moon
/
sync
mirror of https://github.com/calzoneman/sync.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
sync/www/login.html

96 lines
3.6 KiB
HTML
Raw Normal View History

Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>CyTube - Login</title>
<link rel="stylesheet" href="assets/css/bootstrap.css">
Add password change (#88)
2013-05-04 18:01:04 +00:00
<style type="text/css">
#username, #pw {
width: 95%;
}
Finish up
2013-05-30 18:34:54 +00:00
.btn {
width: 45%;
Add password change (#88)
2013-05-04 18:01:04 +00:00
}
</style>
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
</head>
<body>
<form class="form-horizontal" action="javascript:void(0)">
<div class="control-group">
<label class="control-label" for="username">Username</label>
<div class="controls">
<input type="text" id="username">
</div>
</div>
<div class="control-group">
<label class="control-label" for="pw">Password</label>
<div class="controls">
<input type="password" id="pw">
</div>
</div>
<div class="control-group">
<div class="controls">
<button class="btn" id="login">Login</button>
Finish up
2013-05-30 18:34:54 +00:00
<a class="btn" id="register" target="_blank" href="account.html">Register</a>
Add password change (#88)
2013-05-04 18:01:04 +00:00
</div>
</div>
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
</form>
<script src="assets/js/jquery.js" type="text/javascript"></script>
Add SSL user options so the page can be plain HTTP
2013-09-11 03:43:43 +00:00
<script src="assets/js/data.js" type="text/javascript"></script>
Fix cross-domain issues
2013-04-26 04:57:46 +00:00
<script src="assets/js/iourl.js" type="text/javascript"></script>
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
<script type="text/javascript">
Fixes
2013-08-18 19:21:42 +00:00
/*
So, it turns out that $.post causes Firefox to use a GET request
on cross-site requests. What the hell? I'd understand if they just
made it error instead, but why give me chicken tenders if I ordered a
cheeseburger and act like everything's peachy?
*/
function postJSON(url, data, callback) {
$.ajax(url, {
method: "POST",
crossDomain: true,
data: data,
success: function (data) {
try {
data = data.substring(data.indexOf("{"));
data = data.substring(0, data.lastIndexOf("}") + 1);
data = JSON.parse(data);
callback(data);
} catch(e) {
return;
}
},
dataType: "text"
});
}
Add SSL user options so the page can be plain HTTP
2013-09-11 03:43:43 +00:00
var theme = USEROPTS.theme;
Fix login page to load user theme
2013-05-14 22:07:55 +00:00
if(theme != "default") {
$("<link/>").attr("rel", "stylesheet")
.attr("type", "text/css")
.attr("id", "usertheme")
.attr("href", theme)
.appendTo($("head"));
}
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
var source;
var respond = function(e) {
if(e.data == "cytube-syn") {
source = e.source;
Bugfixes for last commit - Fix race condition for login frame - Fix guest logins
2013-04-26 04:04:51 +00:00
source.postMessage("cytube-ack", document.location);
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
}
}
window.addEventListener("message", respond, false);
$("#login").click(function() {
Start updating to new API
2013-08-12 03:10:55 +00:00
var data = {
name: $("#username").val(),
pw: $("#pw").val()
};
Fixes
2013-08-18 19:21:42 +00:00
postJSON(WEB_URL+"/api/login", data, function (data) {
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
data.uname = $("#username").val();
source.postMessage("cytube-login:"+JSON.stringify(data), document.location);
Fixes
2013-08-18 19:21:42 +00:00
});
Implement new session system I replaced the old login system with a more secure one. Instead of storing cookies containing the username and plaintext password, the password is submitted once to obtain a session hash, which is valid for a given length of time. Registering and logging in is now done via an iframe, which prevents custom javascript from having access to the password field. Site admins need to run the following SQL before updating, or else all of your logins/registrations will fail: ALTER TABLE `registrations` ADD `session_hash` VARCHAR( 64 ) NOT NULL , ADD `expire` BIGINT NOT NULL
2013-04-26 03:50:12 +00:00
});
</script>
</body>
</html>