diff --git a/src/oauth2views/login.ejs b/src/oauth2views/login.ejs index 42ed43a24..45849aa84 100644 --- a/src/oauth2views/login.ejs +++ b/src/oauth2views/login.ejs @@ -37,7 +37,7 @@ - Reset password + Reset password diff --git a/src/oauth2views/password_reset.ejs b/src/oauth2views/password_reset.ejs deleted file mode 100644 index 39f57897b..000000000 --- a/src/oauth2views/password_reset.ejs +++ /dev/null @@ -1,53 +0,0 @@ -<% include header %> - - - - - -
- -
-

Hello <%= user.username %>, set a new password

-
- -
- -
-
-
-
- - - - - -
- -
- Password must be atleast 8 characters -
- -
-
- -
- Passwords don't match -
- -
- -
-
-
-
-
- -<% include footer %> diff --git a/src/oauth2views/password_reset_request.ejs b/src/oauth2views/password_reset_request.ejs deleted file mode 100644 index 59e49ecb9..000000000 --- a/src/oauth2views/password_reset_request.ejs +++ /dev/null @@ -1,30 +0,0 @@ -<% include header %> - - - -
- -
-

Reset password

-
- -
- -
-
-
-
- -
- - -
- -
- Login -
-
-
-
- -<% include footer %> diff --git a/src/oauth2views/password_reset_sent.ejs b/src/oauth2views/password_reset_sent.ejs deleted file mode 100644 index a2a7fd091..000000000 --- a/src/oauth2views/password_reset_sent.ejs +++ /dev/null @@ -1,25 +0,0 @@ -<% include header %> - - - -
- -
-

Password reset successful

-
- -
- -
-
-
-

An email was sent to you with a link to set a new password.

-
-
- If you have not received any email, simply try again. -
-
-
-
- -<% include footer %> diff --git a/src/routes/oauth2.js b/src/routes/oauth2.js index a14fe5116..2237cce30 100644 --- a/src/routes/oauth2.js +++ b/src/routes/oauth2.js @@ -7,11 +7,6 @@ exports = module.exports = { login: login, logout: logout, sessionCallback: sessionCallback, - passwordResetRequestSite: passwordResetRequestSite, - passwordResetRequest: passwordResetRequest, - passwordSentSite: passwordSentSite, - passwordResetSite: passwordResetSite, - passwordReset: passwordReset, accountSetupSite: accountSetupSite, accountSetup: accountSetup, authorization: authorization, @@ -317,41 +312,6 @@ function logout(req, res) { }); } -// Form to enter email address to send a password reset request mail -// -> GET /api/v1/session/password/resetRequest.html -function passwordResetRequestSite(req, res) { - var data = { - csrf: req.csrfToken(), - title: 'Password Reset' - }; - - renderTemplate(res, 'password_reset_request', data); -} - -// This route is used for above form submission -// -> POST /api/v1/session/password/resetRequest -function passwordResetRequest(req, res, next) { - assert.strictEqual(typeof req.body, 'object'); - - if (typeof req.body.identifier !== 'string') return next(new HttpError(400, 'Missing identifier')); // email or username - - debug('passwordResetRequest: email or username %s.', req.body.identifier); - - users.resetPasswordByIdentifier(req.body.identifier, function (error) { - if (error && error.reason !== BoxError.NOT_FOUND) { - console.error(error); - return sendErrorPageOrRedirect(req, res, 'User not found'); - } - - res.redirect('/api/v1/session/password/sent.html'); - }); -} - -// -> GET /api/v1/session/password/sent.html -function passwordSentSite(req, res) { - renderTemplate(res, 'password_reset_sent', { title: 'Cloudron Password Reset' }); -} - function renderAccountSetupSite(res, req, userObject, error) { renderTemplate(res, 'account_setup', { user: userObject, @@ -414,54 +374,6 @@ function accountSetup(req, res, next) { }); } -// -> GET /api/v1/session/password/reset.html -function passwordResetSite(req, res, next) { - if (!req.query.email) return next(new HttpError(400, 'Missing email')); - if (!req.query.reset_token) return next(new HttpError(400, 'Missing reset_token')); - - users.getByResetToken(req.query.reset_token, function (error, user) { - if (error) return next(new HttpError(401, 'Invalid email or reset token')); - - renderTemplate(res, 'password_reset', { - user: user, - csrf: req.csrfToken(), - resetToken: req.query.reset_token, - email: req.query.email, - title: 'Password Reset' - }); - }); -} - -// -> POST /api/v1/session/password/reset -function passwordReset(req, res, next) { - assert.strictEqual(typeof req.body, 'object'); - - if (typeof req.body.email !== 'string') return next(new HttpError(400, 'Missing email')); - if (typeof req.body.resetToken !== 'string') return next(new HttpError(400, 'Missing resetToken')); - if (typeof req.body.password !== 'string') return next(new HttpError(400, 'Missing password')); - - debug(`passwordReset: for ${req.body.email} with token ${req.body.resetToken}`); - - users.getByResetToken(req.body.resetToken, function (error, userObject) { - if (error) return next(new HttpError(401, 'Invalid email or resetToken')); - - if (!userObject.username) return next(new HttpError(401, 'No username set')); - - // setPassword clears the resetToken - users.setPassword(userObject.id, req.body.password, function (error) { - if (error && error.reason === BoxError.BAD_FIELD) return next(new HttpError(406, error.message)); - if (error) return next(new HttpError(500, error)); - - clients.addTokenByUserId('cid-webadmin', userObject.id, Date.now() + constants.DEFAULT_TOKEN_EXPIRATION, {}, function (error, result) { - if (error) return next(new HttpError(500, error)); - - res.redirect(`${settings.adminOrigin()}?accessToken=${result.accessToken}&expiresAt=${result.expires}`); - }); - }); - }); -} - - // The callback page takes the redirectURI and the authCode and redirects the browser accordingly // // -> GET /api/v1/session/callback diff --git a/src/server.js b/src/server.js index 496069911..f69e5ed4b 100644 --- a/src/server.js +++ b/src/server.js @@ -227,11 +227,6 @@ function initializeExpressSync() { router.post('/api/v1/session/login', csrf, routes.oauth2.login); router.get ('/api/v1/session/logout', routes.oauth2.logout); router.get ('/api/v1/session/callback', routes.oauth2.sessionCallback()); - router.get ('/api/v1/session/password/resetRequest.html', csrf, routes.oauth2.passwordResetRequestSite); - router.post('/api/v1/session/password/resetRequest', csrf, routes.oauth2.passwordResetRequest); - router.get ('/api/v1/session/password/sent.html', routes.oauth2.passwordSentSite); - router.get ('/api/v1/session/password/reset.html', csrf, routes.oauth2.passwordResetSite); - router.post('/api/v1/session/password/reset', csrf, routes.oauth2.passwordReset); router.get ('/api/v1/session/account/setup.html', csrf, routes.oauth2.accountSetupSite); router.post('/api/v1/session/account/setup', csrf, routes.oauth2.accountSetup);