diff --git a/Dockerfile b/Dockerfile index 70223c5..a30cefe 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,7 +10,6 @@ ARG BUILD_DEPENDENCIES="npm \ # Get dependencies RUN apk add --update --no-cache ${BUILD_DEPENDENCIES} -#RUN apt install ${BUILD_DEPENDENCIES} WORKDIR /build @@ -21,7 +20,8 @@ COPY package.json /build COPY yarn.lock /build # Prepare assets -RUN yarn install --pure-lockfile --production && yarn cache clean +RUN yarn install --pure-lockfile --production && \ + yarn cache clean # Move admin-lte dist RUN mkdir -p assets/dist/js assets/dist/css && \ diff --git a/custom/js/helper.js b/custom/js/helper.js index 50b1d76..f337e5d 100644 --- a/custom/js/helper.js +++ b/custom/js/helper.js @@ -80,10 +80,9 @@ function renderClientList(data) { function renderUserList(data) { $.each(data, function(index, obj) { - // render client status css tag style let clientStatusHtml = '>' - // render client html content + // render user html content let html = `
@@ -101,7 +100,7 @@ function renderUserList(data) {
` - // add the client html elements to the list + // add the user html elements to the list $('#users-list').append(html); }); } diff --git a/handler/routes.go b/handler/routes.go index ddab14f..7db2a9e 100644 --- a/handler/routes.go +++ b/handler/routes.go @@ -107,27 +107,31 @@ func Login(db store.IStore) echo.HandlerFunc { } } -// GetClients handler return a JSON list of Wireguard client data +// GetUsers handler return a JSON list of all users func GetUsers(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { - clientDataList, err := db.GetUsers() + usersList, err := db.GetUsers() if err != nil { return c.JSON(http.StatusInternalServerError, jsonHTTPResponse{ false, fmt.Sprintf("Cannot get user list: %v", err), }) } - return c.JSON(http.StatusOK, clientDataList) + return c.JSON(http.StatusOK, usersList) } } -// GetClient handler returns a JSON object of Wireguard client data +// GetUser handler returns a JSON object of single user func GetUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { username := c.Param("username") + if !isAdmin(c) && (username != currentUser(c)) { + return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Manager cannot access other user data"}) + } + userData, err := db.GetUserByName(username) if err != nil { return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, "User not found"}) @@ -154,7 +158,7 @@ func LoadProfile(db store.IStore) echo.HandlerFunc { } } -// WireGuardClients handler +// UsersSettings handler func UsersSettings(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { return c.Render(http.StatusOK, "users_settings.html", map[string]interface{}{ @@ -163,7 +167,7 @@ func UsersSettings(db store.IStore) echo.HandlerFunc { } } -// UpdateProfile to update user information +// UpdateUser to update user information func UpdateUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -178,6 +182,14 @@ func UpdateUser(db store.IStore) echo.HandlerFunc { previousUsername := data["previous_username"].(string) admin := data["admin"].(bool) + if !isAdmin(c) && (previousUsername != currentUser(c)) { + return c.JSON(http.StatusForbidden, jsonHTTPResponse{false, "Manager cannot access other user data"}) + } + + if !isAdmin(c) { + admin = false + } + user, err := db.GetUserByName(previousUsername) if err != nil { return c.JSON(http.StatusNotFound, jsonHTTPResponse{false, err.Error()}) @@ -221,7 +233,7 @@ func UpdateUser(db store.IStore) echo.HandlerFunc { } } -// UpdateProfile to update user information +// CreateUser to create new user func CreateUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -266,7 +278,7 @@ func CreateUser(db store.IStore) echo.HandlerFunc { } } -// RemoveClient handler +// RemoveUser handler func RemoveUser(db store.IStore) echo.HandlerFunc { return func(c echo.Context) error { data := make(map[string]interface{}) @@ -277,7 +289,7 @@ func RemoveUser(db store.IStore) echo.HandlerFunc { } username := data["username"].(string) - // delete client from database + // delete user from database if err := db.DeleteUser(username); err != nil { log.Error("Cannot delete user: ", err) diff --git a/handler/session.go b/handler/session.go index 689d507..4cede6e 100644 --- a/handler/session.go +++ b/handler/session.go @@ -55,7 +55,7 @@ func currentUser(c echo.Context) string { return username } -// currentUser to get username of logged in user +// isAdmin to get user type: admin or manager func isAdmin(c echo.Context) bool { if util.DisableLogin { return true diff --git a/store/jsondb/jsondb.go b/store/jsondb/jsondb.go index 61d9cc5..e6ebfb2 100644 --- a/store/jsondb/jsondb.go +++ b/store/jsondb/jsondb.go @@ -132,7 +132,7 @@ func (o *JsonDB) GetUser() (model.User, error) { return user, o.conn.Read("server", "users", &user) } -// GetUsers func to query user info from the database +// GetUsers func to get all users from the database func (o *JsonDB) GetUsers() ([]model.User, error) { var users []model.User results, err := o.conn.ReadAll("users") @@ -151,6 +151,7 @@ func (o *JsonDB) GetUsers() ([]model.User, error) { return users, err } +// GetUserByName func to get single user from the database func (o *JsonDB) GetUserByName(username string) (model.User, error) { user := model.User{} @@ -161,19 +162,16 @@ func (o *JsonDB) GetUserByName(username string) (model.User, error) { return user, nil } +// SaveUser func to save user in the database func (o *JsonDB) SaveUser(user model.User) error { return o.conn.Write("users", user.Username, user) } +// DeleteUser func to remove user from the database func (o *JsonDB) DeleteUser(username string) error { return o.conn.Delete("users", username) } -//// SaveUser func to user info to the database -//func (o *JsonDB) SaveUser(user model.User) error { -// return o.conn.Write("server", "users", user) -//} - // GetGlobalSettings func to query global settings from the database func (o *JsonDB) GetGlobalSettings() (model.GlobalSetting, error) { settings := model.GlobalSetting{} diff --git a/templates/profile.html b/templates/profile.html index 5b08745..fa80157 100644 --- a/templates/profile.html +++ b/templates/profile.html @@ -83,7 +83,6 @@ Profile function updateUserInfo() { const username = $("#username").val(); const password = $("#password").val(); -// const previous_username = $("#previous_username").val(); const data = {"username": username, "password": password, "previous_username": previous_username, "admin":admin}; $.ajax({ cache: false, diff --git a/templates/users_settings.html b/templates/users_settings.html index 99f8328..05d8878 100644 --- a/templates/users_settings.html +++ b/templates/users_settings.html @@ -14,7 +14,6 @@ Users Settings {{end}} {{define "page_content"}} -

HUBBA BUBBA BABA YAGA

@@ -111,7 +110,7 @@ Users Settings }