From 4420df6e5d15fa95084471395cb3892f1698e52b Mon Sep 17 00:00:00 2001 From: James Cole Date: Sun, 25 Nov 2018 11:31:02 +0100 Subject: [PATCH] New views for password reset, login and other user forms. --- .../Auth/ForgotPasswordController.php | 3 +- .../Controllers/Auth/RegisterController.php | 7 +- .../Auth/ResetPasswordController.php | 18 ++- app/Services/Password/PwndVerifierV2.php | 2 +- .../Http/Controllers/RequestInformation.php | 2 +- resources/lang/en_US/firefly.php | 17 +-- resources/lang/en_US/validation.php | 2 +- .../views/v1/partials/password-modal.twig | 14 +-- resources/views/v2/auth/login.twig | 73 ++++++------ resources/views/v2/auth/passwords/email.twig | 62 +++++++++++ resources/views/v2/auth/passwords/reset.twig | 105 ++++++++++++++++++ resources/views/v2/auth/register.twig | 78 +++++++++++++ .../v2/emails/access-token-created-html.twig | 13 +++ .../v2/emails/access-token-created-text.twig | 7 ++ .../views/v2/emails/admin-test-html.twig | 5 + .../views/v2/emails/admin-test-text.twig | 3 + .../views/v2/emails/confirm-account-html.twig | 20 ++++ .../views/v2/emails/confirm-account-text.twig | 11 ++ .../v2/emails/confirm-email-change-html.twig | 18 +++ .../v2/emails/confirm-email-change-text.twig | 9 ++ resources/views/v2/emails/error-html.twig | 47 ++++++++ resources/views/v2/emails/error-text.twig | 31 ++++++ resources/views/v2/emails/footer-html.twig | 13 +++ resources/views/v2/emails/footer-text.twig | 6 + resources/views/v2/emails/header-html.twig | 10 ++ resources/views/v2/emails/header-text.twig | 2 + .../v2/emails/oauth-client-created-html.twig | 14 +++ .../v2/emails/oauth-client-created-text.twig | 9 ++ resources/views/v2/emails/password-html.twig | 13 +++ resources/views/v2/emails/password-text.twig | 7 ++ .../views/v2/emails/registered-html.twig | 18 +++ .../views/v2/emails/registered-text.twig | 20 ++++ .../v2/emails/report-new-journals-html.twig | 34 ++++++ .../v2/emails/report-new-journals-text.twig | 25 +++++ .../v2/emails/undo-email-change-html.twig | 18 +++ .../v2/emails/undo-email-change-text.twig | 12 ++ resources/views/v2/error.twig | 35 ++++++ resources/views/v2/layout/auth.twig | 29 +++++ resources/views/v2/layout/default.twig | 14 +-- resources/views/v2/partials/favicons.twig | 7 +- .../views/v2/partials/password_modal.twig | 35 ++++++ 41 files changed, 792 insertions(+), 76 deletions(-) create mode 100644 resources/views/v2/auth/passwords/email.twig create mode 100644 resources/views/v2/auth/passwords/reset.twig create mode 100644 resources/views/v2/auth/register.twig create mode 100644 resources/views/v2/emails/access-token-created-html.twig create mode 100644 resources/views/v2/emails/access-token-created-text.twig create mode 100644 resources/views/v2/emails/admin-test-html.twig create mode 100644 resources/views/v2/emails/admin-test-text.twig create mode 100644 resources/views/v2/emails/confirm-account-html.twig create mode 100644 resources/views/v2/emails/confirm-account-text.twig create mode 100644 resources/views/v2/emails/confirm-email-change-html.twig create mode 100644 resources/views/v2/emails/confirm-email-change-text.twig create mode 100644 resources/views/v2/emails/error-html.twig create mode 100644 resources/views/v2/emails/error-text.twig create mode 100644 resources/views/v2/emails/footer-html.twig create mode 100644 resources/views/v2/emails/footer-text.twig create mode 100644 resources/views/v2/emails/header-html.twig create mode 100644 resources/views/v2/emails/header-text.twig create mode 100644 resources/views/v2/emails/oauth-client-created-html.twig create mode 100644 resources/views/v2/emails/oauth-client-created-text.twig create mode 100644 resources/views/v2/emails/password-html.twig create mode 100644 resources/views/v2/emails/password-text.twig create mode 100644 resources/views/v2/emails/registered-html.twig create mode 100644 resources/views/v2/emails/registered-text.twig create mode 100644 resources/views/v2/emails/report-new-journals-html.twig create mode 100644 resources/views/v2/emails/report-new-journals-text.twig create mode 100644 resources/views/v2/emails/undo-email-change-html.twig create mode 100644 resources/views/v2/emails/undo-email-change-text.twig create mode 100644 resources/views/v2/error.twig create mode 100644 resources/views/v2/partials/password_modal.twig diff --git a/app/Http/Controllers/Auth/ForgotPasswordController.php b/app/Http/Controllers/Auth/ForgotPasswordController.php index c8fe3b60fe..f950b0a99b 100644 --- a/app/Http/Controllers/Auth/ForgotPasswordController.php +++ b/app/Http/Controllers/Auth/ForgotPasswordController.php @@ -109,10 +109,11 @@ class ForgotPasswordController extends Controller $singleUserMode = FireflyConfig::get('single_user_mode', config('firefly.configuration.single_user_mode'))->data; $userCount = User::count(); $allowRegistration = true; + $pageTitle = (string)trans('firefly.forgot_pw_page_title'); if (true === $singleUserMode && $userCount > 0) { $allowRegistration = false; } - return view('auth.passwords.email')->with(compact('allowRegistration')); + return view('auth.passwords.email')->with(compact('allowRegistration', 'pageTitle')); } } diff --git a/app/Http/Controllers/Auth/RegisterController.php b/app/Http/Controllers/Auth/RegisterController.php index 0f09de03b4..fec1f10e5a 100644 --- a/app/Http/Controllers/Auth/RegisterController.php +++ b/app/Http/Controllers/Auth/RegisterController.php @@ -72,7 +72,7 @@ class RegisterController extends Controller { // is allowed to? $allowRegistration = true; - $loginProvider = envNonEmpty('LOGIN_PROVIDER','eloquent'); + $loginProvider = envNonEmpty('LOGIN_PROVIDER', 'eloquent'); $singleUserMode = FireflyConfig::get('single_user_mode', config('firefly.configuration.single_user_mode'))->data; $userCount = User::count(); if (true === $singleUserMode && $userCount > 0 && 'eloquent' === $loginProvider) { @@ -113,10 +113,11 @@ class RegisterController extends Controller public function showRegistrationForm(Request $request) { $allowRegistration = true; - $loginProvider = envNonEmpty('LOGIN_PROVIDER','eloquent'); + $loginProvider = envNonEmpty('LOGIN_PROVIDER', 'eloquent'); $isDemoSite = FireflyConfig::get('is_demo_site', config('firefly.configuration.is_demo_site'))->data; $singleUserMode = FireflyConfig::get('single_user_mode', config('firefly.configuration.single_user_mode'))->data; $userCount = User::count(); + $pageTitle = (string)trans('firefly.register_page_title'); if (true === $isDemoSite) { $allowRegistration = false; @@ -138,7 +139,7 @@ class RegisterController extends Controller $email = $request->old('email'); - return view('auth.register', compact('isDemoSite', 'email')); + return view('auth.register', compact('isDemoSite', 'email', 'pageTitle')); } } diff --git a/app/Http/Controllers/Auth/ResetPasswordController.php b/app/Http/Controllers/Auth/ResetPasswordController.php index a54db5b1a6..fc420866e5 100644 --- a/app/Http/Controllers/Auth/ResetPasswordController.php +++ b/app/Http/Controllers/Auth/ResetPasswordController.php @@ -78,18 +78,18 @@ class ResetPasswordController extends Controller return view('error', compact('message')); } - // is allowed to register? $singleUserMode = FireflyConfig::get('single_user_mode', config('firefly.configuration.single_user_mode'))->data; $userCount = User::count(); $allowRegistration = true; + $pageTitle = (string)trans('firefly.reset_pw_page_title'); if (true === $singleUserMode && $userCount > 0) { $allowRegistration = false; } /** @noinspection PhpUndefinedFieldInspection */ return view('auth.passwords.reset')->with( - ['token' => $token, 'email' => $request->email, 'allowRegistration' => $allowRegistration] + ['token' => $token, 'email' => $request->email, 'allowRegistration' => $allowRegistration,'pageTitle' => $pageTitle] ); } @@ -129,5 +129,17 @@ class ResetPasswordController extends Controller : $this->sendResetFailedResponse($request, $response); } - + /** + * Get the password reset validation rules. + * + * @return array + */ + protected function rules() + { + return [ + 'token' => 'required', + 'email' => 'required|email', + 'password' => 'required|confirmed|min:6|secure_password', + ]; + } } diff --git a/app/Services/Password/PwndVerifierV2.php b/app/Services/Password/PwndVerifierV2.php index 156d2f8b17..a5727ca004 100644 --- a/app/Services/Password/PwndVerifierV2.php +++ b/app/Services/Password/PwndVerifierV2.php @@ -58,7 +58,7 @@ class PwndVerifierV2 implements Verifier $uri = sprintf('https://api.pwnedpasswords.com/range/%s', $prefix); $opt = [ 'headers' => ['User-Agent' => 'Firefly III v' . config('firefly.version')], - 'timeout' => 2]; + 'timeout' => 5]; Log::debug(sprintf('hash prefix is %s', $prefix)); Log::debug(sprintf('rest is %s', $rest)); diff --git a/app/Support/Http/Controllers/RequestInformation.php b/app/Support/Http/Controllers/RequestInformation.php index 01c561f731..76004eddfa 100644 --- a/app/Support/Http/Controllers/RequestInformation.php +++ b/app/Support/Http/Controllers/RequestInformation.php @@ -394,7 +394,7 @@ trait RequestInformation $data, [ 'email' => 'required|string|email|max:255|unique:users', - 'password' => 'required|string|secure_password|confirmed', + 'password' => 'required|string|min:6|secure_password|confirmed', ] ); } diff --git a/resources/lang/en_US/firefly.php b/resources/lang/en_US/firefly.php index 58ef7a4455..77df14cb97 100644 --- a/resources/lang/en_US/firefly.php +++ b/resources/lang/en_US/firefly.php @@ -177,6 +177,10 @@ return [ 'reset_button' => 'Reset', 'want_to_login' => 'I want to login', 'login_page_title' => 'Login to Firefly III', + 'register_page_title' => 'Register at Firefly III', + 'forgot_pw_page_title' => 'Forgot your password for Firefly III', + 'reset_pw_page_title' => 'Reset your password for Firefly III', + 'cannot_reset_demo_user' => 'You cannot reset the password of the demo user.', 'button_register' => 'Register', 'authorization' => 'Authorization', 'active_bills_only' => 'active bills only', @@ -535,14 +539,13 @@ return [ 'invalid_password' => 'Invalid password!', 'what_is_pw_security' => 'What is "verify password security"?', 'secure_pw_title' => 'How to choose a secure password', - 'secure_pw_history' => 'In August 2017 well known security researcher Troy Hunt released a list of 306 million stolen passwords. These passwords were stolen during breakins at companies like LinkedIn, Adobe and NeoPets (and many more).', - 'secure_pw_check_box' => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to the website of Troy Hunt to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest NIST Special Publication on this subject.', - 'secure_pw_sha1' => 'But I thought SHA1 was broken?', - 'secure_pw_hash_speed' => 'Yes, but not in this context. As you can read on the website detailing how they broke SHA1, it is now slightly easier to find a "collision": another digest that results in the same SHA1-hash. It now only takes 10,000 years using a single-GPU machine.', - 'secure_pw_hash_security' => 'This digest would not be equal to your password, nor would it be useful on (a site like) Firefly III. This application does not use SHA1 for password verification. So it is safe to check this box. Your password is hashed and only the first five characters of this digest are sent over HTTPS.', + 'secure_pw_history' => 'Not a week goes by that you read in the news about a site losing the passwords of its users. Hackers and thieves use these passwords to try to steal your private information. This information is valuable.', + 'secure_pw_ff' => 'Do you use the same password all over the internet? If one site loses your password, hackers have access to all your data. Firefly III relies on you to choose a strong and unique password to protect your financial records.', + 'secure_pw_check_box' => 'To help you do that Firefly III can check if the password you want to use has been stolen in the past. If this is the case, Firefly III advises you NOT to use that password.', + 'secure_pw_working_title' => 'How does it work?', + 'secure_pw_working' => 'By checking the box, Firefly III will send the first five characters of the SHA1 hash of your password to the website of Troy Hunt to see if it is on the list. This will stop you from using unsafe passwords as is recommended in the latest NIST Special Publication on this subject.', 'secure_pw_should' => 'Should I check the box?', - 'secure_pw_long_password' => 'If you just generated a long, single-use password for Firefly III using some kind of password generator: no.', - 'secure_pw_short' => 'If you just entered the password you always use: Please yes.', + 'secure_pw_long_password' => 'Yes. Always verify your password is safe.', 'command_line_token' => 'Command line token', 'explain_command_line_token' => 'You need this token to perform command line options, such as importing or exporting data. Without it, such sensitive commands will not work. Do not share your command line token. Nobody will ask you for this token, not even me. If you fear you lost this, or when you\'re paranoid, regenerate this token using the button.', 'regenerate_command_line_token' => 'Regenerate command line token', diff --git a/resources/lang/en_US/validation.php b/resources/lang/en_US/validation.php index 9f8f7b9d50..f1aff6e459 100644 --- a/resources/lang/en_US/validation.php +++ b/resources/lang/en_US/validation.php @@ -123,7 +123,7 @@ return [ 'present' => 'The :attribute field must be present.', 'amount_zero' => 'The total amount cannot be zero.', 'unique_piggy_bank_for_user' => 'The name of the piggy bank must be unique.', - 'secure_password' => 'This is not a secure password. Please try again. For more information, visit http://bit.ly/FF3-password-security.', + 'secure_password' => 'This is not a secure password. Please try again. For more information, visit https://bit.ly/FF3-password-security', 'valid_recurrence_rep_type' => 'Invalid repetition type for recurring transactions.', 'valid_recurrence_rep_moment' => 'Invalid repetition moment for this type of repetition.', 'invalid_account_info' => 'Invalid account information.', diff --git a/resources/views/v1/partials/password-modal.twig b/resources/views/v1/partials/password-modal.twig index 8237612199..cdb8c48654 100644 --- a/resources/views/v1/partials/password-modal.twig +++ b/resources/views/v1/partials/password-modal.twig @@ -11,23 +11,21 @@

{{ 'secure_pw_history'|_ }}

+

+ {{ 'secure_pw_ff'|_ }} +

{{ 'secure_pw_check_box'|_ }}

-

{{ 'secure_pw_sha1'|_ }}

+ +

{{ 'secure_pw_working_title'|_ }}

- {{ 'secure_pw_hash_speed'|_ }} -

-

- {{ 'secure_pw_hash_security'|_ }} + {{ 'secure_pw_working'|_ }}

{{ 'secure_pw_should'|_ }}

{{ 'secure_pw_long_password'|_ }}

-

- {{ 'secure_pw_short'|_ }} -