rework recovery email

This commit is contained in:
Your Name 2023-10-06 19:06:54 -04:00
parent 173612b58d
commit 58d6209a61
3 changed files with 21 additions and 3 deletions

17
auth.go
View File

@ -3,6 +3,8 @@ package scsusers
import (
"fmt"
"log"
"strconv"
"time"
"golang.org/x/crypto/bcrypt"
)
@ -13,9 +15,24 @@ func Login(username, password string) bool {
return false
}
if bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(password)) != nil {
rc, ok := u.Get("recoverycode")
if !ok || bcrypt.CompareHashAndPassword([]byte(u.Password), []byte(rc)) != nil {
log.Printf("scsusers.Login: Failed password for " + username)
return false
}
tmp, ok := u.Get("recoverytime")
if !ok {
log.Printf("scsusers.Login: recoverytime missing " + username)
return false
}
rt, _ := strconv.ParseInt(tmp, 10, 64)
if time.Now().Unix() > rt {
log.Printf("scsusers.Login: recovery time expired")
return false
}
u.Delete("recoverykey")
u.Delete("recoverytime")
}
log.Printf("User %s logged in\n", username)
return true
}

View File

@ -19,7 +19,7 @@ func RecoverByEmail(email string) {
recoverycode := randBytes(16)
u.Set("recoverycode", string(recoverycode))
u.Set("recoverytime", fmt.Sprintf("%d", time.Now().Unix()))
u.Set("recoverytime", fmt.Sprintf("%d", time.Now().Add(time.Minute*60).Unix()))
SendRecoveryEmail(email, email, string(recoverycode))
}

View File

@ -22,6 +22,7 @@ func (u *UserData) Delete(key string) {
if err != nil {
log.Printf("scsauth: set: delete: %s", err.Error())
}
delete(u.Meta, key)
}
}