From df1041766882f67613ed85719b818f267331cec9 Mon Sep 17 00:00:00 2001 From: armisss4 Date: Thu, 29 Dec 2022 09:42:12 +0200 Subject: [PATCH 1/8] User management More than one user with Manager or Admin permissions can be created from UI --- Dockerfile | 4 +- custom/js/helper.js | 29 ++++ handler/routes.go | 200 +++++++++++++++++++---- handler/routes_wake_on_lan.go | 2 +- handler/session.go | 32 +++- main.go | 25 ++- model/misc.go | 1 + model/user.go | 1 + router/router.go | 6 + store/jsondb/jsondb.go | 54 ++++++- store/store.go | 4 +- templates/base.html | 22 ++- templates/login.html | 6 +- templates/profile.html | 125 +++++++++------ templates/users_settings.html | 290 ++++++++++++++++++++++++++++++++++ util/config.go | 1 + util/util.go | 3 +- 17 files changed, 705 insertions(+), 100 deletions(-) create mode 100644 templates/users_settings.html diff --git a/Dockerfile b/Dockerfile index a30cefee..70223c56 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,6 +10,7 @@ ARG BUILD_DEPENDENCIES="npm \ # Get dependencies RUN apk add --update --no-cache ${BUILD_DEPENDENCIES} +#RUN apt install ${BUILD_DEPENDENCIES} WORKDIR /build @@ -20,8 +21,7 @@ COPY package.json /build COPY yarn.lock /build # Prepare assets -RUN yarn install --pure-lockfile --production && \ - yarn cache clean +RUN yarn install --pure-lockfile --production && yarn cache clean # Move admin-lte dist RUN mkdir -p assets/dist/js assets/dist/css && \ diff --git a/custom/js/helper.js b/custom/js/helper.js index 86f6dc7e..50b1d769 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -78,6 +78,35 @@ function renderClientList(data) { }); } +function renderUserList(data) { + $.each(data, function(index, obj) { + // render client status css tag style + let clientStatusHtml = '>' + + // render client html content + let html = `
+
+
+
+ +
+
+ +
+
+ ${obj.username} + ${obj.admin? 'Administrator':'Manager'} +
+
+
` + + // add the client html elements to the list + $('#users-list').append(html); + }); +} + + function prettyDateTime(timeStr) { const dt = new Date(timeStr); const offsetMs = dt.getTimezoneOffset() * 60 * 1000; diff --git a/handler/routes.go b/handler/routes.go index 3ddbb2de..ddab14f5 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -42,39 +42,54 @@ func LoginPage() echo.HandlerFunc { // Login for signing in handler func Login(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { - user := new(model.User) - c.Bind(user) + data := make(map[string]interface{}) + err := json.NewDecoder(c.Request().Body).Decode(&data) - dbuser, err := db.GetUser() + if err != nil { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"}) + } + + username := data["username"].(string) + password := data["password"].(string) + rememberMe := data["rememberMe"].(bool) + + dbuser, err := db.GetUserByName(username) if err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot query user from DB"}) } - userCorrect := subtle.ConstantTimeCompare([]byte(user.Username), []byte(dbuser.Username)) == 1 + userCorrect := subtle.ConstantTimeCompare([]byte(username), []byte(dbuser.Username)) == 1 var passwordCorrect bool if dbuser.PasswordHash != "" { - match, err := util.VerifyHash(dbuser.PasswordHash, user.Password) + match, err := util.VerifyHash(dbuser.PasswordHash, password) if err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot verify password"}) } passwordCorrect = match } else { - passwordCorrect = subtle.ConstantTimeCompare([]byte(user.Password), []byte(dbuser.Password)) == 1 + passwordCorrect = subtle.ConstantTimeCompare([]byte(password), []byte(dbuser.Password)) == 1 } if userCorrect && passwordCorrect { // TODO: refresh the token + ageMax := 0 + expiration := time.Now().Add(24 * time.Hour) + if rememberMe { + ageMax = 86400 + expiration.Add(144 * time.Hour) + } sess, _ := session.Get("session", c) sess.Options = &sessions.Options{ Path: util.BasePath, - MaxAge: 86400, + MaxAge: ageMax, HttpOnly: true, } // set session_token tokenUID := xid.New().String() - sess.Values["username"] = user.Username + sess.Values["username"] = dbuser.Username + sess.Values["admin"] = dbuser.Admin sess.Values["session_token"] = tokenUID sess.Save(c.Request(), c.Response()) @@ -82,7 +97,7 @@ func Login(db store.IStore) echo.HandlerFunc { cookie := new(http.Cookie) cookie.Name = "session_token" cookie.Value = tokenUID - cookie.Expires = time.Now().Add(24 * time.Hour) + cookie.Expires = expiration c.SetCookie(cookie) return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Logged in successfully"}) @@ -92,6 +107,36 @@ func Login(db store.IStore) echo.HandlerFunc { } } +// GetClients handler return a JSON list of Wireguard client data +func GetUsers(db store.IStore) echo.HandlerFunc { + return func(c echo.Context) error { + + clientDataList, err := db.GetUsers() + if err != nil { + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ + false, fmt.Sprintf("Cannot get user list: %v", err), + }) + } + + return c.JSON(http.StatusOK, clientDataList) + } +} + +// GetClient handler returns a JSON object of Wireguard client data +func GetUser(db store.IStore) echo.HandlerFunc { + return func(c echo.Context) error { + + username := c.Param("username") + + userData, err := db.GetUserByName(username) + if err != nil { + return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, "User not found"}) + } + + return c.JSON(http.StatusOK, userData) + } +} + // Logout to log a user out func Logout() echo.HandlerFunc { return func(c echo.Context) error { @@ -103,21 +148,23 @@ func Logout() echo.HandlerFunc { // LoadProfile to load user information func LoadProfile(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { - - userInfo, err := db.GetUser() - if err != nil { - log.Error("Cannot get user information: ", err) - } - return c.Render(http.StatusOK, "profile.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "profile", CurrentUser: currentUser(c)}, - "userInfo": userInfo, + "baseData": model.BaseData{Active: "profile", CurrentUser: currentUser(c), Admin: isAdmin(c)}, + }) + } +} + +// WireGuardClients handler +func UsersSettings(db store.IStore) echo.HandlerFunc { + return func(c echo.Context) error { + return c.Render(http.StatusOK, "users_settings.html", map[string]interface{}{ + "baseData": model.BaseData{Active: "users-settings", CurrentUser: currentUser(c), Admin: isAdmin(c)}, }) } } // UpdateProfile to update user information -func UpdateProfile(db store.IStore) echo.HandlerFunc { +func UpdateUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) err := json.NewDecoder(c.Request().Body).Decode(&data) @@ -128,8 +175,10 @@ func UpdateProfile(db store.IStore) echo.HandlerFunc { username := data["username"].(string) password := data["password"].(string) + previousUsername := data["previous_username"].(string) + admin := data["admin"].(bool) - user, err := db.GetUser() + user, err := db.GetUserByName(previousUsername) if err != nil { return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, err.Error()}) } @@ -140,6 +189,13 @@ func UpdateProfile(db store.IStore) echo.HandlerFunc { user.Username = username } + if username != previousUsername { + _, err := db.GetUserByName(username) + if err == nil { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "This username is taken"}) + } + } + if password != "" { hash, err := util.HashPassword(password) if err != nil { @@ -147,13 +203,93 @@ func UpdateProfile(db store.IStore) echo.HandlerFunc { } user.PasswordHash = hash } + user.Admin = admin + if err := db.DeleteUser(previousUsername); err != nil { + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()}) + } if err := db.SaveUser(user); err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()}) } - log.Infof("Updated admin user information successfully") + log.Infof("Updated user information successfully") + + if previousUsername == currentUser(c) { + setUser(c, user.Username, user.Admin) + } - return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Updated admin user information successfully"}) + return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Updated user information successfully"}) + } +} + +// UpdateProfile to update user information +func CreateUser(db store.IStore) echo.HandlerFunc { + return func(c echo.Context) error { + data := make(map[string]interface{}) + err := json.NewDecoder(c.Request().Body).Decode(&data) + + if err != nil { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"}) + } + + var user model.User + username := data["username"].(string) + password := data["password"].(string) + admin := data["admin"].(bool) + + if username == "" { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Please provide a valid username"}) + } else { + user.Username = username + } + + { + _, err := db.GetUserByName(username) + if err == nil { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "This username is taken"}) + } + } + + hash, err := util.HashPassword(password) + if err != nil { + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()}) + } + user.PasswordHash = hash + + user.Admin = admin + + if err := db.SaveUser(user); err != nil { + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, err.Error()}) + } + log.Infof("Created user successfully") + + return c.JSON(http.StatusOK, jsonHTTPResponse{true, "Created user successfully"}) + } +} + +// RemoveClient handler +func RemoveUser(db store.IStore) echo.HandlerFunc { + return func(c echo.Context) error { + data := make(map[string]interface{}) + err := json.NewDecoder(c.Request().Body).Decode(&data) + + if err != nil { + return c.JSON(http.StatusBadRequest, jsonHTTPResponse{false, "Bad post data"}) + } + + username := data["username"].(string) + // delete client from database + + if err := db.DeleteUser(username); err != nil { + log.Error("Cannot delete user: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot delete user from database"}) + } + + log.Infof("Removed user: %s", username) + if username == currentUser(c) { + log.Infof("You removed yourself, killing session") + clearSession(c) + } + return c.JSON(http.StatusOK, jsonHTTPResponse{true, "User removed"}) } } @@ -169,7 +305,7 @@ func WireGuardClients(db store.IStore) echo.HandlerFunc { } return c.Render(http.StatusOK, "clients.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "clientDataList": clientDataList, }) } @@ -522,7 +658,7 @@ func WireGuardServer(db store.IStore) echo.HandlerFunc { } return c.Render(http.StatusOK, "server.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "wg-server", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "wg-server", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "serverInterface": server.Interface, "serverKeyPair": server.KeyPair, }) @@ -590,7 +726,7 @@ func GlobalSettings(db store.IStore) echo.HandlerFunc { } return c.Render(http.StatusOK, "global_settings.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "global-settings", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "global-settings", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "globalSettings": globalSettings, }) } @@ -618,7 +754,7 @@ func Status(db store.IStore) echo.HandlerFunc { wgClient, err := wgctrl.New() if err != nil { return c.Render(http.StatusInternalServerError, "status.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "error": err.Error(), "devices": nil, }) @@ -627,7 +763,7 @@ func Status(db store.IStore) echo.HandlerFunc { devices, err := wgClient.Devices() if err != nil { return c.Render(http.StatusInternalServerError, "status.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "error": err.Error(), "devices": nil, }) @@ -639,7 +775,7 @@ func Status(db store.IStore) echo.HandlerFunc { clients, err := db.GetClients(false) if err != nil { return c.Render(http.StatusInternalServerError, "status.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "error": err.Error(), "devices": nil, }) @@ -676,7 +812,7 @@ func Status(db store.IStore) echo.HandlerFunc { } return c.Render(http.StatusOK, "status.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "status", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "devices": devicesVm, "error": "", }) @@ -790,6 +926,12 @@ func ApplyServerConfig(db store.IStore, tmplBox *rice.Box) echo.HandlerFunc { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot get client config"}) } + users, err := db.GetUsers() + if err != nil { + log.Error("Cannot get users config: ", err) + return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{false, "Cannot get users config"}) + } + settings, err := db.GetGlobalSettings() if err != nil { log.Error("Cannot get global settings: ", err) @@ -797,7 +939,7 @@ func ApplyServerConfig(db store.IStore, tmplBox *rice.Box) echo.HandlerFunc { } // Write config file - err = util.WriteWireGuardServerConfig(tmplBox, server, clients, settings) + err = util.WriteWireGuardServerConfig(tmplBox, server, clients, users, settings) if err != nil { log.Error("Cannot apply server config: ", err) return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ diff --git a/handler/routes_wake_on_lan.go b/handler/routes_wake_on_lan.go index 40cd3876..43a61863 100644 --- a/handler/routes_wake_on_lan.go +++ b/handler/routes_wake_on_lan.go @@ -37,7 +37,7 @@ func GetWakeOnLanHosts(db store.IStore) echo.HandlerFunc { } err = c.Render(http.StatusOK, "wake_on_lan_hosts.html", map[string]interface{}{ - "baseData": model.BaseData{Active: "wake_on_lan_hosts", CurrentUser: currentUser(c)}, + "baseData": model.BaseData{Active: "wake_on_lan_hosts", CurrentUser: currentUser(c), Admin: isAdmin(c)}, "hosts": hosts, "error": "", }) diff --git a/handler/session.go b/handler/session.go index 9975e0d4..689d507a 100644 --- a/handler/session.go +++ b/handler/session.go @@ -14,15 +14,24 @@ func ValidSession(next echo.HandlerFunc) echo.HandlerFunc { if !isValidSession(c) { nextURL := c.Request().URL if nextURL != nil && c.Request().Method == http.MethodGet { - return c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf(util.BasePath + "/login?next=%s", c.Request().URL)) + return c.Redirect(http.StatusTemporaryRedirect, fmt.Sprintf(util.BasePath+"/login?next=%s", c.Request().URL)) } else { - return c.Redirect(http.StatusTemporaryRedirect, util.BasePath + "/login") + return c.Redirect(http.StatusTemporaryRedirect, util.BasePath+"/login") } } return next(c) } } +func NeedsAdmin(next echo.HandlerFunc) echo.HandlerFunc { + return func(c echo.Context) error { + if !isAdmin(c) { + return c.Redirect(http.StatusTemporaryRedirect, util.BasePath+"/") + } + return next(c) + } +} + func isValidSession(c echo.Context) bool { if util.DisableLogin { return true @@ -46,10 +55,29 @@ func currentUser(c echo.Context) string { return username } +// currentUser to get username of logged in user +func isAdmin(c echo.Context) bool { + if util.DisableLogin { + return true + } + + sess, _ := session.Get("session", c) + admin := fmt.Sprintf("%t", sess.Values["admin"]) + return admin == "true" +} + +func setUser(c echo.Context, username string, admin bool) { + sess, _ := session.Get("session", c) + sess.Values["username"] = username + sess.Values["admin"] = admin + sess.Save(c.Request(), c.Response()) +} + // clearSession to remove current session func clearSession(c echo.Context) { sess, _ := session.Get("session", c) sess.Values["username"] = "" + sess.Values["admin"] = false sess.Values["session_token"] = "" sess.Save(c.Request(), c.Response()) } diff --git a/main.go b/main.go index 3f0cd13b..aefc0bb1 100644 --- a/main.go +++ b/main.go @@ -137,7 +137,12 @@ func main() { app.POST(util.BasePath+"/login", handler.Login(db)) app.GET(util.BasePath+"/logout", handler.Logout(), handler.ValidSession) app.GET(util.BasePath+"/profile", handler.LoadProfile(db), handler.ValidSession) - app.POST(util.BasePath+"/profile", handler.UpdateProfile(db), handler.ValidSession) + app.GET(util.BasePath+"/users-settings", handler.UsersSettings(db), handler.ValidSession, handler.NeedsAdmin) + app.POST(util.BasePath+"/update-user", handler.UpdateUser(db), handler.ValidSession) + app.POST(util.BasePath+"/create-user", handler.CreateUser(db), handler.ValidSession, handler.NeedsAdmin) + app.POST(util.BasePath+"/remove-user", handler.RemoveUser(db), handler.ValidSession, handler.NeedsAdmin) + app.GET(util.BasePath+"/getusers", handler.GetUsers(db), handler.ValidSession, handler.NeedsAdmin) + app.GET(util.BasePath+"/api/user/:username", handler.GetUser(db), handler.ValidSession) } var sendmail emailer.Emailer @@ -154,11 +159,12 @@ func main() { app.POST(util.BasePath+"/client/set-status", handler.SetClientStatus(db), handler.ValidSession, handler.ContentTypeJson) app.POST(util.BasePath+"/remove-client", handler.RemoveClient(db), handler.ValidSession, handler.ContentTypeJson) app.GET(util.BasePath+"/download", handler.DownloadClient(db), handler.ValidSession) - app.GET(util.BasePath+"/wg-server", handler.WireGuardServer(db), handler.ValidSession) - app.POST(util.BasePath+"/wg-server/interfaces", handler.WireGuardServerInterfaces(db), handler.ValidSession, handler.ContentTypeJson) - app.POST(util.BasePath+"/wg-server/keypair", handler.WireGuardServerKeyPair(db), handler.ValidSession, handler.ContentTypeJson) - app.GET(util.BasePath+"/global-settings", handler.GlobalSettings(db), handler.ValidSession) - app.POST(util.BasePath+"/global-settings", handler.GlobalSettingSubmit(db), handler.ValidSession, handler.ContentTypeJson) + app.GET(util.BasePath+"/wg-server", handler.WireGuardServer(db), handler.ValidSession, handler.NeedsAdmin) + app.POST(util.BasePath+"/wg-server/interfaces", handler.WireGuardServerInterfaces(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin) + app.POST(util.BasePath+"/wg-server/keypair", handler.WireGuardServerKeyPair(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin) + app.GET(util.BasePath+"/global-settings", handler.GlobalSettings(db), handler.ValidSession, handler.NeedsAdmin) + + app.POST(util.BasePath+"/global-settings", handler.GlobalSettingSubmit(db), handler.ValidSession, handler.ContentTypeJson, handler.NeedsAdmin) app.GET(util.BasePath+"/status", handler.Status(db), handler.ValidSession) app.GET(util.BasePath+"/api/clients", handler.GetClients(db), handler.ValidSession) app.GET(util.BasePath+"/api/client/:id", handler.GetClient(db), handler.ValidSession) @@ -197,8 +203,13 @@ func initServerConfig(db store.IStore, tmplBox *rice.Box) { log.Fatalf("Cannot get client config: ", err) } + users, err := db.GetUsers() + if err != nil { + log.Fatalf("Cannot get user config: ", err) + } + // write config file - err = util.WriteWireGuardServerConfig(tmplBox, server, clients, settings) + err = util.WriteWireGuardServerConfig(tmplBox, server, clients, users, settings) if err != nil { log.Fatalf("Cannot create server config: ", err) } diff --git a/model/misc.go b/model/misc.go index 12d6906a..d8f2cf58 100644 --- a/model/misc.go +++ b/model/misc.go @@ -10,4 +10,5 @@ type Interface struct { type BaseData struct { Active string CurrentUser string + Admin bool } diff --git a/model/user.go b/model/user.go index 711ebd1f..71f4d138 100644 --- a/model/user.go +++ b/model/user.go @@ -6,4 +6,5 @@ type User struct { Password string `json:"password"` // PasswordHash takes precedence over Password. PasswordHash string `json:"password_hash"` + Admin bool `json:"admin"` } diff --git a/router/router.go b/router/router.go index 0f9facc8..f262243a 100644 --- a/router/router.go +++ b/router/router.go @@ -83,6 +83,11 @@ func New(tmplBox *rice.Box, extraData map[string]string, secret []byte) *echo.Ec log.Fatal(err) } + tmplUsersSettingsString, err := tmplBox.String("users_settings.html") + if err != nil { + log.Fatal(err) + } + tmplStatusString, err := tmplBox.String("status.html") if err != nil { log.Fatal(err) @@ -103,6 +108,7 @@ func New(tmplBox *rice.Box, extraData map[string]string, secret []byte) *echo.Ec templates["clients.html"] = template.Must(template.New("clients").Funcs(funcs).Parse(tmplBaseString + tmplClientsString)) templates["server.html"] = template.Must(template.New("server").Funcs(funcs).Parse(tmplBaseString + tmplServerString)) templates["global_settings.html"] = template.Must(template.New("global_settings").Funcs(funcs).Parse(tmplBaseString + tmplGlobalSettingsString)) + templates["users_settings.html"] = template.Must(template.New("users_settings").Funcs(funcs).Parse(tmplBaseString + tmplUsersSettingsString)) templates["status.html"] = template.Must(template.New("status").Funcs(funcs).Parse(tmplBaseString + tmplStatusString)) templates["wake_on_lan_hosts.html"] = template.Must(template.New("wake_on_lan_hosts").Funcs(funcs).Parse(tmplBaseString + tmplWakeOnLanHostsString)) diff --git a/store/jsondb/jsondb.go b/store/jsondb/jsondb.go index f39a4521..61d9cc5e 100644 --- a/store/jsondb/jsondb.go +++ b/store/jsondb/jsondb.go @@ -42,7 +42,7 @@ func (o *JsonDB) Init() error { var serverInterfacePath string = path.Join(serverPath, "interfaces.json") var serverKeyPairPath string = path.Join(serverPath, "keypair.json") var globalSettingPath string = path.Join(serverPath, "global_settings.json") - var userPath string = path.Join(serverPath, "users.json") + var userPath string = path.Join(o.dbPath, "users") // create directories if they do not exist if _, err := os.Stat(clientPath); os.IsNotExist(err) { os.MkdirAll(clientPath, os.ModePerm) @@ -53,6 +53,9 @@ func (o *JsonDB) Init() error { if _, err := os.Stat(wakeOnLanHostsPath); os.IsNotExist(err) { os.MkdirAll(wakeOnLanHostsPath, os.ModePerm) } + if _, err := os.Stat(userPath); os.IsNotExist(err) { + os.MkdirAll(userPath, os.ModePerm) + } // server's interface if _, err := os.Stat(serverInterfacePath); os.IsNotExist(err) { @@ -103,9 +106,11 @@ func (o *JsonDB) Init() error { } // user info - if _, err := os.Stat(userPath); os.IsNotExist(err) { + results, err := o.conn.ReadAll("users") + if err != nil || len(results) < 1 { user := new(model.User) user.Username = util.LookupEnvOrString(util.UsernameEnvVar, util.DefaultUsername) + user.Admin = util.DefaultIsAdmin user.PasswordHash = util.LookupEnvOrString(util.PasswordHashEnvVar, "") if user.PasswordHash == "" { plaintext := util.LookupEnvOrString(util.PasswordEnvVar, util.DefaultPassword) @@ -115,7 +120,7 @@ func (o *JsonDB) Init() error { } user.PasswordHash = hash } - o.conn.Write("server", "users", user) + o.conn.Write("users", user.Username, user) } return nil @@ -127,11 +132,48 @@ func (o *JsonDB) GetUser() (model.User, error) { return user, o.conn.Read("server", "users", &user) } -// SaveUser func to user info to the database +// GetUsers func to query user info from the database +func (o *JsonDB) GetUsers() ([]model.User, error) { + var users []model.User + results, err := o.conn.ReadAll("users") + if err != nil { + return users, err + } + for _, i := range results { + user := model.User{} + + if err := json.Unmarshal([]byte(i), &user); err != nil { + return users, fmt.Errorf("cannot decode user json structure: %v", err) + } + users = append(users, user) + + } + return users, err +} + +func (o *JsonDB) GetUserByName(username string) (model.User, error) { + user := model.User{} + + if err := o.conn.Read("users", username, &user); err != nil { + return user, err + } + + return user, nil +} + func (o *JsonDB) SaveUser(user model.User) error { - return o.conn.Write("server", "users", user) + return o.conn.Write("users", user.Username, user) } +func (o *JsonDB) DeleteUser(username string) error { + return o.conn.Delete("users", username) +} + +//// SaveUser func to user info to the database +//func (o *JsonDB) SaveUser(user model.User) error { +// return o.conn.Write("server", "users", user) +//} + // GetGlobalSettings func to query global settings from the database func (o *JsonDB) GetGlobalSettings() (model.GlobalSetting, error) { settings := model.GlobalSetting{} @@ -213,7 +255,7 @@ func (o *JsonDB) GetClientByID(clientID string, qrCodeSettings model.QRCodeSetti server, _ := o.GetServer() globalSettings, _ := o.GetGlobalSettings() client := client - if !qrCodeSettings.IncludeDNS{ + if !qrCodeSettings.IncludeDNS { globalSettings.DNSServers = []string{} } if !qrCodeSettings.IncludeMTU { diff --git a/store/store.go b/store/store.go index 86d62243..166bc3da 100644 --- a/store/store.go +++ b/store/store.go @@ -6,8 +6,10 @@ import ( type IStore interface { Init() error - GetUser() (model.User, error) + GetUsers() ([]model.User, error) + GetUserByName(username string) (model.User, error) SaveUser(user model.User) error + DeleteUser(username string) error GetGlobalSettings() (model.GlobalSetting, error) GetServer() (model.Server, error) GetClients(hasQRCode bool) ([]model.ClientData, error) diff --git a/templates/base.html b/templates/base.html index fd337a7b..227e35d4 100644 --- a/templates/base.html +++ b/templates/base.html @@ -88,7 +88,13 @@
{{if .baseData.CurrentUser}} - {{.baseData.CurrentUser}} + + {{if .baseData.Admin}} + Administrator: {{.baseData.CurrentUser}} + {{else}} + Manager: {{.baseData.CurrentUser}} + {{end}} + {{else}} Administrator {{end}} @@ -107,6 +113,8 @@

+ + {{if .baseData.Admin}}
  • @@ -115,6 +123,8 @@

    • + +
  • SETTINGS
  • @@ -124,6 +134,16 @@

    • +
  • + + +

    + Users Settings +

    +     +
    • + {{end}} +
  • UTILITIES
  • diff --git a/templates/login.html b/templates/login.html index c75aa392..db0ba243 100644 --- a/templates/login.html +++ b/templates/login.html @@ -99,7 +99,11 @@ $("#btn_login").click(function () { const username = $("#username").val(); const password = $("#password").val(); - const data = {"username": username, "password": password} + let rememberMe = false; + if ($("#remember").is(':checked')){ + rememberMe = true; + } + const data = {"username": username, "password": password, "rememberMe": rememberMe} $.ajax({ cache: false, diff --git a/templates/profile.html b/templates/profile.html index c2d3b958..5b08745e 100644 --- a/templates/profile.html +++ b/templates/profile.html @@ -31,7 +31,7 @@

    Update user information

    + value="">
    @@ -55,56 +55,83 @@

    Update user information

    {{ define "bottom_js"}} {{ end }} diff --git a/templates/users_settings.html b/templates/users_settings.html new file mode 100644 index 00000000..99f8328b --- /dev/null +++ b/templates/users_settings.html @@ -0,0 +1,290 @@ +{{define "title"}} +Users Settings +{{end}} + +{{define "top_css"}} +{{end}} + +{{define "username"}} +{{ .username }} +{{end}} + +{{define "page_title"}} +Users Settings +{{end}} + +{{define "page_content"}} +

    HUBBA BUBBA BABA YAGA

    +
    +
    +
    +
    +
    +
    + + + + + + +{{end}} + +{{define "bottom_js"}} + + +{{end}} diff --git a/util/config.go b/util/config.go index 63044ca4..16c182fa 100644 --- a/util/config.go +++ b/util/config.go @@ -24,6 +24,7 @@ var ( const ( DefaultUsername = "admin" DefaultPassword = "admin" + DefaultIsAdmin = true DefaultServerAddress = "10.252.1.0/24" DefaultServerPort = 51820 DefaultDNS = "1.1.1.1" diff --git a/util/util.go b/util/util.go index 40eb3574..d3b7c140 100644 --- a/util/util.go +++ b/util/util.go @@ -381,7 +381,7 @@ func ValidateIPAllocation(serverAddresses []string, ipAllocatedList []string, ip } // WriteWireGuardServerConfig to write Wireguard server config. e.g. wg0.conf -func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, clientDataList []model.ClientData, globalSettings model.GlobalSetting) error { +func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, clientDataList []model.ClientData, usersList []model.User, globalSettings model.GlobalSetting) error { var tmplWireguardConf string // if set, read wg.conf template from WgConfTemplate @@ -416,6 +416,7 @@ func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, cl "serverConfig": serverConfig, "clientDataList": clientDataList, "globalSettings": globalSettings, + "usersList": usersList, } err = t.Execute(f, config) From 4b5057e6585df7c66c2053bc7729ee44e106dbfa Mon Sep 17 00:00:00 2001 From: armisss4 Date: Thu, 29 Dec 2022 12:54:31 +0200 Subject: [PATCH 2/8] Security fixes Patched some security holes with GetUser and UpdateUser, did some minor cleanup --- Dockerfile | 4 ++-- custom/js/helper.js | 5 ++--- handler/routes.go | 30 +++++++++++++++++++++--------- handler/session.go | 2 +- store/jsondb/jsondb.go | 10 ++++------ templates/profile.html | 1 - templates/users_settings.html | 16 ++++++++++------ 7 files changed, 40 insertions(+), 28 deletions(-) diff --git a/Dockerfile b/Dockerfile index 70223c56..a30cefee 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,7 +10,6 @@ ARG BUILD_DEPENDENCIES="npm \ # Get dependencies RUN apk add --update --no-cache ${BUILD_DEPENDENCIES} -#RUN apt install ${BUILD_DEPENDENCIES} WORKDIR /build @@ -21,7 +20,8 @@ COPY package.json /build COPY yarn.lock /build # Prepare assets -RUN yarn install --pure-lockfile --production && yarn cache clean +RUN yarn install --pure-lockfile --production && \ + yarn cache clean # Move admin-lte dist RUN mkdir -p assets/dist/js assets/dist/css && \ diff --git a/custom/js/helper.js b/custom/js/helper.js index 50b1d769..f337e5d8 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -80,10 +80,9 @@ function renderClientList(data) { function renderUserList(data) { $.each(data, function(index, obj) { - // render client status css tag style let clientStatusHtml = '>' - // render client html content + // render user html content let html = `
    @@ -101,7 +100,7 @@ function renderUserList(data) {
    ` - // add the client html elements to the list + // add the user html elements to the list $('#users-list').append(html); }); } diff --git a/handler/routes.go b/handler/routes.go index ddab14f5..7db2a9ef 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -107,27 +107,31 @@ func Login(db store.IStore) echo.HandlerFunc { } } -// GetClients handler return a JSON list of Wireguard client data +// GetUsers handler return a JSON list of all users func GetUsers(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { - clientDataList, err := db.GetUsers() + usersList, err := db.GetUsers() if err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ false, fmt.Sprintf("Cannot get user list: %v", err), }) } - return c.JSON(http.StatusOK, clientDataList) + return c.JSON(http.StatusOK, usersList) } } -// GetClient handler returns a JSON object of Wireguard client data +// GetUser handler returns a JSON object of single user func GetUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { username := c.Param("username") + if !isAdmin(c) && (username != currentUser(c)) { + return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Manager cannot access other user data"}) + } + userData, err := db.GetUserByName(username) if err != nil { return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, "User not found"}) @@ -154,7 +158,7 @@ func LoadProfile(db store.IStore) echo.HandlerFunc { } } -// WireGuardClients handler +// UsersSettings handler func UsersSettings(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { return c.Render(http.StatusOK, "users_settings.html", map[string]interface{}{ @@ -163,7 +167,7 @@ func UsersSettings(db store.IStore) echo.HandlerFunc { } } -// UpdateProfile to update user information +// UpdateUser to update user information func UpdateUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -178,6 +182,14 @@ func UpdateUser(db store.IStore) echo.HandlerFunc { previousUsername := data["previous_username"].(string) admin := data["admin"].(bool) + if !isAdmin(c) && (previousUsername != currentUser(c)) { + return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Manager cannot access other user data"}) + } + + if !isAdmin(c) { + admin = false + } + user, err := db.GetUserByName(previousUsername) if err != nil { return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, err.Error()}) @@ -221,7 +233,7 @@ func UpdateUser(db store.IStore) echo.HandlerFunc { } } -// UpdateProfile to update user information +// CreateUser to create new user func CreateUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -266,7 +278,7 @@ func CreateUser(db store.IStore) echo.HandlerFunc { } } -// RemoveClient handler +// RemoveUser handler func RemoveUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -277,7 +289,7 @@ func RemoveUser(db store.IStore) echo.HandlerFunc { } username := data["username"].(string) - // delete client from database + // delete user from database if err := db.DeleteUser(username); err != nil { log.Error("Cannot delete user: ", err) diff --git a/handler/session.go b/handler/session.go index 689d507a..4cede6e1 100644 --- a/handler/session.go +++ b/handler/session.go @@ -55,7 +55,7 @@ func currentUser(c echo.Context) string { return username } -// currentUser to get username of logged in user +// isAdmin to get user type: admin or manager func isAdmin(c echo.Context) bool { if util.DisableLogin { return true diff --git a/store/jsondb/jsondb.go b/store/jsondb/jsondb.go index 61d9cc5e..e6ebfb27 100644 --- a/store/jsondb/jsondb.go +++ b/store/jsondb/jsondb.go @@ -132,7 +132,7 @@ func (o *JsonDB) GetUser() (model.User, error) { return user, o.conn.Read("server", "users", &user) } -// GetUsers func to query user info from the database +// GetUsers func to get all users from the database func (o *JsonDB) GetUsers() ([]model.User, error) { var users []model.User results, err := o.conn.ReadAll("users") @@ -151,6 +151,7 @@ func (o *JsonDB) GetUsers() ([]model.User, error) { return users, err } +// GetUserByName func to get single user from the database func (o *JsonDB) GetUserByName(username string) (model.User, error) { user := model.User{} @@ -161,19 +162,16 @@ func (o *JsonDB) GetUserByName(username string) (model.User, error) { return user, nil } +// SaveUser func to save user in the database func (o *JsonDB) SaveUser(user model.User) error { return o.conn.Write("users", user.Username, user) } +// DeleteUser func to remove user from the database func (o *JsonDB) DeleteUser(username string) error { return o.conn.Delete("users", username) } -//// SaveUser func to user info to the database -//func (o *JsonDB) SaveUser(user model.User) error { -// return o.conn.Write("server", "users", user) -//} - // GetGlobalSettings func to query global settings from the database func (o *JsonDB) GetGlobalSettings() (model.GlobalSetting, error) { settings := model.GlobalSetting{} diff --git a/templates/profile.html b/templates/profile.html index 5b08745e..fa801579 100644 --- a/templates/profile.html +++ b/templates/profile.html @@ -83,7 +83,6 @@

    Update user information

    function updateUserInfo() { const username = $("#username").val(); const password = $("#password").val(); -// const previous_username = $("#previous_username").val(); const data = {"username": username, "password": password, "previous_username": previous_username, "admin":admin}; $.ajax({ cache: false, diff --git a/templates/users_settings.html b/templates/users_settings.html index 99f8328b..05d8878d 100644 --- a/templates/users_settings.html +++ b/templates/users_settings.html @@ -14,7 +14,6 @@ {{end}} {{define "page_content"}} -

    HUBBA BUBBA BABA YAGA

    @@ -111,7 +110,7 @@

    Remove

    } {{ end }} diff --git a/templates/users_settings.html b/templates/users_settings.html deleted file mode 100644 index 05d8878d..00000000 --- a/templates/users_settings.html +++ /dev/null @@ -1,294 +0,0 @@ -{{define "title"}} -Users Settings -{{end}} - -{{define "top_css"}} -{{end}} - -{{define "username"}} -{{ .username }} -{{end}} - -{{define "page_title"}} -Users Settings -{{end}} - -{{define "page_content"}} -
    -
    -
    -
    -
    -
    - - - - - - -{{end}} - -{{define "bottom_js"}} - - -{{end}} diff --git a/util/config.go b/util/config.go index 16c182fa..63044ca4 100644 --- a/util/config.go +++ b/util/config.go @@ -24,7 +24,6 @@ var ( const ( DefaultUsername = "admin" DefaultPassword = "admin" - DefaultIsAdmin = true DefaultServerAddress = "10.252.1.0/24" DefaultServerPort = 51820 DefaultDNS = "1.1.1.1" diff --git a/util/util.go b/util/util.go index d3b7c140..40eb3574 100644 --- a/util/util.go +++ b/util/util.go @@ -381,7 +381,7 @@ func ValidateIPAllocation(serverAddresses []string, ipAllocatedList []string, ip } // WriteWireGuardServerConfig to write Wireguard server config. e.g. wg0.conf -func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, clientDataList []model.ClientData, usersList []model.User, globalSettings model.GlobalSetting) error { +func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, clientDataList []model.ClientData, globalSettings model.GlobalSetting) error { var tmplWireguardConf string // if set, read wg.conf template from WgConfTemplate @@ -416,7 +416,6 @@ func WriteWireGuardServerConfig(tmplBox *rice.Box, serverConfig model.Server, cl "serverConfig": serverConfig, "clientDataList": clientDataList, "globalSettings": globalSettings, - "usersList": usersList, } err = t.Execute(f, config) From 5986e1a7d0a5610b5cd381df4a0d84ff709d4d3c Mon Sep 17 00:00:00 2001 From: Arminas Date: Fri, 10 Feb 2023 08:58:36 +0200 Subject: [PATCH 6/8] Changed wgui.service Updated wgui.service to only apply changes, that were made to clients. Not fully tested, could cause issues with wg-quick specific options. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 598a9945..89244574 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ After=network.target [Service] Type=oneshot -ExecStart=/usr/bin/systemctl restart wg-quick@wg0.service +ExecStart=/bin/bash -c 'wg syncconf wg0 <(wg-quick strip wg0)' [Install] RequiredBy=wgui.path From aae63d1af98728c4c4b864b9a6a475953c9d72f3 Mon Sep 17 00:00:00 2001 From: Arminas Date: Fri, 10 Feb 2023 15:18:14 +0200 Subject: [PATCH 7/8] Changed wgui.service Changed wgui.service to call additional restart-wg.sh file. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 89244574..2eb2d3db 100644 --- a/README.md +++ b/README.md @@ -119,7 +119,7 @@ After=network.target [Service] Type=oneshot -ExecStart=/bin/bash -c 'wg syncconf wg0 <(wg-quick strip wg0)' +ExecStart=/bin/bash /DIR-TO-RESTART-FILE/restart-wg.sh [Install] RequiredBy=wgui.path From 09abbdfcf07f2e4e021bc47bf4f3f767ff17a219 Mon Sep 17 00:00:00 2001 From: Arminas Date: Fri, 10 Feb 2023 15:23:15 +0200 Subject: [PATCH 8/8] Created restart-wg.sh file Created wireguard restart script, which compares wg0.conf part between [Interface] and first peer with previous version for changes, and, if there is any - restarts whole wireguard, if the only changes are done to peers, it calls "wg syncconf", eliminating client disconnection after pressing apply config problem. --- restart-wg.sh | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 restart-wg.sh diff --git a/restart-wg.sh b/restart-wg.sh new file mode 100644 index 00000000..dbbe864e --- /dev/null +++ b/restart-wg.sh @@ -0,0 +1,27 @@ +#!/bin/bash + +config="/etc/wireguard/wg0.conf" +old_config="/etc/wireguard/wg0.conf.old" + +if [ ! -f $old_config ]; then + awk '/Interface/,/# ID:/' $config | head -n -1 | tail -n +2 > $old_config + echo "No old config found, restarting wireguard (wg-quick)" + wg-quick down wg0 + systemctl restart wg-quick@wg0.service + exit 0 +fi + +difference=$(diff <(awk '/Interface/,/# ID:/' $config | head -n -1 | tail -n +2) <(cat $old_config)) + +if [ -n "$difference" ]; then + awk '/Interface/,/# ID:/' $config | head -n -1 | tail -n +2 > $old_config + echo "Changes to interface detected, restarting wireguard (wg-quick)" + wg-quick down wg0 + systemctl restart wg-quick@wg0.service + exit 0 +else + awk '/Interface/,/# ID:/' $config | head -n -1 | tail -n +2 > $old_config + echo "No changes to interface detected, restarting wireguard (wg syncconf)" + wg syncconf wg0 <(wg-quick strip wg0) + exit 0 +fi