No OneTemporary
Actions

Size

56 KB

Subscribers

None

View Options

	diff --git a/admin.go b/admin.go
	index 6408cfe..9a3c824 100644
	--- a/admin.go
	+++ b/admin.go
	@@ -1,675 +1,693 @@
	/*
	* Copyright © 2018-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"fmt"
	+ "html/template"
	"net/http"
	"runtime"
	"strconv"
	"strings"
	"time"

	"github.com/gorilla/mux"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/log"
	"github.com/writeas/web-core/passgen"
	"github.com/writefreely/writefreely/appstats"
	"github.com/writefreely/writefreely/config"
	)

	var (
	appStartTime = time.Now()
	sysStatus systemStatus
	)

	const adminUsersPerPage = 30

	type systemStatus struct {
	Uptime string
	NumGoroutine int

	// General statistics.
	MemAllocated string // bytes allocated and still in use
	MemTotal string // bytes allocated (even if freed)
	MemSys string // bytes obtained from system (sum of XxxSys below)
	Lookups uint64 // number of pointer lookups
	MemMallocs uint64 // number of mallocs
	MemFrees uint64 // number of frees

	// Main allocation heap statistics.
	HeapAlloc string // bytes allocated and still in use
	HeapSys string // bytes obtained from system
	HeapIdle string // bytes in idle spans
	HeapInuse string // bytes in non-idle span
	HeapReleased string // bytes released to the OS
	HeapObjects uint64 // total number of allocated objects

	// Low-level fixed-size structure allocator statistics.
	// Inuse is bytes used now.
	// Sys is bytes obtained from system.
	StackInuse string // bootstrap stacks
	StackSys string
	MSpanInuse string // mspan structures
	MSpanSys string
	MCacheInuse string // mcache structures
	MCacheSys string
	BuckHashSys string // profiling bucket hash table
	GCSys string // GC metadata
	OtherSys string // other system allocations

	// Garbage collector statistics.
	NextGC string // next run in HeapAlloc time (bytes)
	LastGC string // last run in absolute time (ns)
	PauseTotalNs string
	PauseNs string // circular buffer of recent GC pause times, most recent at [(NumGC+255)%256]
	NumGC uint32
	}

	type inspectedCollection struct {
	CollectionObj
	Followers int
	LastPost string
	}

	type instanceContent struct {
	ID string
	Type string
	Title sql.NullString
	Content string
	Updated time.Time
	}

	type AdminPage struct {
	UpdateAvailable bool
	}

	func NewAdminPage(app App) AdminPage {
	ap := &AdminPage{}
	if app.updates != nil {
	ap.UpdateAvailable = app.updates.AreAvailableNoCheck()
	}
	return ap
	}

	-func (c instanceContent) UpdatedFriendly() string {
	+func (c instanceContent) UpdatedFriendly() template.HTML {
	/*
	// TODO: accept a locale in this method and use that for the format
	var loc monday.Locale = monday.LocaleEnUS
	return monday.Format(u.Created, monday.DateTimeFormatsByLocale[loc], loc)
	*/
	- return c.Updated.Format("January 2, 2006, 3:04 PM")
	+ if c.Updated.IsZero() {
	+ return "<em>Never</em>"
	+ }
	+ return template.HTML(c.Updated.Format("January 2, 2006, 3:04 PM"))
	}

	func handleViewAdminDash(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	*AdminPage
	Message string

	UsersCount, CollectionsCount, PostsCount int64
	}{
	UserPage: NewUserPage(app, r, u, "Admin", nil),
	AdminPage: NewAdminPage(app),
	Message: r.FormValue("m"),
	}

	// Get user stats
	p.UsersCount = app.db.GetAllUsersCount()
	var err error
	p.CollectionsCount, err = app.db.GetTotalCollections()
	if err != nil {
	return err
	}
	p.PostsCount, err = app.db.GetTotalPosts()
	if err != nil {
	return err
	}

	showUserPage(w, "admin", p)
	return nil
	}

	func handleViewAdminMonitor(app App, u User, w http.ResponseWriter, r *http.Request) error {
	updateAppStats()
	p := struct {
	*UserPage
	*AdminPage
	SysStatus systemStatus
	Config config.AppCfg

	Message, ConfigMessage string
	}{
	UserPage: NewUserPage(app, r, u, "Admin", nil),
	AdminPage: NewAdminPage(app),
	SysStatus: sysStatus,
	Config: app.cfg.App,

	Message: r.FormValue("m"),
	ConfigMessage: r.FormValue("cm"),
	}

	showUserPage(w, "monitor", p)
	return nil
	}

	func handleViewAdminSettings(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	*AdminPage
	Config config.AppCfg

	Message, ConfigMessage string
	}{
	UserPage: NewUserPage(app, r, u, "Admin", nil),
	AdminPage: NewAdminPage(app),
	Config: app.cfg.App,

	Message: r.FormValue("m"),
	ConfigMessage: r.FormValue("cm"),
	}

	showUserPage(w, "app-settings", p)
	return nil
	}

	func handleViewAdminUsers(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	*AdminPage
	Config config.AppCfg
	Message string
	Flashes []string

	Users *[]User
	CurPage int
	TotalUsers int64
	TotalPages []int
	}{
	UserPage: NewUserPage(app, r, u, "Users", nil),
	AdminPage: NewAdminPage(app),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	p.Flashes, _ = getSessionFlashes(app, w, r, nil)
	p.TotalUsers = app.db.GetAllUsersCount()
	ttlPages := p.TotalUsers / adminUsersPerPage
	p.TotalPages = []int{}
	for i := 1; i <= int(ttlPages); i++ {
	p.TotalPages = append(p.TotalPages, i)
	}

	var err error
	p.CurPage, err = strconv.Atoi(r.FormValue("p"))
	if err != nil \|\| p.CurPage < 1 {
	p.CurPage = 1
	} else if p.CurPage > int(ttlPages) {
	p.CurPage = int(ttlPages)
	}

	p.Users, err = app.db.GetAllUsers(uint(p.CurPage))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get users: %v", err)}
	}

	showUserPage(w, "users", p)
	return nil
	}

	func handleViewAdminUser(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	p := struct {
	*UserPage
	*AdminPage
	Config config.AppCfg
	Message string

	User *User
	Colls []inspectedCollection
	LastPost string
	NewPassword string
	TotalPosts int64
	ClearEmail string
	}{
	AdminPage: NewAdminPage(app),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	Colls: []inspectedCollection{},
	}

	var err error
	p.User, err = app.db.GetUserForAuth(username)
	if err != nil {
	if err == ErrUserNotFound {
	return err
	}
	log.Error("Could not get user: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, err.Error()}
	}

	flashes, _ := getSessionFlashes(app, w, r, nil)
	for _, flash := range flashes {
	if strings.HasPrefix(flash, "SUCCESS: ") {
	p.NewPassword = strings.TrimPrefix(flash, "SUCCESS: ")
	p.ClearEmail = p.User.EmailClear(app.keys)
	}
	}
	p.UserPage = NewUserPage(app, r, u, p.User.Username, nil)
	p.TotalPosts = app.db.GetUserPostsCount(p.User.ID)
	lp, err := app.db.GetUserLastPostTime(p.User.ID)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's last post time: %v", err)}
	}
	if lp != nil {
	p.LastPost = lp.Format("January 2, 2006, 3:04 PM")
	}

	colls, err := app.db.GetCollections(p.User, app.cfg.App.Host)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user's collections: %v", err)}
	}
	for _, c := range *colls {
	ic := inspectedCollection{
	CollectionObj: CollectionObj{Collection: c},
	}

	if app.cfg.App.Federation {
	folls, err := app.db.GetAPFollowers(&c)
	if err == nil {
	// TODO: handle error here (at least log it)
	ic.Followers = len(*folls)
	}
	}

	app.db.GetPostsCount(&ic.CollectionObj, true)

	lp, err := app.db.GetCollectionLastPostTime(c.ID)
	if err != nil {
	log.Error("Didn't get last post time for collection %d: %v", c.ID, err)
	}
	if lp != nil {
	ic.LastPost = lp.Format("January 2, 2006, 3:04 PM")
	}

	p.Colls = append(p.Colls, ic)
	}

	showUserPage(w, "view-user", p)
	return nil
	}

	func handleAdminDeleteUser(app App, u User, w http.ResponseWriter, r *http.Request) error {
	if !u.IsAdmin() {
	return impart.HTTPError{http.StatusForbidden, "Administrator privileges required for this action"}
	}

	vars := mux.Vars(r)
	username := vars["username"]
	confirmUsername := r.PostFormValue("confirm-username")

	if confirmUsername != username {
	return impart.HTTPError{http.StatusBadRequest, "Username was not confirmed"}
	}

	user, err := app.db.GetUserForAuth(username)
	if err == ErrUserNotFound {
	return impart.HTTPError{http.StatusNotFound, fmt.Sprintf("User '%s' was not found", username)}
	} else if err != nil {
	log.Error("get user for deletion: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user with username '%s': %v", username, err)}
	}

	err = app.db.DeleteAccount(user.ID)
	if err != nil {
	log.Error("delete user %s: %v", user.Username, err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not delete user account for '%s': %v", username, err)}
	}

	_ = addSessionFlash(app, w, r, fmt.Sprintf("User \"%s\" was deleted successfully.", username), nil)
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	func handleAdminToggleUserStatus(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	user, err := app.db.GetUserForAuth(username)
	if err != nil {
	log.Error("failed to get user: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get user from username: %v", err)}
	}
	if user.IsSilenced() {
	err = app.db.SetUserStatus(user.ID, UserActive)
	} else {
	err = app.db.SetUserStatus(user.ID, UserSilenced)

	// reset the cache to removed silence user posts
	updateTimelineCache(app.timeline, true)
	}
	if err != nil {
	log.Error("toggle user silenced: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not toggle user status: %v", err)}
	}
	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s#status", username)}
	}

	func handleAdminResetUserPass(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	username := vars["username"]
	if username == "" {
	return impart.HTTPError{http.StatusFound, "/admin/users"}
	}

	// Generate new random password since none supplied
	pass := passgen.NewWordish()
	hashedPass, err := auth.HashPass([]byte(pass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
	}

	userIDVal := r.FormValue("user")
	log.Info("ADMIN: Changing user %s password", userIDVal)
	id, err := strconv.Atoi(userIDVal)
	if err != nil {
	return impart.HTTPError{http.StatusBadRequest, fmt.Sprintf("Invalid user ID: %v", err)}
	}

	err = app.db.ChangePassphrase(int64(id), true, "", hashedPass)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
	}
	log.Info("ADMIN: Successfully changed.")

	addSessionFlash(app, w, r, fmt.Sprintf("SUCCESS: %s", pass), nil)

	return impart.HTTPError{http.StatusFound, fmt.Sprintf("/admin/user/%s", username)}
	}

	func handleViewAdminPages(app App, u User, w http.ResponseWriter, r *http.Request) error {
	p := struct {
	*UserPage
	*AdminPage
	Config config.AppCfg
	Message string

	Pages []*instanceContent
	}{
	UserPage: NewUserPage(app, r, u, "Pages", nil),
	AdminPage: NewAdminPage(app),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	var err error
	p.Pages, err = app.db.GetInstancePages()
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get pages: %v", err)}
	}

	// Add in default pages
	- var hasAbout, hasPrivacy bool
	+ var hasAbout, hasContact, hasPrivacy bool
	for i, c := range p.Pages {
	- if hasAbout && hasPrivacy {
	+ if hasAbout && hasContact && hasPrivacy {
	break
	}
	if c.ID == "about" {
	hasAbout = true
	if !c.Title.Valid {
	p.Pages[i].Title = defaultAboutTitle(app.cfg)
	}
	+ } else if c.ID == "contact" {
	+ hasContact = true
	+ if !c.Title.Valid {
	+ p.Pages[i].Title = defaultContactTitle()
	+ }
	} else if c.ID == "privacy" {
	hasPrivacy = true
	if !c.Title.Valid {
	p.Pages[i].Title = defaultPrivacyTitle()
	}
	}
	}
	if !hasAbout {
	p.Pages = append(p.Pages, &instanceContent{
	ID: "about",
	Title: defaultAboutTitle(app.cfg),
	Content: defaultAboutPage(app.cfg),
	Updated: defaultPageUpdatedTime,
	})
	}
	+ if !hasAbout {
	+ p.Pages = append(p.Pages, &instanceContent{
	+ ID: "contact",
	+ Title: defaultContactTitle(),
	+ Content: defaultContactPage(app),
	+ })
	+ }
	if !hasPrivacy {
	p.Pages = append(p.Pages, &instanceContent{
	ID: "privacy",
	Title: defaultPrivacyTitle(),
	Content: defaultPrivacyPolicy(app.cfg),
	Updated: defaultPageUpdatedTime,
	})
	}

	showUserPage(w, "pages", p)
	return nil
	}

	func handleViewAdminPage(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	slug := vars["slug"]
	if slug == "" {
	return impart.HTTPError{http.StatusFound, "/admin/pages"}
	}

	p := struct {
	*UserPage
	*AdminPage
	Config config.AppCfg
	Message string

	Banner *instanceContent
	Content *instanceContent
	}{
	AdminPage: NewAdminPage(app),
	Config: app.cfg.App,
	Message: r.FormValue("m"),
	}

	var err error
	// Get pre-defined pages, or select slug
	if slug == "about" {
	p.Content, err = getAboutPage(app)
	+ } else if slug == "contact" {
	+ p.Content, err = getContactPage(app)
	} else if slug == "privacy" {
	p.Content, err = getPrivacyPage(app)
	} else if slug == "landing" {
	p.Banner, err = getLandingBanner(app)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
	}
	p.Content, err = getLandingBody(app)
	p.Content.ID = "landing"
	} else if slug == "reader" {
	p.Content, err = getReaderSection(app)
	} else {
	p.Content, err = app.db.GetDynamicContent(slug)
	}
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get page: %v", err)}
	}
	title := "New page"
	if p.Content != nil {
	title = "Edit " + p.Content.ID
	} else {
	p.Content = &instanceContent{}
	}
	p.UserPage = NewUserPage(app, r, u, title, nil)

	showUserPage(w, "view-page", p)
	return nil
	}

	func handleAdminUpdateSite(app App, u User, w http.ResponseWriter, r *http.Request) error {
	vars := mux.Vars(r)
	id := vars["page"]

	// Validate
	- if id != "about" && id != "privacy" && id != "landing" && id != "reader" {
	+ if id != "about" && id != "contact" && id != "privacy" && id != "landing" && id != "reader" {
	return impart.HTTPError{http.StatusNotFound, "No such page."}
	}

	var err error
	m := ""
	if id == "landing" {
	// Handle special landing page
	err = app.db.UpdateDynamicContent("landing-banner", "", r.FormValue("banner"), "section")
	if err != nil {
	m = "?m=" + err.Error()
	return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
	}
	err = app.db.UpdateDynamicContent("landing-body", "", r.FormValue("content"), "section")
	} else if id == "reader" {
	// Update sections with titles
	err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "section")
	} else {
	// Update page
	err = app.db.UpdateDynamicContent(id, r.FormValue("title"), r.FormValue("content"), "page")
	}
	if err != nil {
	m = "?m=" + err.Error()
	}
	return impart.HTTPError{http.StatusFound, "/admin/page/" + id + m}
	}

	func handleAdminUpdateConfig(apper Apper, u User, w http.ResponseWriter, r http.Request) error {
	apper.App().cfg.App.SiteName = r.FormValue("site_name")
	apper.App().cfg.App.SiteDesc = r.FormValue("site_desc")
	apper.App().cfg.App.Landing = r.FormValue("landing")
	apper.App().cfg.App.OpenRegistration = r.FormValue("open_registration") == "on"
	apper.App().cfg.App.OpenDeletion = r.FormValue("open_deletion") == "on"
	mul, err := strconv.Atoi(r.FormValue("min_username_len"))
	if err == nil {
	apper.App().cfg.App.MinUsernameLen = mul
	}
	mb, err := strconv.Atoi(r.FormValue("max_blogs"))
	if err == nil {
	apper.App().cfg.App.MaxBlogs = mb
	}
	apper.App().cfg.App.Federation = r.FormValue("federation") == "on"
	apper.App().cfg.App.PublicStats = r.FormValue("public_stats") == "on"
	apper.App().cfg.App.Monetization = r.FormValue("monetization") == "on"
	apper.App().cfg.App.Private = r.FormValue("private") == "on"
	apper.App().cfg.App.LocalTimeline = r.FormValue("local_timeline") == "on"
	if apper.App().cfg.App.LocalTimeline && apper.App().timeline == nil {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}
	apper.App().cfg.App.UserInvites = r.FormValue("user_invites")
	if apper.App().cfg.App.UserInvites == "none" {
	apper.App().cfg.App.UserInvites = ""
	}
	apper.App().cfg.App.DefaultVisibility = r.FormValue("default_visibility")

	m := "?cm=Configuration+saved."
	err = apper.SaveConfig(apper.App().cfg)
	if err != nil {
	m = "?cm=" + err.Error()
	}
	return impart.HTTPError{http.StatusFound, "/admin/settings" + m + "#config"}
	}

	func updateAppStats() {
	sysStatus.Uptime = appstats.TimeSincePro(appStartTime)

	m := new(runtime.MemStats)
	runtime.ReadMemStats(m)
	sysStatus.NumGoroutine = runtime.NumGoroutine()

	sysStatus.MemAllocated = appstats.FileSize(int64(m.Alloc))
	sysStatus.MemTotal = appstats.FileSize(int64(m.TotalAlloc))
	sysStatus.MemSys = appstats.FileSize(int64(m.Sys))
	sysStatus.Lookups = m.Lookups
	sysStatus.MemMallocs = m.Mallocs
	sysStatus.MemFrees = m.Frees

	sysStatus.HeapAlloc = appstats.FileSize(int64(m.HeapAlloc))
	sysStatus.HeapSys = appstats.FileSize(int64(m.HeapSys))
	sysStatus.HeapIdle = appstats.FileSize(int64(m.HeapIdle))
	sysStatus.HeapInuse = appstats.FileSize(int64(m.HeapInuse))
	sysStatus.HeapReleased = appstats.FileSize(int64(m.HeapReleased))
	sysStatus.HeapObjects = m.HeapObjects

	sysStatus.StackInuse = appstats.FileSize(int64(m.StackInuse))
	sysStatus.StackSys = appstats.FileSize(int64(m.StackSys))
	sysStatus.MSpanInuse = appstats.FileSize(int64(m.MSpanInuse))
	sysStatus.MSpanSys = appstats.FileSize(int64(m.MSpanSys))
	sysStatus.MCacheInuse = appstats.FileSize(int64(m.MCacheInuse))
	sysStatus.MCacheSys = appstats.FileSize(int64(m.MCacheSys))
	sysStatus.BuckHashSys = appstats.FileSize(int64(m.BuckHashSys))
	sysStatus.GCSys = appstats.FileSize(int64(m.GCSys))
	sysStatus.OtherSys = appstats.FileSize(int64(m.OtherSys))

	sysStatus.NextGC = appstats.FileSize(int64(m.NextGC))
	sysStatus.LastGC = fmt.Sprintf("%.1fs", float64(time.Now().UnixNano()-int64(m.LastGC))/1000/1000/1000)
	sysStatus.PauseTotalNs = fmt.Sprintf("%.1fs", float64(m.PauseTotalNs)/1000/1000/1000)
	sysStatus.PauseNs = fmt.Sprintf("%.3fs", float64(m.PauseNs[(m.NumGC+255)%256])/1000/1000/1000)
	sysStatus.NumGC = m.NumGC
	}

	func adminResetPassword(app App, u User, newPass string) error {
	hashedPass, err := auth.HashPass([]byte(newPass))
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not create password hash: %v", err)}
	}

	err = app.db.ChangePassphrase(u.ID, true, "", hashedPass)
	if err != nil {
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not update passphrase: %v", err)}
	}
	return nil
	}

	func handleViewAdminUpdates(app App, u User, w http.ResponseWriter, r *http.Request) error {
	check := r.URL.Query().Get("check")

	if check == "now" && app.cfg.App.UpdateChecks {
	app.updates.CheckNow()
	}

	p := struct {
	*UserPage
	*AdminPage
	CurReleaseNotesURL string
	LastChecked string
	LastChecked8601 string
	LatestVersion string
	LatestReleaseURL string
	LatestReleaseNotesURL string
	CheckFailed bool
	}{
	UserPage: NewUserPage(app, r, u, "Updates", nil),
	AdminPage: NewAdminPage(app),
	}
	p.CurReleaseNotesURL = wfReleaseNotesURL(p.Version)
	if app.cfg.App.UpdateChecks {
	p.LastChecked = app.updates.lastCheck.Format("January 2, 2006, 3:04 PM")
	p.LastChecked8601 = app.updates.lastCheck.Format("2006-01-02T15:04:05Z")
	p.LatestVersion = app.updates.LatestVersion()
	p.LatestReleaseURL = app.updates.ReleaseURL()
	p.LatestReleaseNotesURL = app.updates.ReleaseNotesURL()
	p.UpdateAvailable = app.updates.AreAvailable()
	p.CheckFailed = app.updates.checkError != nil
	}

	showUserPage(w, "app-updates", p)
	return nil
	}
	diff --git a/app.go b/app.go
	index bf15b9e..efdd9df 100644
	--- a/app.go
	+++ b/app.go
	@@ -1,987 +1,993 @@
	/*
	* Copyright © 2018-2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"crypto/tls"
	"database/sql"
	_ "embed"
	"fmt"
	"html/template"
	"io/ioutil"
	"net"
	"net/http"
	"net/url"
	"os"
	"os/signal"
	"path/filepath"
	"regexp"
	"strings"
	"syscall"
	"time"

	"github.com/gorilla/mux"
	"github.com/gorilla/schema"
	"github.com/gorilla/sessions"
	"github.com/manifoldco/promptui"
	stripmd "github.com/writeas/go-strip-markdown/v2"
	"github.com/writeas/impart"
	"github.com/writeas/web-core/auth"
	"github.com/writeas/web-core/converter"
	"github.com/writeas/web-core/log"
	"golang.org/x/crypto/acme/autocert"

	"github.com/writefreely/writefreely/author"
	"github.com/writefreely/writefreely/config"
	"github.com/writefreely/writefreely/key"
	"github.com/writefreely/writefreely/migrations"
	"github.com/writefreely/writefreely/page"
	)

	const (
	staticDir = "static"
	assumedTitleLen = 80
	postsPerPage = 10

	serverSoftware = "WriteFreely"
	softwareURL = "https://writefreely.org"
	)

	var (
	debugging bool

	// Software version can be set from git env using -ldflags
	softwareVer = "0.13.2"

	// DEPRECATED VARS
	isSingleUser bool
	)

	// App holds data and configuration for an individual WriteFreely instance.
	type App struct {
	router *mux.Router
	shttp *http.ServeMux
	db *datastore
	cfg *config.Config
	cfgFile string
	keys *key.Keychain
	sessionStore sessions.Store
	formDecoder *schema.Decoder
	updates *updatesCache

	timeline *localTimeline
	}

	// DB returns the App's datastore
	func (app App) DB() datastore {
	return app.db
	}

	// Router returns the App's router
	func (app App) Router() mux.Router {
	return app.router
	}

	// Config returns the App's current configuration.
	func (app App) Config() config.Config {
	return app.cfg
	}

	// SetConfig updates the App's Config to the given value.
	func (app App) SetConfig(cfg config.Config) {
	app.cfg = cfg
	}

	// SetKeys updates the App's Keychain to the given value.
	func (app App) SetKeys(k key.Keychain) {
	app.keys = k
	}

	func (app *App) SessionStore() sessions.Store {
	return app.sessionStore
	}

	func (app *App) SetSessionStore(s sessions.Store) {
	app.sessionStore = s
	}

	// Apper is the interface for getting data into and out of a WriteFreely
	// instance (or "App").
	//
	// App returns the App for the current instance.
	//
	// LoadConfig reads an app configuration into the App, returning any error
	// encountered.
	//
	// SaveConfig persists the current App configuration.
	//
	// LoadKeys reads the App's encryption keys and loads them into its
	// key.Keychain.
	type Apper interface {
	App() *App

	LoadConfig() error
	SaveConfig(*config.Config) error

	LoadKeys() error

	ReqLog(r *http.Request, status int, timeSince time.Duration) string
	}

	// App returns the App
	func (app App) App() App {
	return app
	}

	// LoadConfig loads and parses a config file.
	func (app *App) LoadConfig() error {
	log.Info("Loading %s configuration...", app.cfgFile)
	cfg, err := config.Load(app.cfgFile)
	if err != nil {
	log.Error("Unable to load configuration: %v", err)
	os.Exit(1)
	return err
	}
	app.cfg = cfg
	return nil
	}

	// SaveConfig saves the given Config to disk -- namely, to the App's cfgFile.
	func (app App) SaveConfig(c config.Config) error {
	return config.Save(c, app.cfgFile)
	}

	// LoadKeys reads all needed keys from disk into the App. In order to use the
	// configured `Server.KeysParentDir`, you must call initKeyPaths(App) before
	// this.
	func (app *App) LoadKeys() error {
	var err error
	app.keys = &key.Keychain{}

	if debugging {
	log.Info(" %s", emailKeyPath)
	}

	executable, err := os.Executable()
	if err != nil {
	executable = "writefreely"
	} else {
	executable = filepath.Base(executable)
	}

	app.keys.EmailKey, err = ioutil.ReadFile(emailKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieAuthKeyPath)
	}
	app.keys.CookieAuthKey, err = ioutil.ReadFile(cookieAuthKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", cookieKeyPath)
	}
	app.keys.CookieKey, err = ioutil.ReadFile(cookieKeyPath)
	if err != nil {
	return err
	}

	if debugging {
	log.Info(" %s", csrfKeyPath)
	}
	app.keys.CSRFKey, err = ioutil.ReadFile(csrfKeyPath)
	if err != nil {
	if os.IsNotExist(err) {
	log.Error(`Missing key: %s.

	Run this command to generate missing keys:
	%s keys generate

	`, csrfKeyPath, executable)
	}
	return err
	}

	return nil
	}

	func (app App) ReqLog(r http.Request, status int, timeSince time.Duration) string {
	return fmt.Sprintf("\"%s %s\" %d %s \"%s\"", r.Method, r.RequestURI, status, timeSince, r.UserAgent())
	}

	// handleViewHome shows page at root path. It checks the configuration and
	// authentication state to show the correct page.
	func handleViewHome(app App, w http.ResponseWriter, r http.Request) error {
	if app.cfg.App.SingleUser {
	// Render blog index
	return handleViewCollection(app, w, r)
	}

	// Multi-user instance
	forceLanding := r.FormValue("landing") == "1"
	if !forceLanding {
	// Show correct page based on user auth status and configured landing path
	u := getUserSession(app, r)

	if app.cfg.App.Chorus {
	// This instance is focused on reading, so show Reader on home route if not
	// private or a private-instance user is logged in.
	if !app.cfg.App.Private \|\| u != nil {
	return viewLocalTimeline(app, w, r)
	}
	}

	if u != nil {
	// User is logged in, so show the Pad
	return handleViewPad(app, w, r)
	}

	if app.cfg.App.Private {
	return viewLogin(app, w, r)
	}

	if land := app.cfg.App.LandingPath(); land != "/" {
	return impart.HTTPError{http.StatusFound, land}
	}
	}

	return handleViewLanding(app, w, r)
	}

	func handleViewLanding(app App, w http.ResponseWriter, r http.Request) error {
	forceLanding := r.FormValue("landing") == "1"

	p := struct {
	page.StaticPage
	*OAuthButtons
	Flashes []template.HTML
	Banner template.HTML
	Content template.HTML

	ForcedLanding bool
	}{
	StaticPage: pageForReq(app, r),
	OAuthButtons: NewOAuthButtons(app.Config()),
	ForcedLanding: forceLanding,
	}

	banner, err := getLandingBanner(app)
	if err != nil {
	log.Error("unable to get landing banner: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get banner: %v", err)}
	}
	p.Banner = template.HTML(applyMarkdown([]byte(banner.Content), "", app.cfg))

	content, err := getLandingBody(app)
	if err != nil {
	log.Error("unable to get landing content: %v", err)
	return impart.HTTPError{http.StatusInternalServerError, fmt.Sprintf("Could not get content: %v", err)}
	}
	p.Content = template.HTML(applyMarkdown([]byte(content.Content), "", app.cfg))

	// Get error messages
	session, err := app.sessionStore.Get(r, cookieName)
	if err != nil {
	// Ignore this
	log.Error("Unable to get session in handleViewHome; ignoring: %v", err)
	}
	flashes, _ := getSessionFlashes(app, w, r, session)
	for _, flash := range flashes {
	p.Flashes = append(p.Flashes, template.HTML(flash))
	}

	// Show landing page
	return renderPage(w, "landing.tmpl", p)
	}

	func handleTemplatedPage(app App, w http.ResponseWriter, r http.Request, t *template.Template) error {
	p := struct {
	page.StaticPage
	ContentTitle string
	Content template.HTML
	PlainContent string
	Updated string

	AboutStats *InstanceStats
	}{
	StaticPage: pageForReq(app, r),
	}
	- if r.URL.Path == "/about" \|\| r.URL.Path == "/privacy" {
	+ if r.URL.Path == "/about" \|\| r.URL.Path == "/contact" \|\| r.URL.Path == "/privacy" {
	var c *instanceContent
	var err error

	if r.URL.Path == "/about" {
	c, err = getAboutPage(app)

	// Fetch stats
	p.AboutStats = &InstanceStats{}
	p.AboutStats.NumPosts, _ = app.db.GetTotalPosts()
	p.AboutStats.NumBlogs, _ = app.db.GetTotalCollections()
	+ } else if r.URL.Path == "/contact" {
	+ c, err = getContactPage(app)
	+ if c.Updated.IsZero() {
	+ // Page was never set up, so return 404
	+ return ErrPostNotFound
	+ }
	} else {
	c, err = getPrivacyPage(app)
	}

	if err != nil {
	return err
	}
	p.ContentTitle = c.Title.String
	p.Content = template.HTML(applyMarkdown([]byte(c.Content), "", app.cfg))
	p.PlainContent = shortPostDescription(stripmd.Strip(c.Content))
	if !c.Updated.IsZero() {
	p.Updated = c.Updated.Format("January 2, 2006")
	}
	}

	// Serve templated page
	err := t.ExecuteTemplate(w, "base", p)
	if err != nil {
	log.Error("Unable to render page: %v", err)
	}
	return nil
	}

	func pageForReq(app App, r http.Request) page.StaticPage {
	p := page.StaticPage{
	AppCfg: app.cfg.App,
	Path: r.URL.Path,
	Version: "v" + softwareVer,
	}

	// Use custom style, if file exists
	if _, err := os.Stat(filepath.Join(staticDir, "local", "custom.css")); err == nil {
	p.CustomCSS = true
	}

	// Add user information, if given
	var u *User
	accessToken := r.FormValue("t")
	if accessToken != "" {
	userID := app.db.GetUserID(accessToken)
	if userID != -1 {
	var err error
	u, err = app.db.GetUserByID(userID)
	if err == nil {
	p.Username = u.Username
	}
	}
	} else {
	u = getUserSession(app, r)
	if u != nil {
	p.Username = u.Username
	p.IsAdmin = u != nil && u.IsAdmin()
	p.CanInvite = canUserInvite(app.cfg, p.IsAdmin)
	}
	}
	p.CanViewReader = !app.cfg.App.Private \|\| u != nil

	return p
	}

	var fileRegex = regexp.MustCompile("/([^/]\\.[^/])$")

	// Initialize loads the app configuration and initializes templates, keys,
	// session, route handlers, and the database connection.
	func Initialize(apper Apper, debug bool) (*App, error) {
	debugging = debug

	apper.LoadConfig()

	// Load templates
	err := InitTemplates(apper.App().Config())
	if err != nil {
	return nil, fmt.Errorf("load templates: %s", err)
	}

	// Load keys and set up session
	initKeyPaths(apper.App()) // TODO: find a better way to do this, since it's unneeded in all Apper implementations
	err = InitKeys(apper)
	if err != nil {
	return nil, fmt.Errorf("init keys: %s", err)
	}
	apper.App().InitUpdates()

	apper.App().InitSession()

	apper.App().InitDecoder()

	err = ConnectToDatabase(apper.App())
	if err != nil {
	return nil, fmt.Errorf("connect to DB: %s", err)
	}

	initActivityPub(apper.App())

	// Handle local timeline, if enabled
	if apper.App().cfg.App.LocalTimeline {
	log.Info("Initializing local timeline...")
	initLocalTimeline(apper.App())
	}

	return apper.App(), nil
	}

	func Serve(app App, r mux.Router) {
	log.Info("Going to serve...")

	isSingleUser = app.cfg.App.SingleUser
	app.cfg.Server.Dev = debugging

	// Handle shutdown
	c := make(chan os.Signal, 2)
	signal.Notify(c, os.Interrupt, syscall.SIGTERM)
	go func() {
	<-c
	log.Info("Shutting down...")
	shutdown(app)
	log.Info("Done.")
	os.Exit(0)
	}()

	// Start gopher server
	if app.cfg.Server.GopherPort > 0 && !app.cfg.App.Private {
	go initGopher(app)
	}

	// Start web application server
	var bindAddress = app.cfg.Server.Bind
	if bindAddress == "" {
	bindAddress = "localhost"
	}
	var err error
	if app.cfg.IsSecureStandalone() {
	if app.cfg.Server.Autocert {
	m := &autocert.Manager{
	Prompt: autocert.AcceptTOS,
	Cache: autocert.DirCache(app.cfg.Server.TLSCertPath),
	}
	host, err := url.Parse(app.cfg.App.Host)
	if err != nil {
	log.Error("[WARNING] Unable to parse configured host! %s", err)
	log.Error(`[WARNING] ALL hosts are allowed, which can open you to an attack where
	clients connect to a server by IP address and pretend to be asking for an
	incorrect host name, and cause you to reach the CA's rate limit for certificate
	requests. We recommend supplying a valid host name.`)
	log.Info("Using autocert on ANY host")
	} else {
	log.Info("Using autocert on host %s", host.Host)
	m.HostPolicy = autocert.HostWhitelist(host.Host)
	}
	s := &http.Server{
	Addr: ":https",
	Handler: r,
	TLSConfig: &tls.Config{
	GetCertificate: m.GetCertificate,
	},
	}
	s.SetKeepAlivesEnabled(false)

	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(":80", m.HTTPHandler(nil))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("---")
	err = s.ListenAndServeTLS("", "")
	} else {
	go func() {
	log.Info("Serving redirects on http://%s:80", bindAddress)
	err = http.ListenAndServe(fmt.Sprintf("%s:80", bindAddress), http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
	http.Redirect(w, r, app.cfg.App.Host, http.StatusMovedPermanently)
	}))
	log.Error("Unable to start redirect server: %v", err)
	}()

	log.Info("Serving on https://%s:443", bindAddress)
	log.Info("Using manual certificates")
	log.Info("---")
	err = http.ListenAndServeTLS(fmt.Sprintf("%s:443", bindAddress), app.cfg.Server.TLSCertPath, app.cfg.Server.TLSKeyPath, r)
	}
	} else {
	network := "tcp"
	protocol := "http"
	if strings.HasPrefix(bindAddress, "/") {
	network = "unix"
	protocol = "http+unix"

	// old sockets will remain after server closes;
	// we need to delete them in order to open new ones
	err = os.Remove(bindAddress)
	if err != nil && !os.IsNotExist(err) {
	log.Error("%s already exists but could not be removed: %v", bindAddress, err)
	os.Exit(1)
	}
	} else {
	bindAddress = fmt.Sprintf("%s:%d", bindAddress, app.cfg.Server.Port)
	}

	log.Info("Serving on %s://%s", protocol, bindAddress)
	log.Info("---")
	listener, err := net.Listen(network, bindAddress)
	if err != nil {
	log.Error("Could not bind to address: %v", err)
	os.Exit(1)
	}

	if network == "unix" {
	err = os.Chmod(bindAddress, 0o666)
	if err != nil {
	log.Error("Could not update socket permissions: %v", err)
	os.Exit(1)
	}
	}

	defer listener.Close()
	err = http.Serve(listener, r)
	}
	if err != nil {
	log.Error("Unable to start: %v", err)
	os.Exit(1)
	}
	}

	func (app *App) InitDecoder() {
	// TODO: do this at the package level, instead of the App level
	// Initialize modules
	app.formDecoder = schema.NewDecoder()
	app.formDecoder.RegisterConverter(converter.NullJSONString{}, converter.ConvertJSONNullString)
	app.formDecoder.RegisterConverter(converter.NullJSONBool{}, converter.ConvertJSONNullBool)
	app.formDecoder.RegisterConverter(sql.NullString{}, converter.ConvertSQLNullString)
	app.formDecoder.RegisterConverter(sql.NullBool{}, converter.ConvertSQLNullBool)
	app.formDecoder.RegisterConverter(sql.NullInt64{}, converter.ConvertSQLNullInt64)
	app.formDecoder.RegisterConverter(sql.NullFloat64{}, converter.ConvertSQLNullFloat64)
	}

	// ConnectToDatabase validates and connects to the configured database, then
	// tests the connection.
	func ConnectToDatabase(app *App) error {
	// Check database configuration
	if app.cfg.Database.Type == driverMySQL && app.cfg.Database.User == "" {
	return fmt.Errorf("Database user not set.")
	}
	if app.cfg.Database.Host == "" {
	app.cfg.Database.Host = "localhost"
	}
	if app.cfg.Database.Database == "" {
	app.cfg.Database.Database = "writefreely"
	}

	// TODO: check err
	connectToDatabase(app)

	// Test database connection
	err := app.db.Ping()
	if err != nil {
	return fmt.Errorf("Database ping failed: %s", err)
	}

	return nil
	}

	// FormatVersion constructs the version string for the application
	func FormatVersion() string {
	return serverSoftware + " " + softwareVer
	}

	// OutputVersion prints out the version of the application.
	func OutputVersion() {
	fmt.Println(FormatVersion())
	}

	// NewApp creates a new app instance.
	func NewApp(cfgFile string) *App {
	return &App{
	cfgFile: cfgFile,
	}
	}

	// CreateConfig creates a default configuration and saves it to the app's cfgFile.
	func CreateConfig(app *App) error {
	log.Info("Creating configuration...")
	c := config.New()
	log.Info("Saving configuration %s...", app.cfgFile)
	err := config.Save(c, app.cfgFile)
	if err != nil {
	return fmt.Errorf("Unable to save configuration: %v", err)
	}
	return nil
	}

	// DoConfig runs the interactive configuration process.
	func DoConfig(app *App, configSections string) {
	if configSections == "" {
	configSections = "server db app"
	}
	// let's check there aren't any garbage in the list
	configSectionsArray := strings.Split(configSections, " ")
	for _, element := range configSectionsArray {
	if element != "server" && element != "db" && element != "app" {
	log.Error("Invalid argument to --sections. Valid arguments are only \"server\", \"db\" and \"app\"")
	os.Exit(1)
	}
	}
	d, err := config.Configure(app.cfgFile, configSections)
	if err != nil {
	log.Error("Unable to configure: %v", err)
	os.Exit(1)
	}
	app.cfg = d.Config
	connectToDatabase(app)
	defer shutdown(app)

	if !app.db.DatabaseInitialized() {
	err = adminInitDatabase(app)
	if err != nil {
	log.Error(err.Error())
	os.Exit(1)
	}
	} else {
	log.Info("Database already initialized.")
	}

	if d.User != nil {
	u := &User{
	Username: d.User.Username,
	HashedPass: d.User.HashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	// Create blog
	log.Info("Creating user %s...\n", u.Username)
	err = app.db.CreateUser(app.cfg, u, app.cfg.App.SiteName, "")
	if err != nil {
	log.Error("Unable to create user: %s", err)
	os.Exit(1)
	}
	log.Info("Done!")
	}
	os.Exit(0)
	}

	// GenerateKeyFiles creates app encryption keys and saves them into the configured KeysParentDir.
	func GenerateKeyFiles(app *App) error {
	// Read keys path from config
	app.LoadConfig()

	// Create keys dir if it doesn't exist yet
	fullKeysDir := filepath.Join(app.cfg.Server.KeysParentDir, keysDir)
	if _, err := os.Stat(fullKeysDir); os.IsNotExist(err) {
	err = os.Mkdir(fullKeysDir, 0700)
	if err != nil {
	return err
	}
	}

	// Generate keys
	initKeyPaths(app)
	// TODO: use something like https://github.com/hashicorp/go-multierror to return errors
	var keyErrs error
	err := generateKey(emailKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieAuthKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(cookieKeyPath)
	if err != nil {
	keyErrs = err
	}
	err = generateKey(csrfKeyPath)
	if err != nil {
	keyErrs = err
	}

	return keyErrs
	}

	// CreateSchema creates all database tables needed for the application.
	func CreateSchema(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())
	err := adminInitDatabase(apper.App())
	if err != nil {
	return err
	}
	return nil
	}

	// Migrate runs all necessary database migrations.
	func Migrate(apper Apper) error {
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	err := migrations.Migrate(migrations.NewDatastore(apper.App().db.DB, apper.App().db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}
	return nil
	}

	// ResetPassword runs the interactive password reset process.
	func ResetPassword(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Fetch user
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("Get user: %s", err)
	os.Exit(1)
	}

	// Prompt for new password
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: "New password",
	Mask: '*',
	}
	newPass, err := prompt.Run()
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}

	// Do the update
	log.Info("Updating...")
	err = adminResetPassword(apper.App(), u, newPass)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	// DoDeleteAccount runs the confirmation and account delete process.
	func DoDeleteAccount(apper Apper, username string) error {
	// Connect to the database
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// check user exists
	u, err := apper.App().db.GetUserForAuth(username)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	userID := u.ID

	// do not delete the admin account
	// TODO: check for other admins and skip?
	if u.IsAdmin() {
	log.Error("Can not delete admin account")
	os.Exit(1)
	}

	// confirm deletion, w/ w/out posts
	prompt := promptui.Prompt{
	Templates: &promptui.PromptTemplates{
	Success: "{{ . \| bold \| faint }}: ",
	},
	Label: fmt.Sprintf("Really delete user : %s", username),
	IsConfirm: true,
	}
	_, err = prompt.Run()
	if err != nil {
	log.Info("Aborted...")
	os.Exit(0)
	}

	log.Info("Deleting...")
	err = apper.App().db.DeleteAccount(userID)
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	return nil
	}

	func connectToDatabase(app *App) {
	log.Info("Connecting to %s database...", app.cfg.Database.Type)

	var db *sql.DB
	var err error
	if app.cfg.Database.Type == driverMySQL {
	db, err = sql.Open(app.cfg.Database.Type, fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=utf8mb4&parseTime=true&loc=%s&tls=%t", app.cfg.Database.User, app.cfg.Database.Password, app.cfg.Database.Host, app.cfg.Database.Port, app.cfg.Database.Database, url.QueryEscape(time.Local.String()), app.cfg.Database.TLS))
	db.SetMaxOpenConns(50)
	} else if app.cfg.Database.Type == driverSQLite {
	if !SQLiteEnabled {
	log.Error("Invalid database type '%s'. Binary wasn't compiled with SQLite3 support.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if app.cfg.Database.FileName == "" {
	log.Error("SQLite database filename value in config.ini is empty.")
	os.Exit(1)
	}
	db, err = sql.Open("sqlite3_with_regex", app.cfg.Database.FileName+"?parseTime=true&cached=shared")
	db.SetMaxOpenConns(2)
	} else {
	log.Error("Invalid database type '%s'. Only 'mysql' and 'sqlite3' are supported right now.", app.cfg.Database.Type)
	os.Exit(1)
	}
	if err != nil {
	log.Error("%s", err)
	os.Exit(1)
	}
	app.db = &datastore{db, app.cfg.Database.Type}
	}

	func shutdown(app *App) {
	log.Info("Closing database connection...")
	app.db.Close()
	if strings.HasPrefix(app.cfg.Server.Bind, "/") {
	// Clean up socket
	log.Info("Removing socket file...")
	err := os.Remove(app.cfg.Server.Bind)
	if err != nil {
	log.Error("Unable to remove socket: %s", err)
	os.Exit(1)
	}
	log.Info("Success.")
	}
	}

	// CreateUser creates a new admin or normal user from the given credentials.
	func CreateUser(apper Apper, username, password string, isAdmin bool) error {
	// Create an admin user with --create-admin
	apper.LoadConfig()
	connectToDatabase(apper.App())
	defer shutdown(apper.App())

	// Ensure an admin / first user doesn't already exist
	firstUser, _ := apper.App().db.GetUserByID(1)
	if isAdmin {
	// Abort if trying to create admin user, but one already exists
	if firstUser != nil {
	return fmt.Errorf("Admin user already exists (%s). Create a regular user with: writefreely --create-user", firstUser.Username)
	}
	} else {
	// Abort if trying to create regular user, but no admin exists yet
	if firstUser == nil {
	return fmt.Errorf("No admin user exists yet. Create an admin first with: writefreely --create-admin")
	}
	}

	// Create the user
	// Normalize and validate username
	desiredUsername := username
	username = getSlug(username, "")

	usernameDesc := username
	if username != desiredUsername {
	usernameDesc += " (originally: " + desiredUsername + ")"
	}

	if !author.IsValidUsername(apper.App().cfg, username) {
	return fmt.Errorf("Username %s is invalid, reserved, or shorter than configured minimum length (%d characters).", usernameDesc, apper.App().cfg.App.MinUsernameLen)
	}

	// Hash the password
	hashedPass, err := auth.HashPass([]byte(password))
	if err != nil {
	return fmt.Errorf("Unable to hash password: %v", err)
	}

	u := &User{
	Username: username,
	HashedPass: hashedPass,
	Created: time.Now().Truncate(time.Second).UTC(),
	}

	userType := "user"
	if isAdmin {
	userType = "admin"
	}
	log.Info("Creating %s %s...", userType, usernameDesc)
	err = apper.App().db.CreateUser(apper.App().Config(), u, desiredUsername, "")
	if err != nil {
	return fmt.Errorf("Unable to create user: %s", err)
	}
	log.Info("Done!")
	return nil
	}

	//go:embed schema.sql
	var schemaSql string

	//go:embed sqlite.sql
	var sqliteSql string

	func adminInitDatabase(app *App) error {
	var schema string
	if app.cfg.Database.Type == driverSQLite {
	schema = sqliteSql
	} else {
	schema = schemaSql
	}

	tblReg := regexp.MustCompile("CREATE TABLE (IF NOT EXISTS )?`([a-z_]+)`")

	queries := strings.Split(string(schema), ";\n")
	for _, q := range queries {
	if strings.TrimSpace(q) == "" {
	continue
	}
	parts := tblReg.FindStringSubmatch(q)
	if len(parts) >= 3 {
	log.Info("Creating table %s...", parts[2])
	} else {
	log.Info("Creating table ??? (Weird query) No match in: %v", parts)
	}
	_, err := app.db.Exec(q)
	if err != nil {
	log.Error("%s", err)
	} else {
	log.Info("Created.")
	}
	}

	// Set up migrations table
	log.Info("Initializing appmigrations table...")
	err := migrations.SetInitialMigrations(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("Unable to set initial migrations: %v", err)
	}

	log.Info("Running migrations...")
	err = migrations.Migrate(migrations.NewDatastore(app.db.DB, app.db.driverName))
	if err != nil {
	return fmt.Errorf("migrate: %s", err)
	}

	log.Info("Done.")
	return nil
	}

	// ServerUserAgent returns a User-Agent string to use in external requests. The
	// hostName parameter may be left empty.
	func ServerUserAgent(hostName string) string {
	hostUAStr := ""
	if hostName != "" {
	hostUAStr = "; +" + hostName
	}
	return "Go (" + serverSoftware + "/" + softwareVer + hostUAStr + ")"
	}
	diff --git a/pages.go b/pages.go
	index 8b3a987..bf85526 100644
	--- a/pages.go
	+++ b/pages.go
	@@ -1,164 +1,198 @@
	/*
	* Copyright © 2018-2019, 2021 Musing Studio LLC.
	*
	* This file is part of WriteFreely.
	*
	* WriteFreely is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License, included
	* in the LICENSE file in this source code package.
	*/

	package writefreely

	import (
	"database/sql"
	"github.com/writefreely/writefreely/config"
	"time"
	)

	var defaultPageUpdatedTime = time.Date(2018, 11, 8, 12, 0, 0, 0, time.Local)

	func getAboutPage(app App) (instanceContent, error) {
	c, err := app.db.GetDynamicContent("about")
	if err != nil {
	return nil, err
	}
	if c == nil {
	c = &instanceContent{
	ID: "about",
	Type: "page",
	Content: defaultAboutPage(app.cfg),
	}
	}
	if !c.Title.Valid {
	c.Title = defaultAboutTitle(app.cfg)
	}
	return c, nil
	}

	func defaultAboutTitle(cfg *config.Config) sql.NullString {
	return sql.NullString{String: "About " + cfg.App.SiteName, Valid: true}
	}

	+func getContactPage(app App) (instanceContent, error) {
	+ c, err := app.db.GetDynamicContent("contact")
	+ if err != nil {
	+ return nil, err
	+ }
	+ if c == nil {
	+ c = &instanceContent{
	+ ID: "contact",
	+ Type: "page",
	+ Content: defaultContactPage(app),
	+ }
	+ }
	+ if !c.Title.Valid {
	+ c.Title = defaultContactTitle()
	+ }
	+ return c, nil
	+}
	+
	+func defaultContactTitle() sql.NullString {
	+ return sql.NullString{String: "Contact Us", Valid: true}
	+}
	+
	func getPrivacyPage(app App) (instanceContent, error) {
	c, err := app.db.GetDynamicContent("privacy")
	if err != nil {
	return nil, err
	}
	if c == nil {
	c = &instanceContent{
	ID: "privacy",
	Type: "page",
	Content: defaultPrivacyPolicy(app.cfg),
	Updated: defaultPageUpdatedTime,
	}
	}
	if !c.Title.Valid {
	c.Title = defaultPrivacyTitle()
	}
	return c, nil
	}

	func defaultPrivacyTitle() sql.NullString {
	return sql.NullString{String: "Privacy Policy", Valid: true}
	}

	func defaultAboutPage(cfg *config.Config) string {
	if cfg.App.Federation {
	return `_` + cfg.App.SiteName + `_ is an interconnected place for you to write and publish, powered by [WriteFreely](https://writefreely.org) and ActivityPub.`
	}
	return `_` + cfg.App.SiteName + `_ is a place for you to write and publish, powered by [WriteFreely](https://writefreely.org).`
	}

	+func defaultContactPage(app *App) string {
	+ c, err := app.db.GetCollectionByID(1)
	+ if err != nil {
	+ return ""
	+ }
	+ return `_` + app.cfg.App.SiteName + `_ is administered by: [` + c.Alias + `](/` + c.Alias + `/).
	+
	+Contact them at this email address: _EMAIL GOES HERE_.
	+
	+You can also reach them here...`
	+}
	+
	func defaultPrivacyPolicy(cfg *config.Config) string {
	return `[WriteFreely](https://writefreely.org), the software that powers this site, is built to enforce your right to privacy by default.

	It retains as little data about you as possible, not even requiring an email address to sign up. However, if you _do_ give us your email address, it is stored encrypted in our database. We salt and hash your account's password.

	We store log files, or data about what happens on our servers. We also use cookies to keep you logged in to your account.

	Beyond this, it's important that you trust whoever runs ` + cfg.App.SiteName + `. Software can only do so much to protect you -- your level of privacy protections will ultimately fall on the humans that run this particular service.`
	}

	func getLandingBanner(app App) (instanceContent, error) {
	c, err := app.db.GetDynamicContent("landing-banner")
	if err != nil {
	return nil, err
	}
	if c == nil {
	c = &instanceContent{
	ID: "landing-banner",
	Type: "section",
	Content: defaultLandingBanner(app.cfg),
	Updated: defaultPageUpdatedTime,
	}
	}
	return c, nil
	}

	func getLandingBody(app App) (instanceContent, error) {
	c, err := app.db.GetDynamicContent("landing-body")
	if err != nil {
	return nil, err
	}
	if c == nil {
	c = &instanceContent{
	ID: "landing-body",
	Type: "section",
	Content: defaultLandingBody(app.cfg),
	Updated: defaultPageUpdatedTime,
	}
	}
	return c, nil
	}

	func defaultLandingBanner(cfg *config.Config) string {
	if cfg.App.Federation {
	return "# Start your blog in the fediverse"
	}
	return "# Start your blog"
	}

	func defaultLandingBody(cfg *config.Config) string {
	if cfg.App.Federation {
	return `## Join the Fediverse

	The fediverse is a large network of platforms that all speak a common language. Imagine if you could reply to Instagram posts from Twitter, or interact with your favorite Medium blogs from Facebook -- federated alternatives like [PixelFed](https://pixelfed.org), [Mastodon](https://joinmastodon.org), and WriteFreely enable you to do these types of things.

	<div style="text-align:center">
	<iframe style="width: 560px; height: 315px; max-width: 100%;" sandbox="allow-same-origin allow-scripts" src="https://video.writeas.org/videos/embed/cc55e615-d204-417c-9575-7b57674cc6f3" frameborder="0" allowfullscreen></iframe>
	</div>

	## Write More Socially

	WriteFreely can communicate with other federated platforms like Mastodon, so people can follow your blogs, bookmark their favorite posts, and boost them to their followers. Sign up above to create a blog and join the fediverse.`
	}
	return ""
	}

	func getReaderSection(app App) (instanceContent, error) {
	c, err := app.db.GetDynamicContent("reader")
	if err != nil {
	return nil, err
	}
	if c == nil {
	c = &instanceContent{
	ID: "reader",
	Type: "section",
	Content: defaultReaderBanner(app.cfg),
	Updated: defaultPageUpdatedTime,
	}
	}
	if !c.Title.Valid {
	c.Title = defaultReaderTitle(app.cfg)
	}
	return c, nil
	}

	func defaultReaderTitle(cfg *config.Config) sql.NullString {
	return sql.NullString{String: "Reader", Valid: true}
	}

	func defaultReaderBanner(cfg *config.Config) string {
	return "Read the latest posts from " + cfg.App.SiteName + "."
	}
	diff --git a/pages/500.tmpl b/pages/500.tmpl
	index 37b031d..4240348 100644
	--- a/pages/500.tmpl
	+++ b/pages/500.tmpl
	@@ -1,8 +1,8 @@
	{{define "head"}}<title>Server error — {{.SiteName}}</title>{{end}}
	{{define "content"}}
	<div class="content-container tight">
	<h1>Server error 😵</h1>
	- <p>There seems to be an issue with this server. Please contact the admin and let them know they'll need to fix it.</p>
	+ <p>There seems to be an issue with this server. Please <a href="/contact">contact the admin</a> and let them know they'll need to fix it.</p>
	<p>– {{.SiteName}} 🤖</p>
	</div>
	{{end}}
	diff --git a/pages/contact.tmpl b/pages/contact.tmpl
	new file mode 100644
	index 0000000..8dff9ae
	--- /dev/null
	+++ b/pages/contact.tmpl
	@@ -0,0 +1,8 @@
	+{{define "head"}}<title>{{.ContentTitle}} — {{.SiteName}}</title>
	+<meta name="description" content="{{.PlainContent}}">
	+{{end}}
	+{{define "content"}}<div class="content-container snug">
	+ <h1>{{.ContentTitle}}</h1>
	+ {{.Content}}
	+ </div>
	+{{end}}
	diff --git a/templates/user/admin/view-page.tmpl b/templates/user/admin/view-page.tmpl
	index 161e40b..dfcf4cd 100644
	--- a/templates/user/admin/view-page.tmpl
	+++ b/templates/user/admin/view-page.tmpl
	@@ -1,77 +1,79 @@
	{{define "view-page"}}
	{{template "header" .}}
	<style>
	label {
	display: block;
	margin-top: 1em;
	padding: 0 0 1em;
	color: #666;
	}
	.content-desc {
	font-size: 0.95em;
	}
	.page-desc {
	margin: 0 0 0.5em;
	}
	textarea + .content-desc {
	margin: 0.5em 0 1em;
	font-style: italic;
	}
	input[type=text] {
	/* Match textarea color. TODO: y is it like this thooo */
	border-color: #ccc;
	}
	</style>
	<div class="snug content-container">
	{{template "admin-header" .}}

	<h2 id="posts-header">{{if eq .Content.ID "landing"}}Home page{{else}}{{.Content.ID}} page{{end}}</h2>

	{{if eq .Content.ID "about"}}
	<p class="page-desc content-desc">Describe what your instance is <a href="/about" target="page">about</a>.</p>
	+ {{else if eq .Content.ID "contact"}}
	+ <p class="page-desc content-desc">Tell your users and outside visitors how to <a href="/contact" target="page">contact</a> you.</p>
	{{else if eq .Content.ID "privacy"}}
	<p class="page-desc content-desc">Outline your <a href="/privacy" target="page">privacy policy</a>.</p>
	{{else if eq .Content.ID "reader"}}
	<p class="page-desc content-desc">Customize your <a href="/read" target="page">Reader</a> page.</p>
	{{else if eq .Content.ID "landing"}}
	<p class="page-desc content-desc">Customize your <a href="/?landing=1" target="page">home page</a>.</p>
	{{end}}

	{{if .Message}}<p>{{.Message}}</p>{{end}}

	<form method="post" action="/admin/update/{{.Content.ID}}" onsubmit="savePage(this)">
	{{if .Banner}}
	<label for="banner">
	Banner
	</label>
	<textarea id="banner" class="section codable norm edit-page" style="min-height: 5em; height: 5em;" name="banner">{{.Banner.Content}}</textarea>
	<p class="content-desc">We suggest a header (e.g. <code># Welcome</code>), optionally followed by a small bit of text. Accepts Markdown and HTML.</p>
	{{else}}
	<label for="title">
	Title
	</label>
	<input type="text" name="title" id="title" value="{{.Content.Title.String}}" />
	{{end}}
	<label for="content">
	{{if .Banner}}Body{{else}}Content{{end}}
	</label>

	<textarea id="content" class="section codable norm edit-page" name="content">{{.Content.Content}}</textarea>

	<p class="content-desc">Accepts Markdown and HTML.</p>

	<input type="submit" value="Save" />
	</form>

	</div>

	<script>
	function savePage(el) {
	var $btn = el.querySelector('input[type=submit]');
	$btn.value = 'Saving...';
	$btn.disabled = true;
	}
	</script>

	{{template "footer" .}}
	{{end}}

File Metadata

Mime Type: text/x-diff
Expires: Thu, Jul 17, 7:49 PM (18 h, 42 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 3324313

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions