Skip to content
This repository was archived by the owner on Aug 30, 2021. It is now read-only.

Commit aafa5e6

Browse files
almegdadalmegdad
committed
Force Lowercase & Remove Sensitive Data
* add directive to force username & email lowercase * remove sensitive data in password reset * 2 space indentation in reset & forgot password views
1 parent 16b481f commit aafa5e6

File tree

9 files changed

+71
-52
lines changed

9 files changed

+71
-52
lines changed

‎modules/users/client/directives/users.client.directive.js

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
'use strict';
2+
3+
// Users directive used to force lowercase input
4+
angular.module('users').directive('lowercase', function () {
5+
return {
6+
require: 'ngModel',
7+
link: function (scope, element, attrs, modelCtrl) {
8+
modelCtrl.$parsers.push(function (input) {
9+
return input ? input.toLowerCase() : '';
10+
});
11+
element.css('text-transform', 'lowercase');
12+
}
13+
};
14+
});

‎modules/users/client/views/authentication/signin.client.view.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ <h3 class="col-md-12 text-center">Or with your account</h3>
55
<fieldset>
66
<div class="form-group" show-errors>
77
<label for="username">Username</label>
8-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" required>
8+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase required>
99
<div ng-messages="userForm.username.$error" role="alert">
1010
<p class="help-block error-text" ng-message="required">Username is required.</p>
1111
</div>

‎modules/users/client/views/authentication/signup.client.view.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,15 @@ <h3 class="col-md-12 text-center">Or sign up using your email</h3>
1919
</div>
2020
<div class="form-group" show-errors>
2121
<label for="email">Email</label>
22-
<input type="email" id="email" name="email" class="form-control" ng-model="credentials.email" placeholder="Email" required>
22+
<input type="email" id="email" name="email" class="form-control" ng-model="credentials.email" placeholder="Email" lowercase required>
2323
<div ng-messages="userForm.email.$error" role="alert">
2424
<p class="help-block error-text" ng-message="required">Email address is required.</p>
2525
<p class="help-block error-text" ng-message="email">Email address is invalid.</p>
2626
</div>
2727
</div>
2828
<div class="form-group" show-errors>
2929
<label for="username">Username</label>
30-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" required>
30+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase required>
3131
<div ng-messages="userForm.username.$error" role="alert">
3232
<p class="help-block error-text" ng-message="required">Username is required.</p>
3333
</div>

‎modules/users/client/views/password/forgot-password.client.view.html

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
11
<section class="row" ng-controller="PasswordController">
2-
<h3 class="col-md-12 text-center">Restore your password</h3>
3-
<p class="small text-center">Enter your account username.</p>
4-
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
5-
<form ng-submit="askForPasswordReset()" class="form-horizontal" autocomplete="off">
6-
<fieldset>
2+
<h3 class="col-md-12 text-center">Restore your password</h3>
3+
<p class="small text-center">Enter your account username.</p>
4+
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
5+
<form ng-submit="askForPasswordReset()" class="form-horizontal" autocomplete="off">
6+
<fieldset>
77
<div class="form-group">
8-
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username">
8+
<input type="text" id="username" name="username" class="form-control" ng-model="credentials.username" placeholder="Username" lowercase>
99
</div>
10-
<div class="text-center form-group">
11-
<button type="submit" class="btn btn-primary">Submit</button>
12-
</div>
13-
<div ng-show="error" class="text-center text-danger">
14-
<strong>{{error}}</strong>
15-
</div>
16-
<div ng-show="success" class="text-center text-success">
17-
<strong>{{success}}</strong>
18-
</div>
19-
</fieldset>
20-
</form>
21-
</div>
10+
<div class="text-center form-group">
11+
<button type="submit" class="btn btn-primary">Submit</button>
12+
</div>
13+
<div ng-show="error" class="text-center text-danger">
14+
<strong>{{error}}</strong>
15+
</div>
16+
<div ng-show="success" class="text-center text-success">
17+
<strong>{{success}}</strong>
18+
</div>
19+
</fieldset>
20+
</form>
21+
</div>
2222
</section>

‎modules/users/client/views/password/reset-password.client.view.html

Lines changed: 24 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
<section class="row" ng-controller="PasswordController">
2-
<h3 class="col-md-12 text-center">Reset your password</h3>
3-
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
4-
<form ng-submit="resetUserPassword()" class="signin form-horizontal" autocomplete="off">
5-
<fieldset>
6-
<div class="form-group">
7-
<label for="newPassword">New Password</label>
8-
<input type="password" id="newPassword" name="newPassword" class="form-control" ng-model="passwordDetails.newPassword" placeholder="New Password">
9-
</div>
10-
<div class="form-group">
11-
<label for="verifyPassword">Verify Password</label>
12-
<input type="password" id="verifyPassword" name="verifyPassword" class="form-control" ng-model="passwordDetails.verifyPassword" placeholder="Verify Password">
13-
</div>
14-
<div class="text-center form-group">
15-
<button type="submit" class="btn btn-lg btn-primary">Update Password</button>
16-
</div>
17-
<div ng-show="error" class="text-center text-danger">
18-
<strong>{{error}}</strong>
19-
</div>
20-
<div ng-show="success" class="text-center text-success">
21-
<strong>{{success}}</strong>
22-
</div>
23-
</fieldset>
24-
</form>
25-
</div>
2+
<h3 class="col-md-12 text-center">Reset your password</h3>
3+
<div class="col-xs-offset-2 col-xs-8 col-md-offset-5 col-md-2">
4+
<form ng-submit="resetUserPassword()" class="signin form-horizontal" autocomplete="off">
5+
<fieldset>
6+
<div class="form-group">
7+
<label for="newPassword">New Password</label>
8+
<input type="password" id="newPassword" name="newPassword" class="form-control" ng-model="passwordDetails.newPassword" placeholder="New Password">
9+
</div>
10+
<div class="form-group">
11+
<label for="verifyPassword">Verify Password</label>
12+
<input type="password" id="verifyPassword" name="verifyPassword" class="form-control" ng-model="passwordDetails.verifyPassword" placeholder="Verify Password">
13+
</div>
14+
<div class="text-center form-group">
15+
<button type="submit" class="btn btn-lg btn-primary">Update Password</button>
16+
</div>
17+
<div ng-show="error" class="text-center text-danger">
18+
<strong>{{error}}</strong>
19+
</div>
20+
<div ng-show="success" class="text-center text-success">
21+
<strong>{{success}}</strong>
22+
</div>
23+
</fieldset>
24+
</form>
25+
</div>
2626
</section>

‎modules/users/client/views/settings/edit-profile.client.view.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,15 @@
1818
</div>
1919
<div class="form-group" show-errors>
2020
<label for="email">Email</label>
21-
<input type="email" id="email" name="email" class="form-control" ng-model="user.email" placeholder="Email" required>
21+
<input type="email" id="email" name="email" class="form-control" ng-model="user.email" placeholder="Email" lowercase required>
2222
<div ng-messages="userForm.email.$error" role="alert">
2323
<p class="help-block error-text" ng-message="required">Email address is required.</p>
2424
<p class="help-block error-text" ng-message="email">Email address is invalid.</p>
2525
</div>
2626
</div>
2727
<div class="form-group" show-errors>
2828
<label for="username">Username</label>
29-
<input type="text" id="username" name="username" class="form-control" ng-model="user.username" placeholder="Username" required>
29+
<input type="text" id="username" name="username" class="form-control" ng-model="user.username" placeholder="Username" lowercase required>
3030
<div ng-messages="userForm.username.$error" role="alert">
3131
<p class="help-block error-text" ng-message="required">Username is required.</p>
3232
</div>

‎modules/users/server/config/strategies/local.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ module.exports = function () {
1515
},
1616
function (username, password, done) {
1717
User.findOne({
18-
username: username
18+
username: username.toLowerCase()
1919
}, function (err, user) {
2020
if (err) {
2121
return done(err);

‎modules/users/server/controllers/users/users.password.server.controller.js

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ exports.forgot = function (req, res, next) {
3030
function (token, done) {
3131
if (req.body.username) {
3232
User.findOne({
33-
username: req.body.username
33+
username: req.body.username.toLowerCase()
3434
}, '-salt -password', function (err, user) {
3535
if (!user) {
3636
return res.status(400).send({
@@ -144,7 +144,10 @@ exports.reset = function (req, res, next) {
144144
if (err) {
145145
res.status(400).send(err);
146146
} else {
147-
// Return authenticated user
147+
// Remove sensitive data before return authenticated user
148+
user.password = undefined;
149+
user.salt = undefined;
150+
148151
res.json(user);
149152

150153
done(err, user);

‎modules/users/server/models/user.server.model.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,17 @@ var UserSchema = new Schema({
5151
},
5252
email: {
5353
type: String,
54-
trim: true,
5554
unique: true,
55+
lowercase: true,
56+
trim: true,
5657
default: '',
5758
validate: [validateLocalStrategyEmail, 'Please fill a valid email address']
5859
},
5960
username: {
6061
type: String,
6162
unique: 'Username already exists',
6263
required: 'Please fill in a username',
64+
lowercase: true,
6365
trim: true
6466
},
6567
password: {
@@ -139,7 +141,7 @@ UserSchema.methods.authenticate = function (password) {
139141
*/
140142
UserSchema.statics.findUniqueUsername = function (username, suffix, callback) {
141143
var _this = this;
142-
var possibleUsername = username + (suffix || '');
144+
var possibleUsername = username.toLowerCase() + (suffix || '');
143145

144146
_this.findOne({
145147
username: possibleUsername

0 commit comments

Comments
 (0)