From 1d87595a64d7e2de12352e4eda69d75ada9dd676 Mon Sep 17 00:00:00 2001
From: simon <simon@journeyman.cc>
Date: Fri, 16 Jan 2015 22:07:41 +0000
Subject: [PATCH] Woohoo! Users can now change their own passwords. More work
 on tidying up stylesheets.

---
 resources/passwd                  |   3 +-
 resources/public/css/standard.css |  35 +++++++--
 resources/public/css/tablet.css   |  28 +++++++-
 resources/templates/about.html    |   4 --
 resources/templates/auth.html     |   5 +-
 resources/templates/base.html     |   2 +-
 resources/templates/edit.html     |   2 +-
 resources/templates/passwd.html   |  23 ++++++
 src/smeagol/authenticate.clj      |  29 ++++++++
 src/smeagol/routes/wiki.clj       | 113 ++++++++++++++++++------------
 10 files changed, 183 insertions(+), 61 deletions(-)
 delete mode 100644 resources/templates/about.html
 create mode 100644 resources/templates/passwd.html

diff --git a/resources/passwd b/resources/passwd
index fd73249..d7b2afd 100644
--- a/resources/passwd
+++ b/resources/passwd
@@ -1,2 +1 @@
-{:admin {:password "admin" :email "admin@localhost"}}
-
+{:admin {:password "admin", :email "admin@localhost"}}
diff --git a/resources/public/css/standard.css b/resources/public/css/standard.css
index fb95157..0d23bf9 100644
--- a/resources/public/css/standard.css
+++ b/resources/public/css/standard.css
@@ -43,6 +43,10 @@ body {
 	float: right;
 	padding: 0.1em 0.75em;
   margin: 0;
+  color: white;
+}
+
+#user a {
   color: silver;
 }
 
@@ -110,13 +114,12 @@ li.nav-item a:active { background: gray; color: white; }
 #footer {
   clear: both;
   font-size: smaller;
-  padding: 0 2em;
   text-align: center;
   color:white;
   background:rgba(128,128,128,0.95);
   width: 100%;
   margin: 0;
-  padding: 0.1em 10%;
+/*  padding: 0.1em 10%; */
   bottom:0;
   position:fixed;
   z-index:150;
@@ -135,6 +138,7 @@ li.nav-item a:active { background: gray; color: white; }
  	border: thin solid white;
  	margin-top: 0;
  	margin-bottom: 0;
+  width: 100%;
 }
 
 .minor-controls {
@@ -144,6 +148,10 @@ li.nav-item a:active { background: gray; color: white; }
 	font-size: 66%;
 }
 
+.message {
+  border: thin solid red;
+}
+
 .wiki {
   margin: 0;
 }
@@ -156,8 +164,12 @@ form {
   border: thin solid silver;
 }
 
-div.content, form, p, pre, ul, ol, dl, menu, h1, h2, h3, h4, h5 {
-  padding: 0.25em 10%;
+div.content, form, p, pre, h1, h2, h3, h4, h5 {
+  padding: 0.25em 5%;
+}
+
+dl, menu, ol, table, ul {
+  margin: 0.25em 5%;
 }
 
 input {
@@ -179,7 +191,7 @@ input.required:after {
 }
 
 label {
-  width: 30em;
+  width: 20%;
   min-width: 20em;
   border-right: thin solid gray;
 }
@@ -192,12 +204,23 @@ menu li::before {
   content: "|| ";
 }
 
+table {
+  border: 2px solid black;
+  border-collapse: collapse;
+}
+
 table.music-ruled tr:nth-child(odd) {
 	background-color: silver;
 }
 
 th, td {
 	text-align: left;
-	padding: 0 0.25em;
+  vertical-align: top;
+	padding: 0.15em 1.5em;
+  border: 1px solid gray;
+}
+
+th {
+  background-color: silver;
 }
 
diff --git a/resources/public/css/tablet.css b/resources/public/css/tablet.css
index ddcfdd8..9a61600 100644
--- a/resources/public/css/tablet.css
+++ b/resources/public/css/tablet.css
@@ -126,11 +126,16 @@ h1, h2, h3, h4, h5 {
   color: white;
 }
 
-p, pre, ul, ol, dl, h1, h2, h3, h4, h5 {
+p, pre, h1, h2, h3, h4, h5 {
   width: 100%;
   padding: 0.25em 1em;
 }
 
+dl, menu, ol, table, ul {
+  margin: 0.15em 3%;
+}
+
+
 input {
   background-color: white;
 }
@@ -165,3 +170,24 @@ menu li::before {
   content: "|| ";
 }
 
+
+table {
+  border: 2px solid black;
+  border-collapse: collapse;
+}
+
+table.music-ruled tr:nth-child(odd) {
+	background-color: silver;
+}
+
+th, td {
+	text-align: left;
+  vertical-align: top;
+	padding: 0.15em 1.5em;
+  border: 1px solid gray;
+}
+
+th {
+  background-color: silver;
+}
+
diff --git a/resources/templates/about.html b/resources/templates/about.html
deleted file mode 100644
index 9295dec..0000000
--- a/resources/templates/about.html
+++ /dev/null
@@ -1,4 +0,0 @@
-{% extends "templates/base.html" %}
-{% block content %}
-  <p>this is the story of smeagol... work in progress</p>
-{% endblock %}
diff --git a/resources/templates/auth.html b/resources/templates/auth.html
index 9fec39e..4eb63b0 100644
--- a/resources/templates/auth.html
+++ b/resources/templates/auth.html
@@ -2,6 +2,7 @@
 {% block content %}
         <div id="content" class="auth">
             <form action="{{servlet-context}}/auth" method="POST">
+                <input type="hidden" name="redirect-to" value="{{redirect-to}}"/>
                 {% if user %}
                 <p class="widget">
                     <label for="submit">To finish editing</label>
@@ -10,11 +11,11 @@
                 {% else %}
                 <p class="widget">
                     <label for="username">Your username</label>
-                    <input name="username" id="username" type="text"/>
+                    <input name="username" id="username" type="text" required/>
                 </p>
                 <p class="widget">
                     <label for="password">Your password</label>
-                    <input name="password" id="password" type="password"/>
+                    <input name="password" id="password" type="password" required/>
                 </p>
                 <p class="widget">
                     <label for="submit">To edit this wiki</label>
diff --git a/resources/templates/base.html b/resources/templates/base.html
index cf48efe..d40b940 100644
--- a/resources/templates/base.html
+++ b/resources/templates/base.html
@@ -14,7 +14,7 @@
     <!-- navbar -->
     <div id="nav">
       {% if user %}
-      <p class="user" id="user">You are logged in as {{user}}</p>
+        <p class="user" id="user">You are logged in as {{user}} | <a href="passwd">change password</a></p>
       {% endif %}
       <img id="nav-icon" src="{{servlet-context}}/img/threelines.png" alt="Menu"/>
       <ul id="nav-menu" class="nav">
diff --git a/resources/templates/edit.html b/resources/templates/edit.html
index 0cfaf85..f9d832d 100644
--- a/resources/templates/edit.html
+++ b/resources/templates/edit.html
@@ -7,7 +7,7 @@
                 <p class="widget">
                     <label for="summary">What have you changed?</label>
                     <input name="summary" id="summary" type="text"
-                        value="{%if exists%}{%else%}New file {{title}}{%endif%}"/>
+                        value="{%if exists%}{%else%}New file {{title}}{%endif%}" required/>
                 </p>
                 <p class="widget">
                     <label for="submit">When you have finished editing</label>
diff --git a/resources/templates/passwd.html b/resources/templates/passwd.html
new file mode 100644
index 0000000..9a10df6
--- /dev/null
+++ b/resources/templates/passwd.html
@@ -0,0 +1,23 @@
+{% extends "templates/base.html" %}
+{% block content %}
+        <div id="content" class="auth">
+            <form action="{{servlet-context}}/passwd" method="POST">
+                <p class="widget">
+                    <label for="password">Your password</label>
+                    <input name="oldpass" id="oldpass" type="password" required/>
+                </p>
+                <p class="widget">
+                    <label for="password">New password</label>
+                    <input name="pass1" id="pass1" type="password" required/>
+                </p>
+                <p class="widget">
+                    <label for="password">And again</label>
+                    <input name="pass2" id="pass2" type="password" required/>
+                </p>
+                <p class="widget">
+                    <label for="submit">To edit this wiki</label>
+                    <input name="action" id="action" type="submit" class="action" value="Login!"/>
+                </p>
+            </form>
+        </div>
+{% endblock %}
diff --git a/src/smeagol/authenticate.clj b/src/smeagol/authenticate.clj
index ea7502b..dad86b1 100644
--- a/src/smeagol/authenticate.clj
+++ b/src/smeagol/authenticate.clj
@@ -20,6 +20,13 @@
 ;; along with this program; if not, write to the Free Software
 ;; Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;;
+;; All functions which relate to the passwd file are in this namespace, in order
+;; that it can reasonably simply swapped out for a more secure replacement
+;;
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
 (defn authenticate
   "Return `true` if this `username`/`password` pair match, `false` otherwise"
   [username password]
@@ -36,3 +43,25 @@
         users (read-string (slurp path))
         user ((keyword username) users)]
     (if user (:email user))))
+
+(defn change-pass
+  "Change the password for the user with this `username` and `oldpass` to this `newpass`.
+  Return `true` if password was successfully changed."
+  [username oldpass newpass]
+  (timbre/info (format "Changing password for user %s" username))
+  (let [path (str (io/resource-path) "../passwd")
+        users (read-string (slurp path))
+        keywd (keyword username)
+        user (if users (keywd users))
+        email (:email user)]
+    (try
+      (cond
+       (and user (.equals (:password user) oldpass))
+       (do
+         (spit path (assoc (dissoc users keywd) keywd {:password newpass :email email}))
+         true))
+      (catch Exception any
+        (timbre/error
+         (format "Changing password failed for user %s failed: %s (%s)"
+                 username (.getName (.getClass any)) (.getMessage any)))
+        false))))
diff --git a/src/smeagol/routes/wiki.clj b/src/smeagol/routes/wiki.clj
index 8787b2a..bd31235 100644
--- a/src/smeagol/routes/wiki.clj
+++ b/src/smeagol/routes/wiki.clj
@@ -16,7 +16,8 @@
 ;; Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 
 (ns smeagol.routes.wiki
-  (:use clojure.walk)
+  (:use clojure.walk
+        clojure.pprint)
   (:require [compojure.core :refer :all]
             [clj-jgit.porcelain :as git]
             [markdown.core :as md]
@@ -40,7 +41,7 @@
 
 (defn process-source
   "Process `source-text` and save it to the specified `file-path`, committing it
-   to Git and finally redirecting to wiki-page."
+  to Git and finally redirecting to wiki-page."
   [params]
   (let [source-text (:src params)
         page (:page params)
@@ -55,8 +56,8 @@
     (spit file-path source-text)
     (if (not exists?) (git/git-add git-repo file-name))
     (git/git-commit git-repo summary {:name user :email email})
-    (response/redirect (str "/wiki?" page))
-  ))
+    (response/redirect (str "/wiki?page=" page))
+    ))
 
 (defn edit-page
   "Render a page in a text-area for editing. This could have been done in the same function as wiki-page,
@@ -70,13 +71,13 @@
     (cond src-text (process-source params)
           true
           (layout/render "edit.html"
-                   {:title (str "Edit " page)
-                    :page page
-                    :left-bar (local-links (util/md->html "/content/_edit-left-bar.md"))
-                    :header (local-links (util/md->html "/content/_header.md"))
-                    :content (if exists? (io/slurp-resource (str "/content/" page ".md")) "")
-                    :user (session/get :user)
-                    :exists exists?}))))
+                         {:title (str "Edit " page)
+                          :page page
+                          :left-bar (local-links (util/md->html "/content/_edit-left-bar.md"))
+                          :header (local-links (util/md->html "/content/_header.md"))
+                          :content (if exists? (io/slurp-resource (str "/content/" page ".md")) "")
+                          :user (session/get :user)
+                          :exists exists?}))))
 
 (defn wiki-page
   "Render the markdown page specified in this `request`, if any. If none found, redirect to edit-page"
@@ -87,18 +88,18 @@
         file-path (str (io/resource-path) file-name)
         exists? (.exists (clojure.java.io/as-file file-path))]
     (cond exists?
-      (layout/render "wiki.html"
-                   {:title page
-                    :page page
-                    :left-bar (local-links (util/md->html "/content/_left-bar.md"))
-                    :header (local-links (util/md->html "/content/_header.md"))
-                    :content (local-links (util/md->html file-name))
-                    :user (session/get :user)})
+          (layout/render "wiki.html"
+                         {:title page
+                          :page page
+                          :left-bar (local-links (util/md->html "/content/_left-bar.md"))
+                          :header (local-links (util/md->html "/content/_header.md"))
+                          :content (local-links (util/md->html file-name))
+                          :user (session/get :user)})
           true (response/redirect (str "/edit?page=" page)))))
 
 (defn history-page
   "Render the history for the markdown page specified in this `request`,
-   if any. If none, error?"
+  if any. If none, error?"
   [request]
   (let [params (keywordize-keys (:params request))
         page (or (:page params) "Introduction")
@@ -123,13 +124,13 @@
                    {:title (str "Version " version " of " page)
                     :page page
                     :left-bar (local-links
-                                (util/md->html "/content/_left-bar.md"))
+                               (util/md->html "/content/_left-bar.md"))
                     :header (local-links
-                              (util/md->html "/content/_header.md"))
+                             (util/md->html "/content/_header.md"))
                     :content (local-links
-                               (md/md-to-html-string
-                                 (hist/fetch-version
-                                   repo-path file-name version)))
+                              (md/md-to-html-string
+                               (hist/fetch-version
+                                repo-path file-name version)))
                     :user (session/get :user)})))
 
 (defn diff-page
@@ -144,39 +145,61 @@
                    {:title (str "Changes since version " version " of " page)
                     :page page
                     :left-bar (local-links
-                                (util/md->html "/content/_left-bar.md"))
+                               (util/md->html "/content/_left-bar.md"))
                     :header (local-links
-                              (util/md->html "/content/_header.md"))
+                             (util/md->html "/content/_header.md"))
                     :content (d2h/diff2html (hist/diff repo-path file-name version))
                     :user (session/get :user)})))
 
 (defn auth-page
   "Render the auth page"
   [request]
+  (pprint request)
   (let [params (keywordize-keys (:form-params request))
         username (:username params)
         password (:password params)
         action (:action params)
-        user (session/get :user)]
+        user (session/get :user)
+        redirect-to (or (:redirect-to params) "/wiki")]
     (cond
-      (= action "Logout!")
-      (do
-        (timbre/info (str "User " user " logging out"))
-        (session/remove! :user)
-        (response/redirect "/wiki"))
-      (and username password (auth/authenticate username password))
-      (do
-        (session/put! :user username)
-        (response/redirect "/wiki"))
-      true
-      (layout/render "auth.html"
-                   {:title (if user (str "Logout " user) "Log in")
+     (= action "Logout!")
+     (do
+       (timbre/info (str "User " user " logging out"))
+       (session/remove! :user)
+       (response/redirect redirect-to))
+     (and username password (auth/authenticate username password))
+     (do
+       (session/put! :user username)
+       (response/redirect redirect-to))
+     true
+     (layout/render "auth.html"
+                    {:title (if user (str "Logout " user) "Log in")
+                     :redirect-to ((:headers request) "referer")
+                     :left-bar (local-links (util/md->html "/content/_left-bar.md"))
+                     :header (local-links (util/md->html "/content/_header.md"))
+                     :user user}))))
+
+(defn passwd-page
+  "Render a page to change the user password"
+  [request]
+  (let [params (keywordize-keys (:form-params request))
+        oldpass (:oldpass params)
+        pass1 (:pass1 params)
+        pass2 (:pass2 params)
+        user (session/get :user)
+        length (if pass1 (count pass1) 0)
+        message (cond
+                 (nil? oldpass) nil
+                 (and pass1 (>= length 8) (.equals pass1 pass2) (auth/change-pass user oldpass pass2))
+                 "Your password was changed"
+                 (< length 8) "You proposed password wasn't long enough: 8 characters required"
+                 (not (= pass1 pass2)) "Your proposed passwords don't match"
+                 true "Your password was not changed")] ;; but I don't know why...
+    (layout/render "passwd.html"
+                   {:title (str "Change passord for " user)
                     :left-bar (local-links (util/md->html "/content/_left-bar.md"))
                     :header (local-links (util/md->html "/content/_header.md"))
-                    :user user}))))
-
-(defn about-page []
-  (layout/render "about.html"))
+                    :message message})))
 
 (defroutes wiki-routes
   (GET "/wiki" request (wiki-page request))
@@ -188,4 +211,6 @@
   (GET "/changes" request (diff-page request))
   (GET "/auth" request (auth-page request))
   (POST "/auth" request (auth-page request))
-  (GET "/about" [] (about-page)))
+  (GET "/passwd" request (passwd-page request))
+  (POST "/passwd" request (passwd-page request))
+  )