No OneTemporary
Actions

Size

53 KB

Subscribers

None

View Options

	diff --git a/app.go b/app.go
	index 7630254..932fdca 100644
	--- a/app.go
	+++ b/app.go
	@@ -1,1003 +1,999 @@
	/*
	* Copyright © 2018-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"crypto/tls"
	"database/sql"
	_ "embed"
	"fmt"
	"html/template"
	"net"
	"net/http"
	"net/url"
	"os"
	"os/signal"
	"path/filepath"
	"regexp"
	"strings"
	"syscall"
	"time"

	"github.com/gorilla/mux"
	"github.com/gorilla/schema"
	"github.com/gorilla/sessions"
	"github.com/manifoldco/promptui"
	stripmd "github.com/writeas/go-strip-markdown/v2"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/log"
	"golang.org/x/crypto/acme/autocert"

	"github.com/writefreely/writefreely/author"
	"github.com/writefreely/writefreely/config"
	"github.com/writefreely/writefreely/key"
	"github.com/writefreely/writefreely/migrations"
	"github.com/writefreely/writefreely/page"
	)

	const (
	staticDir = "static"
	assumedTitleLen = 80
	postsPerPage = 10

	serverSoftware = "WriteFreely"
	softwareURL = "https://writefreely.org"
	)

	var (
	debugging bool

	// Software version can be set from git env using -ldflags
	softwareVer = "0.15.1"

	// DEPRECATED VARS
	isSingleUser bool
	)

	// App holds data and configuration for an individual WriteFreely instance.
	type App struct {
	router *mux.Router
	shttp *http.ServeMux
	db *datastore
	cfg *config.Config
	cfgFile string
	keys *key.Keychain
	sessionStore sessions.Store
	formDecoder *schema.Decoder
	updates *updatesCache

	timeline *localTimeline
	}

	// DB returns the App's datastore
	func (app App) DB() datastore {
	return app.db
	}

	// Router returns the App's router
	func (app App) Router() mux.Router {
	return app.router
	}

	// Config returns the App's current configuration.
	func (app App) Config() config.Config {
	return app.cfg
	}

	// SetConfig updates the App's Config to the given value.
	func (app App) SetConfig(cfg config.Config) {
	app.cfg = cfg
	}

	// SetKeys updates the App's Keychain to the given value.
	func (app App) SetKeys(k key.Keychain) {
	app.keys = k
	}

	func (app *App) SessionStore() sessions.Store {
	return app.sessionStore
	}

	func (app *App) SetSessionStore(s sessions.Store) {
	app.sessionStore = s
	}

	// Apper is the interface for getting data into and out of a WriteFreely
	// instance (or "App").
	//
	// App returns the App for the current instance.
	//
	// LoadConfig reads an app configuration into the App, returning any error
	// encountered.
	//
	// SaveConfig persists the current App configuration.
	//
	// LoadKeys reads the App's encryption keys and loads them into its
	// key.Keychain.
	type Apper interface {
	App() *App

	LoadConfig() error
	SaveConfig(*config.Config) error

	LoadKeys() error

	ReqLog(r *http.Request, status int, timeSince time.Duration) string
	}

	// App returns the App
	func (app App) App() App {
	return app
	}

	// LoadConfig loads and parses a config file.
	func (app *App) LoadConfig() error {
	log.Info("Loading %s configuration...", app.cfgFile)
	cfg, err := config.Load(app.cfgFile)
	if err != nil {
	log.Error("Unable to load configuration: %v", err)
	os.Exit(1)
	return err
	}
	app.cfg = cfg
	return nil
	}

	// SaveConfig saves the given Config to disk -- namely, to the App's cfgFile.
	func (app App) SaveConfig(c config.Config) error {
	return config.Save(c, app.cfgFile)
	}

	// LoadKeys reads all needed keys from disk into the App. In order to use the
	// configured `Server.KeysParentDir`, you must call initKeyPaths(App) before
	// this.
	func (app *App) LoadKeys() error {
	var err error
	app.keys = &key.Keychain{}

	if debugging {
	log.Info(" %s", emailKeyPath)
	}

	executable, err := os.Executable()
	if err != nil {
	executable = "writefreely"
	} else {
	executable = filepath.Base(executable)
	}

	app.keys.EmailKey, err = os.ReadFile(emailKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieAuthKeyPath)
	}
	app.keys.CookieAuthKey, err = os.ReadFile(cookieAuthKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieKeyPath)
	}
	app.keys.CookieKey, err = os.ReadFile(cookieKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", csrfKeyPath)
	}
	app.keys.CSRFKey, err = os.ReadFile(csrfKeyPath)
	if err != nil {
	if os.IsNotExist(err) {
	log.Error(`Missing key: %s.

	Run this command to generate missing keys:
	%s keys generate

	`, csrfKeyPath, executable)
	}
	return err
	}

	return nil
	}

	func (app App) ReqLog(r http.Request, status int, timeSince time.Duration) string {
	return fmt.Sprintf("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, timeSince, r.UserAgent())
	}

	// handleViewHome shows page at root path. It checks the configuration and
	// authentication state to show the correct page.
	func handleViewHome(app App, w http.ResponseWriter, r http.Request) error {
	if app.cfg.App.SingleUser {
	// Render blog index
	return handleViewCollection(app, w, r)
	}

	// Multi-user instance
	forceLanding := r.FormValue("landing") == "1"
	if !forceLanding {
	// Show correct page based on user auth status and configured landing path
	u := getUserSession(app, r)

	if app.cfg.App.Chorus {
	// This instance is focused on reading, so show Reader on home route if not
	// private or a private-instance user is logged in.
	if !app.cfg.App.Private \|\| u != nil {
	return viewLocalTimeline(app, w, r)
	}
	}

	if u != nil {
	// User is logged in, so show the Pad
	return handleViewPad(app, w, r)
	}

	if app.cfg.App.Private {
	return viewLogin(app, w, r)
	}

	if land := app.cfg.App.LandingPath(); land != "/" {
	return impart.HTTPError{http.StatusFound, land}
	}
	}

	return handleViewLanding(app, w, r)
	}

	func handleViewLanding(app App, w http.ResponseWriter, r http.Request) error {
	forceLanding := r.FormValue("landing") == "1"

	p := struct {
	page.StaticPage
	*OAuthButtons
	Flashes []template.HTML
	Banner template.HTML
	Content template.HTML

	ForcedLanding bool
	}{
	StaticPage: pageForReq(app, r),
	OAuthButtons: NewOAuthButtons(app.Config()),
	ForcedLanding: forceLanding,
	}

	banner, err := getLandingBanner(app)
	if err != nil {
	log.Error("unable to get landing banner: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
	}
	p.Banner = template.HTML(applyMarkdown([]byte(banner.Content), "", app.cfg))

	content, err := getLandingBody(app)
	if err != nil {
	log.Error("unable to get landing content: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get content: %v", err)}
	}
	p.Content = template.HTML(applyMarkdown([]byte(content.Content), "", app.cfg))

	// Get error messages
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}

	// Show landing page
	return renderPage(w, "landing.tmpl", p)
	}

	func handleTemplatedPage(app App, w http.ResponseWriter, r http.Request, t *template.Template) error {
	p := struct {
	page.StaticPage
	ContentTitle string
	Content template.HTML
	PlainContent string
	Updated string

	AboutStats *InstanceStats
	}{
	StaticPage: pageForReq(app, r),
	}
	if r.URL.Path == "/about" \|\| r.URL.Path == "/contact" \|\| r.URL.Path == "/privacy" {
	var c *instanceContent
	var err error

	if r.URL.Path == "/about" {
	c, err = getAboutPage(app)

	// Fetch stats
	p.AboutStats = &InstanceStats{}
	p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
	p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
	} else if r.URL.Path == "/contact" {
	c, err = getContactPage(app)
	if c.Updated.IsZero() {
	// Page was never set up, so return 404
	return ErrPostNotFound
	}
	} else {
	c, err = getPrivacyPage(app)
	}

	if err != nil {
	return err
	}
	p.ContentTitle = c.Title.String
	p.Content = template.HTML(applyMarkdown([]byte(c.Content), "", app.cfg))
	p.PlainContent = shortPostDescription(stripmd.Strip(c.Content))
	if !c.Updated.IsZero() {
	p.Updated = c.Updated.Format("January 2, 2006")
	}
	}

	// Serve templated page
	err := t.ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return nil
	}

	func pageForReq(app App, r http.Request) page.StaticPage {
	p := page.StaticPage{
	AppCfg: app.cfg.App,
	Path: r.URL.Path,
	Version: "v" + softwareVer,
	}

	// Use custom style, if file exists
	if _, err := os.Stat(filepath.Join(app.cfg.Server.StaticParentDir, staticDir, "local", "custom.css")); err == nil {
	p.CustomCSS = true
	}

	// Add user information, if given
	var u *User
	accessToken := r.FormValue("t")
	if accessToken != "" {
	userID := app.db.GetUserID(accessToken)
	if userID != -1 {
	var err error
	u, err = app.db.GetUserByID(userID)
	if err == nil {
	p.Username = u.Username
	}
	}
	} else {
	u = getUserSession(app, r)
	if u != nil {
	p.Username = u.Username
	p.IsAdmin = u != nil && u.IsAdmin()
	p.CanInvite = canUserInvite(app.cfg, p.IsAdmin)
	}
	}
	p.CanViewReader = !app.cfg.App.Private \|\| u != nil

	return p
	}

	var fileRegex = regexp.MustCompile("/([^/]\\.[^/])$")

	// Initialize loads the app configuration and initializes templates, keys,
	// session, route handlers, and the database connection.
	func Initialize(apper Apper, debug bool) (*App, error) {
	debugging = debug

	apper.LoadConfig()

	// Load templates
	err := InitTemplates(apper.App().Config())
	if err != nil {
	return nil, fmt.Errorf("load templates: %s", err)
	}

	// Load keys and set up session
	initKeyPaths(apper.App()) // TODO: find a better way to do this, since it's unneeded in all Apper implementations
	err = InitKeys(apper)
	if err != nil {
	return nil, fmt.Errorf("init keys: %s", err)
	}
	apper.App().InitUpdates()

	apper.App().InitSession()

	apper.App().InitDecoder()

	err = ConnectToDatabase(apper.App())
	if err != nil {
	return nil, fmt.Errorf("connect to DB: %s", err)
	}

	initActivityPub(apper.App())

	- if apper.App().cfg.Email.Domain != "" \|\| apper.App().cfg.Email.MailgunPrivate != "" {
	- if apper.App().cfg.Email.Domain == "" {
	- log.Error("[FAILED] Starting publish jobs queue: no [letters]domain config value set.")
	- } else if apper.App().cfg.Email.MailgunPrivate == "" {
	- log.Error("[FAILED] Starting publish jobs queue: no [letters]mailgun_private config value set.")
	- } else {
	- log.Info("Starting publish jobs queue...")
	- go startPublishJobsQueue(apper.App())
	- }
	+ if apper.App().cfg.Email.Enabled() {
	+ log.Info("Starting publish jobs queue...")
	+ go startPublishJobsQueue(apper.App())
	+ } else {
	+ log.Error("[FAILED] Starting publish jobs queue: no email provider is configured.")
	}

	// Handle local timeline, if enabled
	if apper.App().cfg.App.LocalTimeline {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}

	return apper.App(), nil
	}

	func Serve(app App, r mux.Router) {
	log.Info("Going to serve...")

	isSingleUser = app.cfg.App.SingleUser
	app.cfg.Server.Dev = debugging

	// Handle shutdown
	c := make(chan os.Signal, 2)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
	go func() {
	<-c
	log.Info("Shutting down...")
	shutdown(app)
	log.Info("Done.")
	os.Exit(0)
	}()

	// Start gopher server
	if app.cfg.Server.GopherPort > 0 && !app.cfg.App.Private {
	go initGopher(app)
	}

	// Start web application server
	var bindAddress = app.cfg.Server.Bind
	if bindAddress == "" {
	bindAddress = "localhost"
	}
	var err error
	if app.cfg.IsSecureStandalone() {
	if app.cfg.Server.Autocert {
	m := &autocert.Manager{
	Prompt: autocert.AcceptTOS,
	Cache: autocert.DirCache(app.cfg.Server.TLSCertPath),
	}
	host, err := url.Parse(app.cfg.App.Host)
	if err != nil {
	log.Error("[WARNING] Unable to parse configured host! %s", err)
	log.Error(`[WARNING] ALL hosts are allowed, which can open you to an attack where
	clients connect to a server by IP address and pretend to be asking for an
	incorrect host name, and cause you to reach the CA's rate limit for certificate
	requests. We recommend supplying a valid host name.`)
	log.Info("Using autocert on ANY host")
	} else {
	log.Info("Using autocert on host %s", host.Host)
	m.HostPolicy = autocert.HostWhitelist(host.Host)
	}
	s := &http.Server{
	Addr: ":https",
	Handler: r,
	TLSConfig: &tls.Config{
	GetCertificate: m.GetCertificate,
	},
	}
	s.SetKeepAlivesEnabled(false)

	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(":80", m.HTTPHandler(nil))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("---")
	err = s.ListenAndServeTLS("", "")
	} else {
	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
	}))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("Using manual certificates")
	log.Info("---")
	err = http.ListenAndServeTLS(fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, r)
	}
	} else {
	network := "tcp"
	protocol := "http"
	if strings.HasPrefix(bindAddress, "/") {
	network = "unix"
	protocol = "http+unix"

	// old sockets will remain after server closes;
	// we need to delete them in order to open new ones
	err = os.Remove(bindAddress)
	if err != nil && !os.IsNotExist(err) {
	log.Error("%s already exists but could not be removed: %v", bindAddress, err)
	os.Exit(1)
	}
	} else {
	bindAddress = fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port)
	}

	log.Info("Serving on %s://%s", protocol, bindAddress)
	log.Info("---")
	listener, err := net.Listen(network, bindAddress)
	if err != nil {
	log.Error("Could not bind to address: %v", err)
	os.Exit(1)
	}

	if network == "unix" {
	err = os.Chmod(bindAddress, 0o666)
	if err != nil {
	log.Error("Could not update socket permissions: %v", err)
	os.Exit(1)
	}
	}

	defer listener.Close()
	err = http.Serve(listener, r)
	}
	if err != nil {
	log.Error("Unable to start: %v", err)
	os.Exit(1)
	}
	}

	func (app *App) InitDecoder() {
	// TODO: do this at the package level, instead of the App level
	// Initialize modules
	app.formDecoder = schema.NewDecoder()
	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)
	}

	// ConnectToDatabase validates and connects to the configured database, then
	// tests the connection.
	func ConnectToDatabase(app *App) error {
	// Check database configuration
	if app.cfg.Database.Type == driverMySQL && app.cfg.Database.User == "" {
	return fmt.Errorf("Database user not set.")
	}
	if app.cfg.Database.Host == "" {
	app.cfg.Database.Host = "localhost"
	}
	if app.cfg.Database.Database == "" {
	app.cfg.Database.Database = "writefreely"
	}

	// TODO: check err
	connectToDatabase(app)

	// Test database connection
	err := app.db.Ping()
	if err != nil {
	return fmt.Errorf("Database ping failed: %s", err)
	}

	return nil
	}

	// FormatVersion constructs the version string for the application
	func FormatVersion() string {
	return serverSoftware + " " + softwareVer
	}

	// OutputVersion prints out the version of the application.
	func OutputVersion() {
	fmt.Println(FormatVersion())
	}

	// NewApp creates a new app instance.
	func NewApp(cfgFile string) *App {
	return &App{
	cfgFile: cfgFile,
	}
	}

	// CreateConfig creates a default configuration and saves it to the app's cfgFile.
	func CreateConfig(app *App) error {
	log.Info("Creating configuration...")
	c := config.New()
	log.Info("Saving configuration %s...", app.cfgFile)
	err := config.Save(c, app.cfgFile)
	if err != nil {
	return fmt.Errorf("Unable to save configuration: %v", err)
	}
	return nil
	}

	// DoConfig runs the interactive configuration process.
	func DoConfig(app *App, configSections string) {
	if configSections == "" {
	configSections = "server db app"
	}
	// let's check there aren't any garbage in the list
	configSectionsArray := strings.Split(configSections, " ")
	for _, element := range configSectionsArray {
	if element != "server" && element != "db" && element != "app" {
	log.Error("Invalid argument to --sections. Valid arguments are only \"server\", \"db\" and \"app\"")
	os.Exit(1)
	}
	}
	d, err := config.Configure(app.cfgFile, configSections)
	if err != nil {
	log.Error("Unable to configure: %v", err)
	os.Exit(1)
	}
	app.cfg = d.Config
	connectToDatabase(app)
	defer shutdown(app)

	if !app.db.DatabaseInitialized() {
	err = adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	} else {
	log.Info("Database already initialized.")
	}

	if d.User != nil {
	u := &User{
	Username: d.User.Username,
	HashedPass: d.User.HashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create blog
	log.Info("Creating user %s...\n", u.Username)
	err = app.db.CreateUser(app.cfg, u, app.cfg.App.SiteName, "")
	if err != nil {
	log.Error("Unable to create user: %s", err)
	os.Exit(1)
	}
	log.Info("Done!")
	}
	os.Exit(0)
	}

	// GenerateKeyFiles creates app encryption keys and saves them into the configured KeysParentDir.
	func GenerateKeyFiles(app *App) error {
	// Read keys path from config
	app.LoadConfig()

	// Create keys dir if it doesn't exist yet
	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
	err = os.Mkdir(fullKeysDir, 0700)
	if err != nil {
	return err
	}
	}

	// Generate keys
	initKeyPaths(app)
	// TODO: use something like https://github.com/hashicorp/go-multierror to return errors
	var keyErrs error
	err := generateKey(emailKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieAuthKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(csrfKeyPath)
	if err != nil {
	keyErrs = err
	}

	return keyErrs
	}

	// CreateSchema creates all database tables needed for the application.
	func CreateSchema(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())
	err := adminInitDatabase(apper.App())
	if err != nil {
	return err
	}
	return nil
	}

	// Migrate runs all necessary database migrations.
	func Migrate(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	err := migrations.Migrate(migrations.NewDatastore(apper.App().db.DB, apper.App().db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}
	return nil
	}

	// ResetPassword runs the interactive password reset process.
	func ResetPassword(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Fetch user
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("Get user: %s", err)
	os.Exit(1)
	}

	// Prompt for new password
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: "New password",
	Mask: '*',
	}
	newPass, err := prompt.Run()
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}

	// Do the update
	log.Info("Updating...")
	err = adminResetPassword(apper.App(), u, newPass)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	// DoDeleteAccount runs the confirmation and account delete process.
	func DoDeleteAccount(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// check user exists
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	userID := u.ID

	// do not delete the admin account
	// TODO: check for other admins and skip?
	if u.IsAdmin() {
	log.Error("Can not delete admin account")
	os.Exit(1)
	}

	// confirm deletion, w/ w/out posts
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: fmt.Sprintf("Really delete user : %s", username),
	IsConfirm: true,
	}
	_, err = prompt.Run()
	if err != nil {
	log.Info("Aborted...")
	os.Exit(0)
	}

	log.Info("Deleting...")
	err = apper.App().db.DeleteAccount(userID)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	func connectToDatabase(app *App) {
	log.Info("Connecting to %s database...", app.cfg.Database.Type)

	var db *sql.DB
	var err error
	if app.cfg.Database.Type == driverMySQL {
	db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s&tls=%t", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String()), app.cfg.Database.TLS))
	db.SetMaxOpenConns(50)
	} else if app.cfg.Database.Type == driverSQLite {
	if !SQLiteEnabled {
	log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if app.cfg.Database.FileName == "" {
	log.Error("SQLite database filename value in config.ini is empty.")
	os.Exit(1)
	}
	db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
	db.SetMaxOpenConns(2)
	} else {
	log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	app.db = &datastore{db, app.cfg.Database.Type}
	}

	func shutdown(app *App) {
	log.Info("Closing database connection...")
	app.db.Close()
	if strings.HasPrefix(app.cfg.Server.Bind, "/") {
	// Clean up socket
	log.Info("Removing socket file...")
	err := os.Remove(app.cfg.Server.Bind)
	if err != nil {
	log.Error("Unable to remove socket: %s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	}
	}

	// CreateUser creates a new admin or normal user from the given credentials.
	func CreateUser(apper Apper, username, password string, isAdmin bool) error {
	// Create an admin user with --create-admin
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Ensure an admin / first user doesn't already exist
	firstUser, _ := apper.App().db.GetUserByID(1)
	if isAdmin {
	// Abort if trying to create admin user, but one already exists
	if firstUser != nil {
	return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely --create-user", firstUser.Username)
	}
	} else {
	// Abort if trying to create regular user, but no admin exists yet
	if firstUser == nil {
	return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely --create-admin")
	}
	}

	// Create the user
	// Normalize and validate username
	desiredUsername := username
	username = getSlug(username, "")

	usernameDesc := username
	if username != desiredUsername {
	usernameDesc += " (originally: " + desiredUsername + ")"
	}

	if !author.IsValidUsername(apper.App().cfg, username) {
	return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, apper.App().cfg.App.MinUsernameLen)
	}

	// Hash the password
	hashedPass, err := auth.HashPass([]byte(password))
	if err != nil {
	return fmt.Errorf("Unable to hash password: %v", err)
	}

	u := &User{
	Username: username,
	HashedPass: hashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	userType := "user"
	if isAdmin {
	userType = "admin"
	}
	log.Info("Creating %s %s...", userType, usernameDesc)
	err = apper.App().db.CreateUser(apper.App().Config(), u, desiredUsername, "")
	if err != nil {
	return fmt.Errorf("Unable to create user: %s", err)
	}
	log.Info("Done!")
	return nil
	}

	//go:embed schema.sql
	var schemaSql string

	//go:embed sqlite.sql
	var sqliteSql string

	func adminInitDatabase(app *App) error {
	var schema string
	if app.cfg.Database.Type == driverSQLite {
	schema = sqliteSql
	} else {
	schema = schemaSql
	}

	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")

	queries := strings.Split(string(schema), ";\n")
	for _, q := range queries {
	if strings.TrimSpace(q) == "" {
	continue
	}
	parts := tblReg.FindStringSubmatch(q)
	if len(parts) >= 3 {
	log.Info("Creating table %s...", parts[2])
	} else {
	log.Info("Creating table ??? (Weird query) No match in: %v", parts)
	}
	_, err := app.db.Exec(q)
	if err != nil {
	log.Error("%s", err)
	} else {
	log.Info("Created.")
	}
	}

	// Set up migrations table
	log.Info("Initializing appmigrations table...")
	err := migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("Unable to set initial migrations: %v", err)
	}

	log.Info("Running migrations...")
	err = migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}

	log.Info("Done.")
	return nil
	}

	// ServerUserAgent returns a User-Agent string to use in external requests. The
	// hostName parameter may be left empty.
	func ServerUserAgent(hostName string) string {
	hostUAStr := ""
	if hostName != "" {
	hostUAStr = "; +" + hostName
	}
	return "Go (" + serverSoftware + "/" + softwareVer + hostUAStr + ")"
	}
	diff --git a/config/config.go b/config/config.go
	index 17d34c8..b725f7d 100644
	--- a/config/config.go
	+++ b/config/config.go
	@@ -1,313 +1,314 @@
	/*
	* Copyright © 2018-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	// Package config holds and assists in the configuration of a writefreely instance.
	package config

	import (
	"net/url"
	"strings"

	"github.com/go-ini/ini"
	"github.com/writeas/web-core/log"
	"golang.org/x/net/idna"
	)

	const (
	// FileName is the default configuration file name
	FileName = "config.ini"

	UserNormal UserType = "user"
	UserAdmin = "admin"
	)

	type (
	UserType string

	// ServerCfg holds values that affect how the HTTP server runs
	ServerCfg struct {
	HiddenHost string `ini:"hidden_host"`
	Port int `ini:"port"`
	Bind string `ini:"bind"`

	TLSCertPath string `ini:"tls_cert_path"`
	TLSKeyPath string `ini:"tls_key_path"`
	Autocert bool `ini:"autocert"`

	TemplatesParentDir string `ini:"templates_parent_dir"`
	StaticParentDir string `ini:"static_parent_dir"`
	PagesParentDir string `ini:"pages_parent_dir"`
	KeysParentDir string `ini:"keys_parent_dir"`

	HashSeed string `ini:"hash_seed"`

	GopherPort int `ini:"gopher_port"`

	Dev bool `ini:"-"`
	}

	// DatabaseCfg holds values that determine how the application connects to a datastore
	DatabaseCfg struct {
	Type string `ini:"type"`
	FileName string `ini:"filename"`
	User string `ini:"username"`
	Password string `ini:"password"`
	Database string `ini:"database"`
	Host string `ini:"host"`
	Port int `ini:"port"`
	TLS bool `ini:"tls"`
	}

	WriteAsOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	AuthLocation string `ini:"auth_location"`
	TokenLocation string `ini:"token_location"`
	InspectLocation string `ini:"inspect_location"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	GitlabOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	Host string `ini:"host"`
	DisplayName string `ini:"display_name"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	GiteaOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	Host string `ini:"host"`
	DisplayName string `ini:"display_name"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	SlackOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	TeamID string `ini:"team_id"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	}

	GenericOauthCfg struct {
	ClientID string `ini:"client_id"`
	ClientSecret string `ini:"client_secret"`
	Host string `ini:"host"`
	DisplayName string `ini:"display_name"`
	CallbackProxy string `ini:"callback_proxy"`
	CallbackProxyAPI string `ini:"callback_proxy_api"`
	TokenEndpoint string `ini:"token_endpoint"`
	InspectEndpoint string `ini:"inspect_endpoint"`
	AuthEndpoint string `ini:"auth_endpoint"`
	Scope string `ini:"scope"`
	AllowDisconnect bool `ini:"allow_disconnect"`
	MapUserID string `ini:"map_user_id"`
	MapUsername string `ini:"map_username"`
	MapDisplayName string `ini:"map_display_name"`
	MapEmail string `ini:"map_email"`
	}

	// AppCfg holds values that affect how the application functions
	AppCfg struct {
	SiteName string `ini:"site_name"`
	SiteDesc string `ini:"site_description"`
	Host string `ini:"host"`

	// Site appearance
	Theme string `ini:"theme"`
	Editor string `ini:"editor"`
	JSDisabled bool `ini:"disable_js"`
	WebFonts bool `ini:"webfonts"`
	Landing string `ini:"landing"`
	SimpleNav bool `ini:"simple_nav"`
	WFModesty bool `ini:"wf_modesty"`

	// Site functionality
	Chorus bool `ini:"chorus"`
	Forest bool `ini:"forest"` // The admin cares about the forest, not the trees. Hide unnecessary technical info.
	DisableDrafts bool `ini:"disable_drafts"`

	// Users
	SingleUser bool `ini:"single_user"`
	OpenRegistration bool `ini:"open_registration"`
	OpenDeletion bool `ini:"open_deletion"`
	MinUsernameLen int `ini:"min_username_len"`
	MaxBlogs int `ini:"max_blogs"`

	// Options for public instances
	// Federation
	Federation bool `ini:"federation"`
	PublicStats bool `ini:"public_stats"`
	Monetization bool `ini:"monetization"`
	NotesOnly bool `ini:"notes_only"`

	// Access
	Private bool `ini:"private"`

	// Additional functions
	LocalTimeline bool `ini:"local_timeline"`
	UserInvites string `ini:"user_invites"`

	// Defaults
	DefaultVisibility string `ini:"default_visibility"`

	// Check for Updates
	UpdateChecks bool `ini:"update_checks"`

	// Disable password authentication if use only Oauth
	DisablePasswordAuth bool `ini:"disable_password_auth"`
	}

	EmailCfg struct {
	// SMTP configuration values
	Host string `ini:"smtp_host"`
	Port int `ini:"smtp_port"`
	Username string `ini:"smtp_username"`
	Password string `ini:"smtp_password"`
	EnableStartTLS bool `ini:"smtp_enable_start_tls"`

	// Mailgun configuration values
	Domain string `ini:"domain"`
	MailgunPrivate string `ini:"mailgun_private"`
	}

	// Config holds the complete configuration for running a writefreely instance
	Config struct {
	Server ServerCfg `ini:"server"`
	Database DatabaseCfg `ini:"database"`
	App AppCfg `ini:"app"`
	Email EmailCfg `ini:"email"`
	SlackOauth SlackOauthCfg `ini:"oauth.slack"`
	WriteAsOauth WriteAsOauthCfg `ini:"oauth.writeas"`
	GitlabOauth GitlabOauthCfg `ini:"oauth.gitlab"`
	GiteaOauth GiteaOauthCfg `ini:"oauth.gitea"`
	GenericOauth GenericOauthCfg `ini:"oauth.generic"`
	}
	)

	// New creates a new Config with sane defaults
	func New() *Config {
	c := &Config{
	Server: ServerCfg{
	Port: 8080,
	Bind: "localhost", /* IPV6 support when not using localhost? */
	},
	App: AppCfg{
	Host: "http://localhost:8080",
	Theme: "write",
	WebFonts: true,
	SingleUser: true,
	MinUsernameLen: 3,
	MaxBlogs: 1,
	Federation: true,
	PublicStats: true,
	},
	}
	c.UseMySQL(true)
	return c
	}

	// UseMySQL resets the Config's Database to use default values for a MySQL setup.
	func (cfg *Config) UseMySQL(fresh bool) {
	cfg.Database.Type = "mysql"
	if fresh {
	cfg.Database.Host = "localhost"
	cfg.Database.Port = 3306
	}
	}

	// UseSQLite resets the Config's Database to use default values for a SQLite setup.
	func (cfg *Config) UseSQLite(fresh bool) {
	cfg.Database.Type = "sqlite3"
	if fresh {
	cfg.Database.FileName = "writefreely.db"
	}
	}

	// IsSecureStandalone returns whether or not the application is running as a
	// standalone server with TLS enabled.
	func (cfg *Config) IsSecureStandalone() bool {
	return cfg.Server.Port == 443 && cfg.Server.TLSCertPath != "" && cfg.Server.TLSKeyPath != ""
	}

	func (ac *AppCfg) LandingPath() string {
	if !strings.HasPrefix(ac.Landing, "/") {
	return "/" + ac.Landing
	}
	return ac.Landing
	}

	func (lc EmailCfg) Enabled() bool {
	- return lc.Domain != "" && lc.MailgunPrivate != ""
	+ return (lc.Domain != "" && lc.MailgunPrivate != "") \|\|
	+ lc.Username != "" && lc.Password != "" && lc.Host != "" && lc.Port > 0
	}

	func (ac AppCfg) SignupPath() string {
	if !ac.OpenRegistration {
	return ""
	}
	if ac.Chorus \|\| ac.Private \|\| (ac.Landing != "" && ac.Landing != "/") {
	return "/signup"
	}
	return "/"
	}

	// Load reads the given configuration file, then parses and returns it as a Config.
	func Load(fname string) (*Config, error) {
	if fname == "" {
	fname = FileName
	}
	cfg, err := ini.Load(fname)
	if err != nil {
	return nil, err
	}

	// Parse INI file
	uc := &Config{}
	err = cfg.MapTo(uc)
	if err != nil {
	return nil, err
	}

	// Do any transformations
	u, err := url.Parse(uc.App.Host)
	if err != nil {
	return nil, err
	}
	d, err := idna.ToASCII(u.Hostname())
	if err != nil {
	log.Error("idna.ToASCII for %s: %s", u.Hostname(), err)
	return nil, err
	}
	uc.App.Host = u.Scheme + "://" + d
	if u.Port() != "" {
	uc.App.Host += ":" + u.Port()
	}

	return uc, nil
	}

	// Save writes the given Config to the given file.
	func Save(uc *Config, fname string) error {
	cfg := ini.Empty()
	err := ini.ReflectFrom(cfg, uc)
	if err != nil {
	return err
	}

	if fname == "" {
	fname = FileName
	}
	return cfg.SaveTo(fname)
	}
	diff --git a/email.go b/email.go
	index a44b253..561af91 100644
	--- a/email.go
	+++ b/email.go
	@@ -1,472 +1,477 @@
	/*
	* Copyright © 2019-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"encoding/json"
	"fmt"
	"github.com/writefreely/writefreely/mailer"
	"html/template"
	"net/http"
	"strings"
	"time"

	"github.com/aymerick/douceur/inliner"
	"github.com/gorilla/mux"
	- "github.com/mailgun/mailgun-go"
	stripmd "github.com/writeas/go-strip-markdown/v2"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/data"
	"github.com/writeas/web-core/log"
	"github.com/writefreely/writefreely/key"
	"github.com/writefreely/writefreely/spam"
	)

	const (
	emailSendDelay = 15
	)

	type (
	SubmittedSubscription struct {
	CollAlias string
	UserID int64

	Email string `schema:"email" json:"email"`
	Web bool `schema:"web" json:"web"`
	Slug string `schema:"slug" json:"slug"`
	From string `schema:"from" json:"from"`
	}

	EmailSubscriber struct {
	ID string
	CollID int64
	UserID sql.NullInt64
	Email sql.NullString
	Subscribed time.Time
	Token string
	Confirmed bool
	AllowExport bool
	acctEmail sql.NullString
	}
	)

	func (es EmailSubscriber) FinalEmail(keys key.Keychain) string {
	if !es.UserID.Valid \|\| es.Email.Valid {
	return es.Email.String
	}

	decEmail, err := data.Decrypt(keys.EmailKey, []byte(es.acctEmail.String))
	if err != nil {
	log.Error("Error decrypting user email: %v", err)
	return ""
	}
	return string(decEmail)
	}

	func (es *EmailSubscriber) SubscribedFriendly() string {
	return es.Subscribed.Format("January 2, 2006")
	}

	func handleCreateEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	reqJSON := IsJSON(r)
	vars := mux.Vars(r)
	var err error

	ss := SubmittedSubscription{
	CollAlias: vars["alias"],
	}
	u := getUserSession(app, r)
	if u != nil {
	ss.UserID = u.ID
	}
	if reqJSON {
	// Decode JSON request
	decoder := json.NewDecoder(r.Body)
	err = decoder.Decode(&ss)
	if err != nil {
	log.Error("Couldn't parse new subscription JSON request: %v\n", err)
	return ErrBadJSON
	}
	} else {
	err = r.ParseForm()
	if err != nil {
	log.Error("Couldn't parse new subscription form request: %v\n", err)
	return ErrBadFormData
	}

	err = app.formDecoder.Decode(&ss, r.PostForm)
	if err != nil {
	log.Error("Continuing, but error decoding new subscription form request: %v\n", err)
	//return ErrBadFormData
	}
	}

	c, err := app.db.GetCollection(ss.CollAlias)
	if err != nil {
	log.Error("getCollection: %s", err)
	return err
	}
	c.hostName = app.cfg.App.Host

	from := c.CanonicalURL()
	isAuthorBanned, err := app.db.IsUserSilenced(c.OwnerID)
	if isAuthorBanned {
	log.Info("Author is silenced, so subscription is blocked.")
	return impart.HTTPError{http.StatusFound, from}
	}

	if ss.Web {
	if u != nil && u.ID == c.OwnerID {
	from = "/" + c.Alias + "/"
	}
	from += ss.Slug
	}

	if r.FormValue(spam.HoneypotFieldName()) != "" \|\| r.FormValue("fake_password") != "" {
	log.Info("Honeypot field was filled out! Not subscribing.")
	return impart.HTTPError{http.StatusFound, from}
	}

	if ss.Email == "" && ss.UserID < 1 {
	log.Info("No subscriber data. Not subscribing.")
	return impart.HTTPError{http.StatusFound, from}
	}

	confirmed := app.db.IsSubscriberConfirmed(ss.Email)
	es, err := app.db.AddEmailSubscription(c.ID, ss.UserID, ss.Email, confirmed)
	if err != nil {
	log.Error("addEmailSubscription: %s", err)
	return err
	}

	// Send confirmation email if needed
	if !confirmed {
	err = sendSubConfirmEmail(app, c, ss.Email, es.ID, es.Token)
	if err != nil {
	log.Error("Failed to send subscription confirmation email: %s", err)
	return err
	}
	}

	if ss.Web {
	session, err := app.sessionStore.Get(r, userEmailCookieName)
	if err != nil {
	// The cookie should still save, even if there's an error.
	// Source: https://github.com/gorilla/sessions/issues/16#issuecomment-143642144
	log.Error("Getting user email cookie: %v; ignoring", err)
	}
	if confirmed {
	addSessionFlash(app, w, r, "<strong>Subscribed</strong>. You'll now receive future blog posts via email.", nil)
	} else {
	addSessionFlash(app, w, r, "Please check your email and <strong>click the confirmation link</strong> to subscribe.", nil)
	}
	session.Values[userEmailCookieVal] = ss.Email
	err = session.Save(r, w)
	if err != nil {
	log.Error("save email cookie: %s", err)
	return err
	}

	return impart.HTTPError{http.StatusFound, from}
	}
	return impart.WriteSuccess(w, "", http.StatusAccepted)
	}

	func handleDeleteEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	alias := collectionAliasFromReq(r)

	vars := mux.Vars(r)
	subID := vars["subscriber"]
	email := r.FormValue("email")
	token := r.FormValue("t")
	slug := r.FormValue("slug")
	isWeb := r.Method == "GET"

	// Display collection if this is a collection
	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	log.Error("Get collection: %s", err)
	return err
	}

	from := c.CanonicalURL()

	if subID != "" {
	// User unsubscribing via email, so assume action is taken by either current
	// user or not current user, and only use the request's information to
	// satisfy this unsubscribe, i.e. subscriberID and token.
	err = app.db.DeleteEmailSubscriber(subID, token)
	} else {
	// User unsubscribing through the web app, so assume action is taken by
	// currently-auth'd user.
	var userID int64
	u := getUserSession(app, r)
	if u != nil {
	// User is logged in
	userID = u.ID
	if userID == c.OwnerID {
	from = "/" + c.Alias + "/"
	}
	}
	if email == "" && userID <= 0 {
	// Get email address from saved cookie
	session, err := app.sessionStore.Get(r, userEmailCookieName)
	if err != nil {
	log.Error("Unable to get email cookie: %s", err)
	} else {
	email = session.Values[userEmailCookieVal].(string)
	}
	}

	if email == "" && userID <= 0 {
	err = fmt.Errorf("No subscriber given.")
	log.Error("Not deleting subscription: %s", err)
	return err
	}

	err = app.db.DeleteEmailSubscriberByUser(email, userID, c.ID)
	}
	if err != nil {
	log.Error("Unable to delete subscriber: %v", err)
	return err
	}

	if isWeb {
	from += slug
	addSessionFlash(app, w, r, "<strong>Unsubscribed</strong>. You will no longer receive these blog posts via email.", nil)
	return impart.HTTPError{http.StatusFound, from}
	}
	return impart.WriteSuccess(w, "", http.StatusAccepted)
	}

	func handleConfirmEmailSubscription(app App, w http.ResponseWriter, r http.Request) error {
	alias := collectionAliasFromReq(r)
	subID := mux.Vars(r)["subscriber"]
	token := r.FormValue("t")

	var c *Collection
	var err error
	if app.cfg.App.SingleUser {
	c, err = app.db.GetCollectionByID(1)
	} else {
	c, err = app.db.GetCollection(alias)
	}
	if err != nil {
	log.Error("Get collection: %s", err)
	return err
	}

	from := c.CanonicalURL()

	err = app.db.UpdateSubscriberConfirmed(subID, token)
	if err != nil {
	addSessionFlash(app, w, r, err.Error(), nil)
	return impart.HTTPError{http.StatusFound, from}
	}

	addSessionFlash(app, w, r, "<strong>Confirmed</strong>! Thanks. Now you'll receive future blog posts via email.", nil)
	return impart.HTTPError{http.StatusFound, from}
	}

	func emailPost(app App, p PublicPost, collID int64) error {
	p.augmentContent()

	// Do some shortcode replacement.
	// Since the user is receiving this email, we can assume they're subscribed via email.
	p.Content = strings.Replace(p.Content, "<!--emailsub-->", `<p id="emailsub">You're subscribed to email updates.</p>`, -1)

	if p.HTMLContent == template.HTML("") {
	p.formatContent(app.cfg, false, false)
	}
	p.augmentReadingDestination()

	title := p.Title.String
	if title != "" {
	title = p.Title.String + "\n\n"
	}
	plainMsg := title + "A new post from " + p.CanonicalURL(app.cfg.App.Host) + "\n\n" + stripmd.Strip(p.Content)
	plainMsg += `

	---------------------------------------------------------------------------------

	Originally published on ` + p.Collection.DisplayTitle() + ` (` + p.Collection.CanonicalURL() + `), a blog you subscribe to.

	Sent to %recipient.to%. Unsubscribe: ` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%`

	- gun := mailgun.NewMailgun(app.cfg.Email.Domain, app.cfg.Email.MailgunPrivate)
	- m := mailgun.NewMessage(p.Collection.DisplayTitle()+" <"+p.Collection.Alias+"@"+app.cfg.Email.Domain+">", stripmd.Strip(p.DisplayTitle()), plainMsg)
	+ mlr, err := mailer.New(app.cfg.Email)
	+ if err != nil {
	+ return err
	+ }
	+ m, err := mlr.NewMessage(p.Collection.DisplayTitle()+" <"+p.Collection.Alias+"@"+app.cfg.Email.Domain+">", stripmd.Strip(p.DisplayTitle()), plainMsg)
	+ if err != nil {
	+ return err
	+ }
	replyTo := app.db.GetCollectionAttribute(collID, collAttrLetterReplyTo)
	if replyTo != "" {
	m.SetReplyTo(replyTo)
	}

	subs, err := app.db.GetEmailSubscribers(collID, true)
	if err != nil {
	log.Error("Unable to get email subscribers: %v", err)
	return err
	}
	if len(subs) == 0 {
	return nil
	}

	if title != "" {
	title = string(`<h2 id="title">` + p.FormattedDisplayTitle() + `</h2>`)
	}
	m.AddTag("New post")

	fontFam := "Lora, Palatino, Baskerville, serif"
	if p.IsSans() {
	fontFam = `"Open Sans", Tahoma, Arial, sans-serif`
	} else if p.IsMonospace() {
	fontFam = `Hack, consolas, Menlo-Regular, Menlo, Monaco, monospace, monospace`
	}

	// TODO: move this to a templated file and LESS-generated stylesheet
	fullHTML := `<html>
	<head>
	<style>
	body {
	font-size: 120%;
	font-family: ` + fontFam + `;
	margin: 1em 2em;
	}
	#article {
	line-height: 1.5;
	margin: 1.5em 0;
	white-space: pre-wrap;
	word-wrap: break-word;
	}
	h1, h2, h3, h4, h5, h6, p, code {
	display: inline
	}
	img, iframe, video {
	max-width: 100%
	}
	#title {
	margin-bottom: 1em;
	display: block;
	}
	.intro {
	font-style: italic;
	font-size: 0.95em;
	}
	div#footer {
	text-align: center;
	max-width: 35em;
	margin: 2em auto;
	}
	div#footer p {
	display: block;
	font-size: 0.86em;
	color: #666;
	}
	hr {
	border: 1px solid #ccc;
	margin: 2em 1em;
	}
	p#emailsub {
	text-align: center;
	display: inline-block !important;
	width: 100%;
	font-style: italic;
	}
	</style>
	</head>
	<body>
	<div id="article">` + title + `<p class="intro">From <a href="` + p.CanonicalURL(app.cfg.App.Host) + `">` + p.DisplayCanonicalURL() + `</a></p>

	` + string(p.HTMLContent) + `</div>
	<hr />
	<div id="footer">
	<p>Originally published on <a href="` + p.Collection.CanonicalURL() + `">` + p.Collection.DisplayTitle() + `</a>, a blog you subscribe to.</p>
	<p>Sent to %recipient.to%. <a href="` + p.Collection.CanonicalURL() + `email/unsubscribe/%recipient.id%?t=%recipient.token%">Unsubscribe</a>.</p>
	</div>
	</body>
	</html>`

	// inline CSS
	html, err := inliner.Inline(fullHTML)
	if err != nil {
	log.Error("Unable to inline email HTML: %v", err)
	return err
	}

	- m.SetHtml(html)
	+ m.SetHTML(html)

	log.Info("[email] Adding %d recipient(s)", len(subs))
	for _, s := range subs {
	e := s.FinalEmail(app.keys)
	log.Info("[email] Adding %s", e)
	err = m.AddRecipientAndVariables(e, map[string]interface{}{
	"id": s.ID,
	"to": e,
	"token": s.Token,
	})
	if err != nil {
	log.Error("Unable to add receipient %s: %s", e, err)
	}
	}

	- res, _, err := gun.Send(m)
	- log.Info("[email] Send result: %s", res)
	+ err = mlr.Send(m)
	+ log.Info("[email] Email sent")
	if err != nil {
	log.Error("Unable to send post email: %v", err)
	return err
	}

	return nil
	}

	func sendSubConfirmEmail(app App, c Collection, email, subID, token string) error {
	if email == "" {
	return fmt.Errorf("You must supply an email to verify.")
	}

	// Send email
	mlr, err := mailer.New(app.cfg.Email)
	if err != nil {
	return err
	}

	plainMsg := "Confirm your subscription to " + c.DisplayTitle() + ` (` + c.CanonicalURL() + `) to start receiving future posts. Simply click the following link (or copy and paste it into your browser):

	` + c.CanonicalURL() + "email/confirm/" + subID + "?t=" + token + `

	If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.`
	m, err := mlr.NewMessage(c.DisplayTitle()+" <"+c.Alias+"@"+app.cfg.Email.Domain+">", "Confirm your subscription to "+c.DisplayTitle(), plainMsg, fmt.Sprintf("<%s>", email))
	if err != nil {
	return err
	}
	m.AddTag("Email Verification")

	m.SetHTML(`<html>
	<body style="font-family:Lora, 'Palatino Linotype', Palatino, Baskerville, 'Book Antiqua', 'New York', 'DejaVu serif', serif; font-size: 100%%; margin:1em 2em;">
	<div style="font-size: 1.2em;">
	<p>Confirm your subscription to <a href="` + c.CanonicalURL() + `">` + c.DisplayTitle() + `</a> to start receiving future posts:</p>
	<p><a href="` + c.CanonicalURL() + `email/confirm/` + subID + `?t=` + token + `">Subscribe to ` + c.DisplayTitle() + `</a></p>
	<p>If you didn't subscribe to this site or you're not sure why you're getting this email, you can delete it. You won't be subscribed or receive any future emails.</p>
	</div>
	</body>
	</html>`)
	err = mlr.Send(m)
	if err != nil {
	return err
	}

	return nil
	}
	diff --git a/mailer/mailer.go b/mailer/mailer.go
	index 1f9f86e..b343132 100644
	--- a/mailer/mailer.go
	+++ b/mailer/mailer.go
	@@ -1,105 +1,124 @@
	/*
	* Copyright © 2024 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package mailer

	import (
	"fmt"
	"github.com/mailgun/mailgun-go"
	"github.com/writefreely/writefreely/config"
	mail "github.com/xhit/go-simple-mail/v2"
	)

	type (
	// Mailer holds configurations for the preferred mailing provider.
	Mailer struct {
	smtp *mail.SMTPServer
	mailGun *mailgun.MailgunImpl
	}

	// Message holds the email contents and metadata for the preferred mailing provider.
	Message struct {
	mgMsg *mailgun.Message
	smtpMsg *mail.Email
	}
	)

	// New creates a new Mailer from the instance's config.EmailCfg, returning an error if not properly configured.
	func New(eCfg config.EmailCfg) (*Mailer, error) {
	m := &Mailer{}
	if eCfg.Domain != "" && eCfg.MailgunPrivate != "" {
	m.mailGun = mailgun.NewMailgun(eCfg.Domain, eCfg.MailgunPrivate)
	} else if eCfg.Username != "" && eCfg.Password != "" && eCfg.Host != "" && eCfg.Port > 0 {
	m.smtp = mail.NewSMTPClient()
	m.smtp.Host = eCfg.Host
	m.smtp.Port = eCfg.Port
	m.smtp.Username = eCfg.Username
	m.smtp.Password = eCfg.Password
	if eCfg.EnableStartTLS {
	m.smtp.Encryption = mail.EncryptionSTARTTLS
	}
	} else {
	return nil, fmt.Errorf("no email provider is configured")
	}

	return m, nil
	}

	// NewMessage creates a new Message from the given parameters.
	func (m Mailer) NewMessage(from, subject, text string, to ...string) (Message, error) {
	msg := &Message{}
	if m.mailGun != nil {
	msg.mgMsg = m.mailGun.NewMessage(from, subject, text, to...)
	} else if m.smtp != nil {
	msg.smtpMsg = mail.NewMSG()
	msg.smtpMsg.SetFrom(from)
	msg.smtpMsg.AddTo(to...)
	msg.smtpMsg.SetSubject(subject)
	msg.smtpMsg.AddAlternative(mail.TextPlain, text)

	if msg.smtpMsg.Error != nil {
	return nil, msg.smtpMsg.Error
	}
	}
	return msg, nil
	}

	// SetHTML sets the body of the message.
	func (m *Message) SetHTML(html string) {
	if m.smtpMsg != nil {
	m.smtpMsg.SetBody(mail.TextHTML, html)
	} else if m.mgMsg != nil {
	m.mgMsg.SetHtml(html)
	}
	}

	+func (m *Message) SetReplyTo(replyTo string) {
	+ if (m.smtpMsg != nil) {
	+ m.smtpMsg.SetReplyTo(replyTo)
	+ } else {
	+ m.mgMsg.SetReplyTo(replyTo)
	+ }
	+}
	+
	// AddTag attaches a tag to the Message for providers that support it.
	func (m *Message) AddTag(tag string) {
	if m.mgMsg != nil {
	m.mgMsg.AddTag(tag)
	}
	}

	+// Variable only used by mailgun
	+func (m *Message) AddRecipientAndVariables(r string, vars map[string]interface{}) error {
	+ if (m.smtpMsg != nil) {
	+ m.smtpMsg.AddBcc(r)
	+ return nil
	+ } else {
	+ return m.mgMsg.AddRecipientAndVariables(r, vars)
	+ }
	+}
	+
	// Send sends the given message via the preferred provider.
	func (m Mailer) Send(msg Message) error {
	if m.smtp != nil {
	client, err := m.smtp.Connect()
	if err != nil {
	return err
	}
	+ // TODO: handle possible limits (new config?) on max recipients (multiple batches, with delay?)
	return msg.smtpMsg.Send(client)
	} else if m.mailGun != nil {
	_, _, err := m.mailGun.Send(msg.mgMsg)
	if err != nil {
	return err
	}
	}
	return nil
	}

File Metadata

Mime Type: text/x-diff
Expires: Fri, Apr 25, 6:20 AM (1 h, 36 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3214980

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions