Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit aafa5e6

Browse filesBrowse files
almegdadalmegdad
committed
Force Lowercase & Remove Sensitive Data
* add directive to force username & email lowercase * remove sensitive data in password reset * 2 space indentation in reset & forgot password views
1 parent 16b481f commit aafa5e6
Copy full SHA for aafa5e6

File tree

Expand file treeCollapse file tree

9 files changed

+71
-52
lines changed
Filter options
Expand file treeCollapse file tree

9 files changed

+71
-52
lines changed

‎modules/users/client/directives/users.client.directive.js

Copy file name to clipboard
+14Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
'use strict';
2+
3+
// Users directive used to force lowercase input
4+
angular.module('users').directive('lowercase', function () {
5+
return {
6+
require: 'ngModel',
7+
link: function (scope, element, attrs, modelCtrl) {
8+
modelCtrl.$parsers.push(function (input) {
9+
return input ? input.toLowerCase() : '';
10+
});
11+
element.css('text-transform', 'lowercase');
12+
}
13+
};
14+
});

‎modules/users/client/views/authentication/signin.client.view.html

Copy file name to clipboardExpand all lines: modules/users/client/views/authentication/signin.client.view.html
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ <h3 class="col-md-12 text-center">Or with your account</h3>
55
<fieldset>
66
<div class="form-group" show-errors>
77
<label for="username">Username</label>
8-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" required>
8+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase required>
99
<div ng-messages="userForm.username.$error" role="alert">
1010
<p class="help-block error-text" ng-message="required">Username is required.</p>
1111
</div>

‎modules/users/client/views/authentication/signup.client.view.html

Copy file name to clipboardExpand all lines: modules/users/client/views/authentication/signup.client.view.html
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ <h3 class="col-md-12 text-center">Or sign up using your email</h3>
1919
</div>
2020
<div class="form-group" show-errors>
2121
<label for="email">Email</label>
22-
<input type="email" id="email" name="email" class="form-control" ng-model="credentials.email" placeholder="Email" required>
22+
<input type="email" id="email" name="email" class="form-control" ng-model="credentials.email" placeholder="Email" lowercase required>
2323
<div ng-messages="userForm.email.$error" role="alert">
2424
<p class="help-block error-text" ng-message="required">Email address is required.</p>
2525
<p class="help-block error-text" ng-message="email">Email address is invalid.</p>
2626
</div>
2727
</div>
2828
<div class="form-group" show-errors>
2929
<label for="username">Username</label>
30-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" required>
30+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase required>
3131
<div ng-messages="userForm.username.$error" role="alert">
3232
<p class="help-block error-text" ng-message="required">Username is required.</p>
3333
</div>

‎modules/users/client/views/password/forgot-password.client.view.html

Copy file name to clipboard
+18-18Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
<section class="row" ng-controller="PasswordController">
2-
<h3 class="col-md-12 text-center">Restore your password</h3>
3-
<p class="small text-center">Enter your account username.</p>
4-
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
5-
<form ng-submit="askForPasswordReset()" class="form-horizontal" autocomplete="off">
6-
<fieldset>
2+
<h3 class="col-md-12 text-center">Restore your password</h3>
3+
<p class="small text-center">Enter your account username.</p>
4+
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
5+
<form ng-submit="askForPasswordReset()" class="form-horizontal" autocomplete="off">
6+
<fieldset>
77
<div class="form-group">
8-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username">
8+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase>
99
</div>
10-
<div class="text-center form-group">
11-
<button type="submit" class="btn btn-primary">Submit</button>
12-
</div>
13-
<div ng-show="error" class="text-center text-danger">
14-
<strong>{{error}}</strong>
15-
</div>
16-
<div ng-show="success" class="text-center text-success">
17-
<strong>{{success}}</strong>
18-
</div>
19-
</fieldset>
20-
</form>
21-
</div>
10+
<div class="text-center form-group">
11+
<button type="submit" class="btn btn-primary">Submit</button>
12+
</div>
13+
<div ng-show="error" class="text-center text-danger">
14+
<strong>{{error}}</strong>
15+
</div>
16+
<div ng-show="success" class="text-center text-success">
17+
<strong>{{success}}</strong>
18+
</div>
19+
</fieldset>
20+
</form>
21+
</div>
2222
</section>

‎modules/users/client/views/password/reset-password.client.view.html

Copy file name to clipboard
+24-24Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
<section class="row" ng-controller="PasswordController">
2-
<h3 class="col-md-12 text-center">Reset your password</h3>
3-
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
4-
<form ng-submit="resetUserPassword()" class="signin form-horizontal" autocomplete="off">
5-
<fieldset>
6-
<div class="form-group">
7-
<label for="newPassword">New Password</label>
8-
<input type="password" id="newPassword" name="newPassword" class="form-control" ng-model="passwordDetails.newPassword" placeholder="New Password">
9-
</div>
10-
<div class="form-group">
11-
<label for="verifyPassword">Verify Password</label>
12-
<input type="password" id="verifyPassword" name="verifyPassword" class="form-control" ng-model="passwordDetails.verifyPassword" placeholder="Verify Password">
13-
</div>
14-
<div class="text-center form-group">
15-
<button type="submit" class="btn btn-lg btn-primary">Update Password</button>
16-
</div>
17-
<div ng-show="error" class="text-center text-danger">
18-
<strong>{{error}}</strong>
19-
</div>
20-
<div ng-show="success" class="text-center text-success">
21-
<strong>{{success}}</strong>
22-
</div>
23-
</fieldset>
24-
</form>
25-
</div>
2+
<h3 class="col-md-12 text-center">Reset your password</h3>
3+
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
4+
<form ng-submit="resetUserPassword()" class="signin form-horizontal" autocomplete="off">
5+
<fieldset>
6+
<div class="form-group">
7+
<label for="newPassword">New Password</label>
8+
<input type="password" id="newPassword" name="newPassword" class="form-control" ng-model="passwordDetails.newPassword" placeholder="New Password">
9+
</div>
10+
<div class="form-group">
11+
<label for="verifyPassword">Verify Password</label>
12+
<input type="password" id="verifyPassword" name="verifyPassword" class="form-control" ng-model="passwordDetails.verifyPassword" placeholder="Verify Password">
13+
</div>
14+
<div class="text-center form-group">
15+
<button type="submit" class="btn btn-lg btn-primary">Update Password</button>
16+
</div>
17+
<div ng-show="error" class="text-center text-danger">
18+
<strong>{{error}}</strong>
19+
</div>
20+
<div ng-show="success" class="text-center text-success">
21+
<strong>{{success}}</strong>
22+
</div>
23+
</fieldset>
24+
</form>
25+
</div>
2626
</section>

‎modules/users/client/views/settings/edit-profile.client.view.html

Copy file name to clipboardExpand all lines: modules/users/client/views/settings/edit-profile.client.view.html
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@
1818
</div>
1919
<div class="form-group" show-errors>
2020
<label for="email">Email</label>
21-
<input type="email" id="email" name="email" class="form-control" ng-model="user.email" placeholder="Email" required>
21+
<input type="email" id="email" name="email" class="form-control" ng-model="user.email" placeholder="Email" lowercase required>
2222
<div ng-messages="userForm.email.$error" role="alert">
2323
<p class="help-block error-text" ng-message="required">Email address is required.</p>
2424
<p class="help-block error-text" ng-message="email">Email address is invalid.</p>
2525
</div>
2626
</div>
2727
<div class="form-group" show-errors>
2828
<label for="username">Username</label>
29-
<input type="text" id="username" name="username" class="form-control" ng-model="user.username" placeholder="Username" required>
29+
<input type="text" id="username" name="username" class="form-control" ng-model="user.username" placeholder="Username" lowercase required>
3030
<div ng-messages="userForm.username.$error" role="alert">
3131
<p class="help-block error-text" ng-message="required">Username is required.</p>
3232
</div>

‎modules/users/server/config/strategies/local.js

Copy file name to clipboardExpand all lines: modules/users/server/config/strategies/local.js
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module.exports = function () {
1515
},
1616
function (username, password, done) {
1717
User.findOne({
18-
username: username
18+
username: username.toLowerCase()
1919
}, function (err, user) {
2020
if (err) {
2121
return done(err);

‎modules/users/server/controllers/users/users.password.server.controller.js

Copy file name to clipboardExpand all lines: modules/users/server/controllers/users/users.password.server.controller.js
+5-2Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ exports.forgot = function (req, res, next) {
3030
function (token, done) {
3131
if (req.body.username) {
3232
User.findOne({
33-
username: req.body.username
33+
username: req.body.username.toLowerCase()
3434
}, '-salt -password', function (err, user) {
3535
if (!user) {
3636
return res.status(400).send({
@@ -144,7 +144,10 @@ exports.reset = function (req, res, next) {
144144
if (err) {
145145
res.status(400).send(err);
146146
} else {
147-
// Return authenticated user
147+
// Remove sensitive data before return authenticated user
148+
user.password = undefined;
149+
user.salt = undefined;
150+
148151
res.json(user);
149152

150153
done(err, user);

‎modules/users/server/models/user.server.model.js

Copy file name to clipboardExpand all lines: modules/users/server/models/user.server.model.js
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,17 @@ var UserSchema = new Schema({
5151
},
5252
email: {
5353
type: String,
54-
trim: true,
5554
unique: true,
55+
lowercase: true,
56+
trim: true,
5657
default: '',
5758
validate: [validateLocalStrategyEmail, 'Please fill a valid email address']
5859
},
5960
username: {
6061
type: String,
6162
unique: 'Username already exists',
6263
required: 'Please fill in a username',
64+
lowercase: true,
6365
trim: true
6466
},
6567
password: {
@@ -139,7 +141,7 @@ UserSchema.methods.authenticate = function (password) {
139141
*/
140142
UserSchema.statics.findUniqueUsername = function (username, suffix, callback) {
141143
var _this = this;
142-
var possibleUsername = username + (suffix || '');
144+
var possibleUsername = username.toLowerCase() + (suffix || '');
143145

144146
_this.findOne({
145147
username: possibleUsername

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.