From d37bc94312f066615cf91cc2b8221c170492ada0 Mon Sep 17 00:00:00 2001 From: Adam Soltys Date: Thu, 6 Dec 2012 22:22:14 -0800 Subject: Users can only access their own pages --- app.coffee | 12 ++++++++---- passport.coffee | 2 +- routes/sessions.coffee | 4 ++++ 3 files changed, 13 insertions(+), 5 deletions(-) diff --git a/app.coffee b/app.coffee index a5c1ecdf..b86336a3 100644 --- a/app.coffee +++ b/app.coffee @@ -1,16 +1,13 @@ express = require('express') path = require('path') engines = require('consolidate') -passport = require('./passport').passport +passport = require('./passport') calculator = require("./routes/calculator") sessions = require("./routes/sessions")(passport) transactions = require("./routes/transactions") users = require("./routes/users") -authorize = (req, res, next) -> - return next() if req.isAuthenticated() - res.redirect('/login') app = express() app.enable('trust proxy') @@ -46,12 +43,19 @@ for route, view of routes ) )(route, view) +authorize = (req, res, next) -> + return next() if req.isAuthenticated() and + req.params.user is req.user.username or + req.user.username is 'admin' + res.redirect('/login') + app.get('/setup', calculator.new) app.get('/calculator', calculator.show) app.get('/ticker', calculator.ticker) app.get('/login', sessions.new) app.post('/login', sessions.create) +app.get('/logout', sessions.destroy) app.get('/:user.json', authorize, users.json) app.get('/:user', authorize, users.show) diff --git a/passport.coffee b/passport.coffee index 280117d1..05a4c68c 100644 --- a/passport.coffee +++ b/passport.coffee @@ -27,4 +27,4 @@ passport.use(new LocalStrategy( ) )) -exports.passport = passport +module.exports = passport diff --git a/routes/sessions.coffee b/routes/sessions.coffee index 631004ca..50719394 100644 --- a/routes/sessions.coffee +++ b/routes/sessions.coffee @@ -17,3 +17,7 @@ module.exports = (passport) -> return res.redirect('/' + user.username) ) )(req, res, next) + + destroy: (req, res) -> + req.logout() + res.redirect('/login') -- cgit v1.2.3