|
|
@ -1,13 +1,13 @@
|
|
|
|
use rocket_contrib::json::Json;
|
|
|
|
|
|
|
|
use chrono::Utc;
|
|
|
|
use chrono::Utc;
|
|
|
|
|
|
|
|
use rocket_contrib::json::Json;
|
|
|
|
|
|
|
|
|
|
|
|
use crate::db::models::*;
|
|
|
|
use crate::db::models::*;
|
|
|
|
use crate::db::DbConn;
|
|
|
|
use crate::db::DbConn;
|
|
|
|
|
|
|
|
|
|
|
|
use crate::api::{EmptyResult, JsonResult, JsonUpcase, Notify, NumberOrString, PasswordData, UpdateType};
|
|
|
|
use crate::api::{EmptyResult, JsonResult, JsonUpcase, Notify, NumberOrString, PasswordData, UpdateType};
|
|
|
|
use crate::auth::{decode_invite, decode_delete, decode_verify_email, Headers};
|
|
|
|
use crate::auth::{decode_delete, decode_invite, decode_verify_email, Headers};
|
|
|
|
use crate::mail;
|
|
|
|
|
|
|
|
use crate::crypto;
|
|
|
|
use crate::crypto;
|
|
|
|
|
|
|
|
use crate::mail;
|
|
|
|
|
|
|
|
|
|
|
|
use crate::CONFIG;
|
|
|
|
use crate::CONFIG;
|
|
|
|
|
|
|
|
|
|
|
@ -414,20 +414,21 @@ fn post_email(data: JsonUpcase<ChangeEmailData>, headers: Headers, conn: DbConn)
|
|
|
|
|
|
|
|
|
|
|
|
match user.email_new {
|
|
|
|
match user.email_new {
|
|
|
|
Some(ref val) => {
|
|
|
|
Some(ref val) => {
|
|
|
|
if *val != data.NewEmail.to_string() {
|
|
|
|
if val != &data.NewEmail {
|
|
|
|
err!("Email change mismatch");
|
|
|
|
err!("Email change mismatch");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
},
|
|
|
|
}
|
|
|
|
None => err!("No email change pending"),
|
|
|
|
None => err!("No email change pending"),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
if CONFIG.mail_enabled() {
|
|
|
|
if CONFIG.mail_enabled() {
|
|
|
|
// Only check the token if we sent out an email...
|
|
|
|
// Only check the token if we sent out an email...
|
|
|
|
match user.email_new_token {
|
|
|
|
match user.email_new_token {
|
|
|
|
Some(ref val) =>
|
|
|
|
Some(ref val) => {
|
|
|
|
if *val != data.Token.into_string() {
|
|
|
|
if *val != data.Token.into_string() {
|
|
|
|
err!("Token mismatch");
|
|
|
|
err!("Token mismatch");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
}
|
|
|
|
None => err!("No email change pending"),
|
|
|
|
None => err!("No email change pending"),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
user.verified_at = Some(Utc::now().naive_utc());
|
|
|
|
user.verified_at = Some(Utc::now().naive_utc());
|
|
|
@ -480,11 +481,9 @@ fn post_verify_email_token(data: JsonUpcase<VerifyEmailTokenData>, conn: DbConn)
|
|
|
|
Ok(claims) => claims,
|
|
|
|
Ok(claims) => claims,
|
|
|
|
Err(_) => err!("Invalid claim"),
|
|
|
|
Err(_) => err!("Invalid claim"),
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
if claims.sub != user.uuid {
|
|
|
|
if claims.sub != user.uuid {
|
|
|
|
err!("Invalid claim");
|
|
|
|
err!("Invalid claim");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
user.verified_at = Some(Utc::now().naive_utc());
|
|
|
|
user.verified_at = Some(Utc::now().naive_utc());
|
|
|
|
user.last_verifying_at = None;
|
|
|
|
user.last_verifying_at = None;
|
|
|
|
user.login_verify_count = 0;
|
|
|
|
user.login_verify_count = 0;
|
|
|
@ -501,7 +500,7 @@ struct DeleteRecoverData {
|
|
|
|
Email: String,
|
|
|
|
Email: String,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
#[post("/accounts/delete-recover", data="<data>")]
|
|
|
|
#[post("/accounts/delete-recover", data = "<data>")]
|
|
|
|
fn post_delete_recover(data: JsonUpcase<DeleteRecoverData>, conn: DbConn) -> EmptyResult {
|
|
|
|
fn post_delete_recover(data: JsonUpcase<DeleteRecoverData>, conn: DbConn) -> EmptyResult {
|
|
|
|
let data: DeleteRecoverData = data.into_inner().data;
|
|
|
|
let data: DeleteRecoverData = data.into_inner().data;
|
|
|
|
|
|
|
|
|
|
|
@ -530,7 +529,7 @@ struct DeleteRecoverTokenData {
|
|
|
|
Token: String,
|
|
|
|
Token: String,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
#[post("/accounts/delete-recover-token", data="<data>")]
|
|
|
|
#[post("/accounts/delete-recover-token", data = "<data>")]
|
|
|
|
fn post_delete_recover_token(data: JsonUpcase<DeleteRecoverTokenData>, conn: DbConn) -> EmptyResult {
|
|
|
|
fn post_delete_recover_token(data: JsonUpcase<DeleteRecoverTokenData>, conn: DbConn) -> EmptyResult {
|
|
|
|
let data: DeleteRecoverTokenData = data.into_inner().data;
|
|
|
|
let data: DeleteRecoverTokenData = data.into_inner().data;
|
|
|
|
|
|
|
|
|
|
|
@ -543,11 +542,9 @@ fn post_delete_recover_token(data: JsonUpcase<DeleteRecoverTokenData>, conn: DbC
|
|
|
|
Ok(claims) => claims,
|
|
|
|
Ok(claims) => claims,
|
|
|
|
Err(_) => err!("Invalid claim"),
|
|
|
|
Err(_) => err!("Invalid claim"),
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
|
|
if claims.sub != user.uuid {
|
|
|
|
if claims.sub != user.uuid {
|
|
|
|
err!("Invalid claim");
|
|
|
|
err!("Invalid claim");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
user.delete(&conn)
|
|
|
|
user.delete(&conn)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|