Skip to content

Commit d36722f

Browse files
IanR01IanR01
authored
Change relative urls to absolute (#18)
* add logging in code * debugging, add logging * temporarily disable allowed domains check for debugging * add logging in /dialog/authorize route middleware * debugging remove res.locals in logging * add url met domain * debugging add APP_URL to urls * set appUrl in layout * set complete URL for several autorizeUrls * add complete URL to checkRequiredUserFields redirect * set full URL at template POST button * add logging for debugging check2FA function * fix defaultValue for twoFactorRoles in client model * add logging for debugging allowedDomains * change regex in seeds script, so also the path is removed from an URL (for allowed domains) * add debugging code * fix redirects to correctpath * fix redirect with APP_URL * added a lot of APP_URL env to redirects * use force flag for db syncing * add directConnection paramater to mongo connection string * remove directConnection parameter from mongo connection string * add appUrl to views via controllers * remove logging triggering an error * cleanup
1 parent 8093dc5 commit d36722f

27 files changed

+136
-102
lines changed

‎config/auth.js

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,15 @@ const memberRoleId = process.env.MEMBER_ROLE_ID ? process.env.MEMBER_ROLE_ID :
22
const anonymousRoleId = process.env.ANONYMOUS_ROLE_ID ? process.env.ANONYMOUS_ROLE_ID : 3;
33

44
const formatLoginUrl = (slug) => {
5-
return `/auth/${slug}/login`;
5+
return `${process.env.APP_URL}/auth/${slug}/login`;
66
}
77

88
const formatRegisterUrl = (slug) => {
9-
return `/auth/${slug}/register`;
9+
return `${process.env.APP_URL}/auth/${slug}/register`;
1010
}
1111

1212
const formatSMSCodeUrl = (slug) => {
13-
return `/auth/${slug}/sms-code`;
13+
return `${process.env.APP_URL}/auth/${slug}/sms-code`;
1414
}
1515

1616
const types = [

‎controllers/admin/client.js

+7-4
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,8 @@ const authTypes = require('../../config/auth').types;
1212
*/
1313
exports.all = (req, res, next) => {
1414
res.render('admin/client/all', {
15-
clients: req.clients
15+
clients: req.clients,
16+
appUrl: process.env.APP_URL
1617
});
1718
}
1819

@@ -28,6 +29,7 @@ exports.new = (req, res, next) => {
2829
requiredUserFields: userFields,
2930
exposedUserFields: userFields,
3031
authTypes: authTypes,
32+
appUrl: process.env.APP_URL
3133
});
3234
}
3335

@@ -46,7 +48,8 @@ exports.edit = (req, res, next) => {
4648
clientExposedUserFields: clientExposedUserFields,
4749
clientRequiredUserFields: clientRequiredUserFields,
4850
roles: req.roles,
49-
clients: req.clients
51+
clients: req.clients,
52+
appUrl: process.env.APP_URL
5053
});
5154
}
5255

@@ -75,7 +78,7 @@ exports.create = (req, res, next) => {
7578
.create(values)
7679
.then((response) => {
7780
req.flash('success', { msg: 'Succesfully created '});
78-
res.redirect('/admin/client/' + response.id || '/');
81+
res.redirect(process.env.APP_URL + '/admin/client/' + response.id || '/');
7982
})
8083
.catch((err) => { next(err); });
8184
}
@@ -95,7 +98,7 @@ exports.update = (req, res, next) => {
9598
})
9699
.then((response) => {
97100
req.flash('success', { msg: 'Updated client!'});
98-
res.redirect('/admin/client/' + response.get('id') || '/');
101+
res.redirect(process.env.APP_URL + '/admin/client/' + response.get('id') || '/');
99102
})
100103
.catch((err) => { next(err); })
101104
}

‎controllers/admin/code.js

+9-6
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,22 @@ const csv = require('fast-csv');
55

66
exports.all = (req, res, next) => {
77
res.render('admin/code/all', {
8-
codes: req.codes
8+
codes: req.codes,
9+
appUrl: process.env.APP_URL
910
});
1011
}
1112

1213
exports.new = (req, res, next) => {
1314
res.render('admin/code/new', {
14-
clients: req.clients
15+
clients: req.clients,
16+
appUrl: process.env.APP_URL
1517
});
1618
}
1719

1820
exports.bulk = (req, res, next) => {
1921
res.render('admin/code/bulk', {
20-
clients: req.clients
22+
clients: req.clients,
23+
appUrl: process.env.APP_URL
2124
});
2225
}
2326

@@ -111,7 +114,7 @@ exports.postBulk = (req, res, next) => {
111114
req.flash('success', {msg: `All codes succesfully created!` });
112115
}
113116

114-
res.redirect(req.header('Referer') || '/admin/code/bulk');
117+
res.redirect(req.header('Referer') || `${process.env.APP_URL}/admin/code/bulk`);
115118
}
116119

117120
/**
@@ -141,13 +144,13 @@ exports.create = (req, res, next) => {
141144
.create({ code, clientId })
142145
.then((response) => {
143146
req.flash('success', { msg: 'Succesfully created '});
144-
res.redirect('/admin/codes' || '/');
147+
res.redirect(`${process.env.APP_URL}/admin/codes`);
145148
})
146149
.catch((err) => { next(err); });
147150
}
148151

149152
exports.destroy = (req, res) => {
150153
req.body.code.destroy();
151154
req.flash('success', { msg: 'Succesfully removed'});
152-
res.redirect('/admin/codes');
155+
res.redirect(process.env.APP_URL + '/admin/codes');
153156
}

‎controllers/admin/role.js

+9-5
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,21 @@ const db = require('../../db');
33

44
exports.all = (req, res, next) => {
55
res.render('admin/role/all', {
6-
roles: req.roles
6+
roles: req.roles,
7+
appUrl: process.env.APP_URL
78
});
89
}
910

1011
exports.new = (req, res, next) => {
11-
res.render('admin/role/new');
12+
res.render('admin/role/new', {
13+
appUrl: process.env.APP_URL
14+
});
1215
}
1316

1417
exports.edit = (req, res, next) => {
1518
res.render('admin/role/edit', {
16-
role: req.role
19+
role: req.role,
20+
appUrl: process.env.APP_URL
1721
});
1822
}
1923

@@ -27,7 +31,7 @@ exports.create = (req, res, next) => {
2731
.create({ name })
2832
.then((response) => {
2933
req.flash('success', { msg: 'Succesfully created '});
30-
res.redirect('/admin/roles' || '/');
34+
res.redirect(`${process.env.APP_URL}/admin/roles`);
3135
})
3236
.catch((err) => { next(err); });
3337
}
@@ -39,7 +43,7 @@ exports.update = (req, res, next) => {
3943
.update({name})
4044
.then((response) => {
4145
req.flash('success', { msg: 'Updated role!'});
42-
res.redirect('/admin/role/' + response.get('id') || '/');
46+
res.redirect(`${process.env.APP_URL}/admin/role/` + response.get('id') || process.env.APP_URL);
4347
})
4448
.catch((err) => { next(err); })
4549
}

‎controllers/admin/user.js

+7-5
Original file line numberDiff line numberDiff line change
@@ -21,14 +21,16 @@ exports.edit = (req, res) => {
2121
user: req.userObject,
2222
roles: req.roles,
2323
clients: userClients,
24-
userRoles: userRoles
24+
userRoles: userRoles,
25+
appUrl: process.env.APP_URL
2526
});
2627
}
2728

2829
exports.new = (req, res) => {
2930
res.render('admin/user/new', {
3031
roles: req.roles,
31-
clients: req.clients
32+
clients: req.clients,
33+
appUrl: process.env.APP_URL
3234
});
3335
}
3436

@@ -58,7 +60,7 @@ exports.create = (req, res, next) => {
5860
})
5961
.then((response) => {
6062
req.flash('success', { msg: 'Succesfully created '});
61-
res.redirect('/admin/user/' + response.id );
63+
res.redirect(`${process.env.APP_URL}/admin/user/` + response.id );
6264
})
6365
.catch((err) => {
6466
next(err);
@@ -105,11 +107,11 @@ exports.update = (req, res, next) => {
105107
})
106108
.then(() => {
107109
req.flash('success', { msg: 'Updated user!' });
108-
res.redirect('/admin/user/' + req.userObject.id);
110+
res.redirect(`${process.env.APP_URL}/admin/user/` + req.userObject.id);
109111
})
110112
.catch((err) => {
111113
req.flash('error', { msg: 'Error!' });
112-
res.redirect('/admin/user/' + req.userObject.id);
114+
res.redirect(`${process.env.APP_URL}/admin/user/` + req.userObject.id);
113115
})
114116

115117
}

‎controllers/auth/anonymous.js

+8-7
Original file line numberDiff line numberDiff line change
@@ -20,21 +20,21 @@ exports.login = (req, res, next) => {
2020

2121
// catch users that have cookies turned off
2222
req.session.createAnonymousUser = true;
23-
res.redirect('/auth/anonymous/register?' + queryString)
23+
res.redirect(`${process.env.APP_URL}/auth/anonymous/register?` + queryString)
2424

2525
};
2626

2727
exports.register = (req, res, next) => {
2828

2929
if (req.client && req.client.config.users && req.client.config.users && req.client.config.users.canCreateNewUsers === false) {
3030
req.flash('error', {msg: 'Cannot create new users'});
31-
return res.redirect(`/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
31+
return res.redirect(`${process.env.APP_URL}/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
3232
}
3333

3434
if (!req.session.createAnonymousUser) {
3535

3636
req.flash('error', {msg: 'Cookies zijn onmisbaar op deze site'});
37-
return res.redirect(`/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
37+
return res.redirect(`${process.env.APP_URL}/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
3838

3939
} else {
4040

@@ -46,7 +46,7 @@ exports.register = (req, res, next) => {
4646

4747
if (!user) {
4848
req.flash('error', {msg: authAnonymousConfig.errorMessage});
49-
return res.redirect(`/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
49+
return res.redirect(`${process.env.APP_URL}/auth/anonymous/info?clientId=${req.client.clientId}&redirect_uri=${req.query.redirect_uri}`);
5050
}
5151

5252
req.user = user;
@@ -65,8 +65,8 @@ exports.register = (req, res, next) => {
6565
ip: ip
6666
}
6767

68-
const authorizeUrl = `/dialog/authorize?redirect_uri=${encodeURIComponent(req.query.redirect_uri)}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
69-
68+
const authorizeUrl = `${process.env.APP_URL}/dialog/authorize?redirect_uri=${encodeURIComponent(req.query.redirect_uri)}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
69+
7070
try {
7171
db.ActionLog
7272
.create(values)
@@ -91,7 +91,7 @@ exports.register = (req, res, next) => {
9191
.catch((err) => {
9292
console.log('===> err', err);
9393
req.flash('error', {msg: 'Inloggen is niet gelukt'});
94-
return res.redirect(`/auth/anonymous/info?clientId=${req.client.clientId}`);
94+
return res.redirect(`${process.env.APP_URL}/auth/anonymous/info?clientId=${req.client.clientId}`);
9595
});
9696

9797
}
@@ -103,5 +103,6 @@ exports.info = (req, res, next) => {
103103
loginUrl: authAnonymousConfig.loginUrl,
104104
clientId: req.client.clientId,
105105
client: req.client,
106+
appUrl: process.env.APP_URL
106107
});
107108
}

‎controllers/auth/choose.js

+3-2
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,16 @@ const configAuthTypes = require('../../config/auth.js').types;
3030
if (req.query.redirect_uri) {
3131
url = url + '&redirect_uri=' + encodeURIComponent(req.query.redirect_uri);
3232
}
33-
33+
3434
res.redirect(url);
3535
} else {
3636
res.render('auth/choose', {
3737
authTypes: availableAuthTypes,
3838
isPriviligedRoute: isPriviligedRoute,
3939
clientId: req.client.clientId,
4040
client: req.client,
41-
redirect_uri: encodeURIComponent(req.query.redirect_uri)
41+
redirect_uri: encodeURIComponent(req.query.redirect_uri),
42+
appUrl: process.env.APP_URL
4243
})
4344
}
4445
};

‎controllers/auth/code.js

+3-2
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,8 @@ exports.login = (req, res, next) => {
2525
buttonText: configAuthType.buttonText ? configAuthType.buttonText : authCodeConfig.buttonText,
2626
displaySidebar: configAuthType.displaySidebar ? configAuthType.displaySidebar : authCodeConfig.displaySidebar,
2727
backUrl: authCodeConfig.displayBackbutton ? backUrl : false,
28-
redirect_uri: encodeURIComponent(req.query.redirect_uri)
28+
redirect_uri: encodeURIComponent(req.query.redirect_uri),
29+
appUrl: process.env.APP_URL
2930
});
3031
}
3132

@@ -46,7 +47,7 @@ exports.postLogin = (req, res, next) => {
4647
req.brute.resetKey(req.bruteKey);
4748
const redirectUrl = req.query.redirect_uri ? req.query.redirect_uri : req.client.redirectUrl;
4849
// Redirect if it succeeds to authorize screen
49-
const authorizeUrl = `/dialog/authorize?redirect_uri=${encodeURIComponent(redirectUrl)}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
50+
const authorizeUrl = `${process.env.APP_URL}/dialog/authorize?redirect_uri=${encodeURIComponent(redirectUrl)}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
5051
return res.redirect(authorizeUrl);
5152
}
5253

‎controllers/auth/forgot.js

+5-3
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ exports.forgot = (req, res) => {
2929
clientId: req.client.clientId,
3030
client: req.client,
3131
redirectUrl: encodeURIComponent(req.query.redirect_uri),
32+
appUrl: process.env.APP_URL
3233
});
3334
};
3435

@@ -48,6 +49,7 @@ exports.reset = (req, res) => {
4849
clientId: req.client.clientId,
4950
client: req.client,
5051
redirectUrl: encodeURIComponent(req.query.redirect_uri),
52+
appUrl: process.env.APP_URL
5153
});
5254
};
5355

@@ -92,7 +94,7 @@ exports.postForgot = (req, res, next) => {
9294
.then((user) => {
9395
if (!user) {
9496
req.flash('error', {msg: 'Het is niet gelukt om de e-mail te versturen!'});
95-
res.redirect('/auth/local/forgot' + '?clientId=' + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
97+
res.redirect(`${process.env.APP_URL}/auth/local/forgot` + '?clientId=' + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
9698
}
9799

98100
req.user = user;
@@ -107,12 +109,12 @@ exports.postForgot = (req, res, next) => {
107109
})
108110
.then(() => {
109111
req.flash('success', {msg: 'We hebben een e-mail naar je verstuurd'});
110-
res.redirect('/auth/local/forgot?clientId=' + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
112+
res.redirect(`${process.env.APP_URL}/auth/local/forgot?clientId=` + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
111113
})
112114
.catch((err) => {
113115
console.log('ererer', err)
114116
req.flash('error', {msg: 'E-mail adres is niet bekend bij ons.'});
115-
res.redirect('/auth/local/forgot?clientId=' + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
117+
res.redirect(`${process.env.APP_URL}/auth/local/forgot?clientId=` + req.client.clientId + `&redirect_uri=${encodeURIComponent(req.query.redirect_uri)}`);
116118
});
117119

118120
/**

‎controllers/auth/local.js

+8-6
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,9 @@
2323
*/
2424
exports.index = (req, res) => {
2525
if (req.user) {
26-
res.redirect('/account');
26+
res.redirect(process.env.APP_URL + '/account');
2727
} else {
28-
res.redirect('/login');
28+
res.redirect(process.env.APP_URL + '/login');
2929
}
3030
};
3131

@@ -51,6 +51,7 @@ exports.login = (req, res) => {
5151
helpText: configAuthType.helpText ? configAuthType.helpText : authLocalConfig.helpText,
5252
buttonText: configAuthType.buttonText ? configAuthType.buttonText : authLocalConfig.buttonText,
5353
forgotPasswordText: configAuthType.forgotPasswordText ? configAuthType.forgotPasswordText : authLocalConfig.forgotPasswordText,
54+
appUrl: process.env.APP_URL
5455
});
5556
};
5657

@@ -62,7 +63,8 @@ exports.login = (req, res) => {
6263
*/
6364
exports.register = (req, res) => {
6465
res.render('auth/local/register', {
65-
clientId: req.client.clientId
66+
clientId: req.client.clientId,
67+
appUrl: process.env.APP_URL
6668
});
6769
};
6870

@@ -80,7 +82,7 @@ exports.postRegister = (req, res, next) => {
8082
.catch((err) => { next(err) });
8183
} else {
8284
req.flash('error', { errors });
83-
res.redirect('/register');
85+
res.redirect(process.env.APP_URL + '/register');
8486
}
8587
}
8688

@@ -102,7 +104,7 @@ exports.postLogin = (req, res, next) => {
102104
req.logIn(user, function(err) {
103105
if (err) { return next(err); }
104106
const redirectUrl = req.query.redirect_uri ? encodeURIComponent(req.query.redirect_uri) : req.client.redirectUrl;
105-
const authorizeUrl = `/dialog/authorize?redirect_uri=${redirectUrl}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
107+
const authorizeUrl = `${process.env.APP_URL}/dialog/authorize?redirect_uri=${redirectUrl}&response_type=code&client_id=${req.client.clientId}&scope=offline`;
106108

107109
// const redirectTo = req.session.returnTo ? req.session.returnTo : req.client.redirectUrl;
108110

@@ -129,7 +131,7 @@ exports.logout = async (req, res) => {
129131
let redirectURL = req.query.redirectUrl;
130132
try {
131133
const redirectUrlHost = redirectURL ? new URL(redirectURL).hostname : false;
132-
redirectURL = redirectUrlHost && allowedDomains && allowedDomains.indexOf(redirectUrlHost) !== -1 ? redirectURL : false;
134+
redirectURL = redirectUrlHost && allowedDomains && allowedDomains.indexOf(redirectUrlHost) !== -1 ? redirectURL : false;
133135
} catch (e) {
134136
redirectURL = null;
135137
}

0 commit comments

Comments
 (0)