| 28 | } |
| 29 | |
| 30 | func Toggle(options *ToggleOptions) macaron.Handler { |
| 31 | return func(c *Context) { |
| 32 | // Cannot view any page before installation. |
| 33 | if !conf.Security.InstallLock { |
| 34 | c.RedirectSubpath("/install") |
| 35 | return |
| 36 | } |
| 37 | |
| 38 | // Check prohibit login users. |
| 39 | if c.IsLogged && c.User.ProhibitLogin { |
| 40 | c.Data["Title"] = c.Tr("auth.prohibit_login") |
| 41 | c.Success("user/auth/prohibit_login") |
| 42 | return |
| 43 | } |
| 44 | |
| 45 | // Check non-logged users landing page. |
| 46 | if !c.IsLogged && c.Req.RequestURI == "/" && conf.Server.LandingURL != "/" { |
| 47 | c.RedirectSubpath(conf.Server.LandingURL) |
| 48 | return |
| 49 | } |
| 50 | |
| 51 | // Redirect to dashboard if user tries to visit any non-login page. |
| 52 | if options.SignOutRequired && c.IsLogged && c.Req.RequestURI != "/" { |
| 53 | c.RedirectSubpath("/") |
| 54 | return |
| 55 | } |
| 56 | |
| 57 | if !options.SignOutRequired && !options.DisableCSRF && c.Req.Method == "POST" && !isAPIPath(c.Req.URL.Path) { |
| 58 | csrf.Validate(c.Context, c.csrf) |
| 59 | if c.Written() { |
| 60 | return |
| 61 | } |
| 62 | } |
| 63 | |
| 64 | if options.SignInRequired { |
| 65 | if !c.IsLogged { |
| 66 | // Restrict API calls with error message. |
| 67 | if isAPIPath(c.Req.URL.Path) { |
| 68 | c.JSON(http.StatusForbidden, map[string]string{ |
| 69 | "message": "Only authenticated user is allowed to call APIs.", |
| 70 | }) |
| 71 | return |
| 72 | } |
| 73 | |
| 74 | c.SetCookie("redirect_to", url.QueryEscape(conf.Server.Subpath+c.Req.RequestURI), 0, conf.Server.Subpath) |
| 75 | c.RedirectSubpath("/user/login") |
| 76 | return |
| 77 | } else if !c.User.IsActive && conf.Auth.RequireEmailConfirmation { |
| 78 | c.Title("auth.active_your_account") |
| 79 | c.Success("user/auth/activate") |
| 80 | return |
| 81 | } |
| 82 | } |
| 83 | |
| 84 | // Redirect to log in page if auto-signin info is provided and has not signed in. |
| 85 | if !options.SignOutRequired && !c.IsLogged && !isAPIPath(c.Req.URL.Path) && |
| 86 | len(c.GetCookie(conf.Security.CookieUsername)) > 0 { |
| 87 | c.SetCookie("redirect_to", url.QueryEscape(conf.Server.Subpath+c.Req.RequestURI), 0, conf.Server.Subpath) |