snipette/snipette-crowdfunding-site
snipette/snipette-crowdfunding-site
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Make compatible serialisers on script import

Browse source 
The new make_serialiser function allows you to import things to a
separate script and still use the standard secret key when making
serialisers.

During the process, we also realised we weren't salting values
properly, so thankfully that's been fixed! :P
This commit is contained in:
Badri Sunderarajan 2023-03-12 14:09:23 +05:30
parent 11cefdada0
commit 295147ae86
1 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
server/index.js
View file

@ -15,7 +15,7 @@ if (process.env.DEBUG || process.env.CROWDFUNDING_SITE_DEBUG) {
DEBUG = false DEBUG = false
} }
if (DEBUG) console.log('Starting website in debug mode') if (DEBUG) console.log('Loading website in debug mode')
// set up secret key // set up secret key
let secretKey let secretKey
@ -31,6 +31,11 @@ if (process.env.CROWDFUNDING_SITE_SECRET_KEY) {
} }
} }
// helper function to make the serialiser
function makeSerialiser(value) {
return URLSafeTimedSerializer(secretKey, {salt: value})
}
// set up nodemailer (if configured) // set up nodemailer (if configured)
let mailer let mailer
let emailFrom let emailFrom
@ -490,7 +495,7 @@ router.post('/pledge', async (req, res) => {
} }
// generate verification link // generate verification link
let serialiser = URLSafeTimedSerializer(secretKey, pledge.get('email')) let serialiser = makeSerialiser(pledge.get('email'))
let verificationLink = `${req.protocol}://${req.hostname}/verify?email=${encodeURIComponent(pledge.get('email'))}&key=${encodeURIComponent(serialiser.dumps(pledge.get('amount')))}` let verificationLink = `${req.protocol}://${req.hostname}/verify?email=${encodeURIComponent(pledge.get('email'))}&key=${encodeURIComponent(serialiser.dumps(pledge.get('amount')))}`
// send out the email, along with existing pledge deets // send out the email, along with existing pledge deets
@ -528,7 +533,7 @@ router.get('/verify', async (req, res) => {
if (DEBUG) console.debug('Validating pledge:', req.query) if (DEBUG) console.debug('Validating pledge:', req.query)
// unpack verification link (unless it's expired) // unpack verification link (unless it's expired)
let serialiser = URLSafeTimedSerializer(secretKey, req.query.email) let serialiser = makeSerialiser(req.query.email)
let amount let amount
try { try {
@ -746,4 +751,5 @@ module.exports = {
Pledge, Pledge,
UnverifiedPledge, UnverifiedPledge,
router, router,
makeSerialiser,
} }