|
@@ -3,6 +3,9 @@ import express from 'express';
|
|
|
import injectResetOrderByTokenMiddleware from '../middlewares/inject-reset-order-by-token-middleware';
|
|
import injectResetOrderByTokenMiddleware from '../middlewares/inject-reset-order-by-token-middleware';
|
|
|
import injectUserRegistrationOrderByTokenMiddleware from '../middlewares/inject-user-registration-order-by-token-middleware';
|
|
import injectUserRegistrationOrderByTokenMiddleware from '../middlewares/inject-user-registration-order-by-token-middleware';
|
|
|
|
|
|
|
|
|
|
+import * as loginFormValidator from '../middlewares/login-form-validator';
|
|
|
|
|
+import * as registerFormValidator from '../middlewares/register-form-validator';
|
|
|
|
|
+
|
|
|
import * as forgotPassword from './forgot-password';
|
|
import * as forgotPassword from './forgot-password';
|
|
|
import * as privateLegacyPages from './private-legacy-pages';
|
|
import * as privateLegacyPages from './private-legacy-pages';
|
|
|
import * as allInAppNotifications from './all-in-app-notifications';
|
|
import * as allInAppNotifications from './all-in-app-notifications';
|
|
@@ -14,7 +17,7 @@ const rateLimit = require('express-rate-limit');
|
|
|
|
|
|
|
|
const apiLimiter = rateLimit({
|
|
const apiLimiter = rateLimit({
|
|
|
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
windowMs: 15 * 60 * 1000, // 15 minutes
|
|
|
- max: 5, // limit each IP to 5 requests per windowMs
|
|
|
|
|
|
|
+ max: 10, // limit each IP to 10 requests per windowMs
|
|
|
message:
|
|
message:
|
|
|
'Too many requests sent from this IP, please try again after 15 minutes',
|
|
'Too many requests sent from this IP, please try again after 15 minutes',
|
|
|
});
|
|
});
|
|
@@ -34,7 +37,6 @@ module.exports = function(crowi, app) {
|
|
|
const injectUserUISettings = require('../middlewares/inject-user-ui-settings-to-localvars')();
|
|
const injectUserUISettings = require('../middlewares/inject-user-ui-settings-to-localvars')();
|
|
|
|
|
|
|
|
const uploads = multer({ dest: `${crowi.tmpDir}uploads` });
|
|
const uploads = multer({ dest: `${crowi.tmpDir}uploads` });
|
|
|
- const form = require('../form');
|
|
|
|
|
const page = require('./page')(crowi, app);
|
|
const page = require('./page')(crowi, app);
|
|
|
const login = require('./login')(crowi, app);
|
|
const login = require('./login')(crowi, app);
|
|
|
const loginPassport = require('./login-passport')(crowi, app);
|
|
const loginPassport = require('./login-passport')(crowi, app);
|
|
@@ -61,10 +63,10 @@ module.exports = function(crowi, app) {
|
|
|
app.get('/login/error/:reason' , applicationInstalled, login.error);
|
|
app.get('/login/error/:reason' , applicationInstalled, login.error);
|
|
|
app.get('/login' , applicationInstalled, login.preLogin, login.login);
|
|
app.get('/login' , applicationInstalled, login.preLogin, login.login);
|
|
|
app.get('/login/invited' , applicationInstalled, login.invited);
|
|
app.get('/login/invited' , applicationInstalled, login.invited);
|
|
|
- app.post('/login/activateInvited' , applicationInstalled, form.invited , csrf, login.invited);
|
|
|
|
|
- app.post('/login' , applicationInstalled, form.login , csrf, loginPassport.loginWithLocal, loginPassport.loginWithLdap, loginPassport.loginFailure);
|
|
|
|
|
|
|
+ app.post('/login/activateInvited' , apiLimiter , applicationInstalled, loginFormValidator.inviteRules(), loginFormValidator.inviteValidation, csrf, login.invited);
|
|
|
|
|
+ app.post('/login' , apiLimiter , applicationInstalled, loginFormValidator.loginRules(), loginFormValidator.loginValidation, csrf, loginPassport.loginWithLocal, loginPassport.loginWithLdap, loginPassport.loginFailure);
|
|
|
|
|
|
|
|
- app.post('/register' , applicationInstalled, form.register , csrf, login.register);
|
|
|
|
|
|
|
+ app.post('/register' , apiLimiter , applicationInstalled, registerFormValidator.registerRules(), registerFormValidator.registerValidation, csrf, login.register);
|
|
|
app.get('/register' , applicationInstalled, login.preLogin, login.register);
|
|
app.get('/register' , applicationInstalled, login.preLogin, login.register);
|
|
|
app.get('/logout' , applicationInstalled, logout.logout);
|
|
app.get('/logout' , applicationInstalled, logout.logout);
|
|
|
|
|
|
|
@@ -75,7 +77,7 @@ module.exports = function(crowi, app) {
|
|
|
if (!isInstalled) {
|
|
if (!isInstalled) {
|
|
|
const installer = require('./installer')(crowi);
|
|
const installer = require('./installer')(crowi);
|
|
|
app.get('/installer' , applicationNotInstalled , installer.index);
|
|
app.get('/installer' , applicationNotInstalled , installer.index);
|
|
|
- app.post('/installer' , applicationNotInstalled , form.register , csrf, installer.install);
|
|
|
|
|
|
|
+ app.post('/installer' , apiLimiter , applicationNotInstalled , registerFormValidator.registerRules(), registerFormValidator.registerValidation, csrf, installer.install);
|
|
|
return;
|
|
return;
|
|
|
}
|
|
}
|
|
|
|
|
|
|
@@ -92,7 +94,7 @@ module.exports = function(crowi, app) {
|
|
|
app.get('/passport/oidc/callback' , loginPassport.loginPassportOidcCallback , loginPassport.loginFailure);
|
|
app.get('/passport/oidc/callback' , loginPassport.loginPassportOidcCallback , loginPassport.loginFailure);
|
|
|
app.post('/passport/saml/callback' , loginPassport.loginPassportSamlCallback , loginPassport.loginFailure);
|
|
app.post('/passport/saml/callback' , loginPassport.loginPassportSamlCallback , loginPassport.loginFailure);
|
|
|
|
|
|
|
|
- app.post('/_api/login/testLdap' , loginRequiredStrictly , form.login , loginPassport.testLdapCredentials);
|
|
|
|
|
|
|
+ app.post('/_api/login/testLdap' , apiLimiter , loginRequiredStrictly , loginFormValidator.loginRules() , loginFormValidator.loginValidation , loginPassport.testLdapCredentials);
|
|
|
|
|
|
|
|
// security admin
|
|
// security admin
|
|
|
app.get('/admin/security' , loginRequiredStrictly , adminRequired , admin.security.index);
|
|
app.get('/admin/security' , loginRequiredStrictly , adminRequired , admin.security.index);
|
|
@@ -158,7 +160,6 @@ module.exports = function(crowi, app) {
|
|
|
app.get('/_api/me/user-group-relations' , accessTokenParser , loginRequiredStrictly , me.api.userGroupRelations);
|
|
app.get('/_api/me/user-group-relations' , accessTokenParser , loginRequiredStrictly , me.api.userGroupRelations);
|
|
|
|
|
|
|
|
// HTTP RPC Styled API (に徐々に移行していいこうと思う)
|
|
// HTTP RPC Styled API (に徐々に移行していいこうと思う)
|
|
|
- app.get('/_api/users.list' , accessTokenParser , loginRequired , user.api.list);
|
|
|
|
|
app.get('/_api/pages.list' , accessTokenParser , loginRequired , page.api.list);
|
|
app.get('/_api/pages.list' , accessTokenParser , loginRequired , page.api.list);
|
|
|
app.post('/_api/pages.update' , accessTokenParser , loginRequiredStrictly , csrf, page.api.update);
|
|
app.post('/_api/pages.update' , accessTokenParser , loginRequiredStrictly , csrf, page.api.update);
|
|
|
app.get('/_api/pages.exist' , accessTokenParser , loginRequired , page.api.exist);
|
|
app.get('/_api/pages.exist' , accessTokenParser , loginRequired , page.api.exist);
|