email:
@@ -77,7 +77,7 @@ log:
7777
```
7878
7979
**NOTE**: If you are using a config file, all other flags and environment
80-
variables will be ingored.
80+
variables will be ignored.
8181
8282
## Security Considerations
8383
@@ -90,7 +90,7 @@ through plain http. You should make sure that in this case the server does
9090
**not** listen on a public port and that any reverse proxies that handle
9191
outgoing connections are protected via TLS.
9292

93-
### Link spoofing and the --host option
93+
### Link spoofing and the --base-url option
9494

9595
Padlock Cloud frequently uses confirmation links for things like activating
9696
authentication tokens, confirmation for deleting an account etc. They usually
@@ -103,24 +103,23 @@ https://hostname:port/activate/?v=1&t=cdB6iEdL4o5PfhLey30Rrg
103103

104104
These links are sent out to a users email address and serve as a form of
105105
authentication. Only users that actually have control over the email account
106-
accociated with their Padlock Cloud account may access the correponding data.
106+
associated with their Padlock Cloud account may access the corresponding data.
107107

108-
Now the `hostname` and `port` portion of the url will obviously differ based on
108+
Now the `hostname` and `port` portion of the URL will obviously differ based on
109109
the environment. By default, the app will simply use the value provided by the
110110
`Host` header of the incoming request. But the `Host` header can easily be
111111
faked and unless the server is running behind a reverse proxy that sets the it
112-
to the correct value, this opens the app up to a vulnerabilty we call 'link
113-
spoofing'. Let's say an attacker sends an authentiation request to our server
112+
to the correct value, this opens the app up to a vulnerability we call 'link
113+
spoofing'. Let's say an attacker sends an authentication request to our server
114114
using a targets email address, but changes the `Host` header to a server that
115115
he controls. The email that is sent to the target will now contain a link that
116116
points to the attackers server instead of our own and once the user clicks the
117117
link the attacker is in possession of the activation token which can in turn be
118118
used to activate the authentication token he already has. There is a simple
119-
solution for this: Explicitly provide a hostname and port to be used for link
120-
generation when starting up the server. The `runserver` command provides the
121-
`--host` flag for this. This is a string that contains the hostname and
122-
optionally a port, e.g. `example.com:3000` or simply `example.com`. it is
123-
recommended to use this option in production environments at all times!
119+
solution for this: Explicitly provide a base URL to be used for constructing
120+
links when starting up the server. The `runserver` command provides the
121+
`--base-url` flag for this. It is recommended to use this option in production
122+
environments at all times!
124123

125124
## Troubleshooting
126125

‎assets/static/css/base.css

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
body {
2+
padding: 0;
3+
margin: 0;
4+
font-family: "Clear Sans", "Helvetica Neue", Helvetica, sans-serif;
5+
font-size: 18px;
6+
color: #333;
7+
font-weight: 300;
8+
-webkit-tap-highlight-color: transparent;
9+
}
10+
11+
body, input, button {
12+
-webkit-font-smoothing: antialiased;
13+
}
14+
15+
input:not([type="checkbox"]), button {
16+
-webkit-appearance: none;
17+
-moz-appearance: none;
18+
border-radius: 0;
19+
font-size: inherit;
20+
font-family: inherit;
21+
padding: 10px 15px;
22+
background: #fff;
23+
border: solid 1px #ccc;
24+
min-width: 0;
25+
}
26+
27+
input[type="checkbox"] {
28+
vertical-align: middle;
29+
cursor: pointer;
30+
}
31+
32+
button {
33+
border: none;
34+
background: #59c6ff;
35+
color: #fff;
36+
cursor: pointer;
37+
white-space: nowrap;
38+
overflow: hidden;
39+
text-overflow: ellipsis;
40+
}
41+
42+
button.light {
43+
background: none;
44+
color: #59c6ff;
45+
padding: 0;
46+
margin: 5px 0 0 2px;
47+
}
48+
49+
*:focus {
50+
outline: none;
51+
}
52+
53+
h1 {
54+
font-size: 250%;
55+
font-weight: 100;
56+
margin: 20px 0;
57+
}
58+
59+
h2 {
60+
font-size: 120%;
61+
font-weight: 400;
62+
}
63+
64+
h3 {
65+
font-size: 110%;
66+
font-weight: 400;
67+
}
68+
69+
a {
70+
color: #59c6ff;
71+
text-decoration: none;
72+
font-weight: 400;
73+
}
74+
75+
button:hover, a:hover {
76+
opacity: 0.7;
77+
}
78+
79+
section {
80+
padding: 0 40px;
81+
margin: 40px 0;
82+
clear: both;
83+
}
84+
85+
footer {
86+
display: block;
87+
padding: 10px;
88+
text-align: center;
89+
font-size: 80%;
90+
border-top: solid 1px #ccc;
91+
}
92+
93+
footer .copyright {
94+
color: #ccc;
95+
}
96+
97+
footer a {
98+
margin: 0 5px;
99+
}
100+
101+
ul {
102+
list-style: none;
103+
margin: 0;
104+
padding: 0;
105+
}
106+
107+
th {
108+
text-align: left;
109+
vertical-align: top;
110+
width: 150px;
111+
}
112+
113+
svg.icon {
114+
fill: currentColor;
115+
stroke: currentColor;
116+
}
117+
118+
header {
119+
background: #ffffff;
120+
position: fixed;
121+
top: 0;
122+
width: 100%;
123+
z-index: 1;
124+
padding: 0 10px;
125+
box-sizing: border-box;
126+
border-bottom: solid 1px #ccc;
127+
}
128+
129+
header .inner {
130+
height: 50px;
131+
width: 100%;
132+
margin: 0 auto;
133+
}
134+
135+
header .inner, header .home, header nav, header nav ul {
136+
display: flex;
137+
align-items: center;
138+
}
139+
140+
header nav ul li {
141+
display: inline-block;
142+
margin-left: 10px;
143+
}
144+
145+
header .logo {
146+
width: 35px;
147+
height: 35px;
148+
margin-right: 10px;
149+
margin-left: 3px;
150+
}
151+
152+
header .spacer {
153+
flex: 1;
154+
}
155+
156+
main {
157+
margin: 80px auto;
158+
}
159+
160+
header .inner, main {
161+
max-width: 800px;
162+
}
163+
164+
.account-email {
165+
font-size: 90%;
166+
font-weight: bold;
167+
}
168+
169+
.note {
170+
background: rgba(89, 198, 255, 0.1);
171+
padding: 20px;
172+
border: solid 1px #59c6ff;
173+
}
174+
175+
@media (max-width: 500px) {
176+
header .home .type {
177+
display: none;
178+
}
179+
180+
section {
181+
padding-left: 20px;
182+
padding-right: 20px;
183+
}
184+
}

0 commit comments

Comments
 (0)