From cb187c880e7f418675ff0a14b01c171e4a20f868 Mon Sep 17 00:00:00 2001 From: Jascha Urbach Date: Wed, 16 Nov 2022 12:38:49 +0100 Subject: [PATCH 01/12] Quote ports in docker-compose Per sepcification in compose-file v3 ports are in quotes. https://docs.docker.com/compose/compose-file/compose-file-v3/ --- docker-compose.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index c654374b9..18647aea6 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -5,7 +5,7 @@ services: image: nginx:latest restart: unless-stopped ports: - - 1333:80 + - "1333:80" depends_on: - web networks: @@ -36,7 +36,7 @@ services: networks: - main ports: - - 8000 + - "8000" redis_activity: image: redis command: redis-server --requirepass ${REDIS_ACTIVITY_PASSWORD} --appendonly yes --port ${REDIS_ACTIVITY_PORT} From c29256708abe16e483a0e7af26ae9bbf101b19dd Mon Sep 17 00:00:00 2001 From: Jascha Urbach Date: Wed, 16 Nov 2022 20:30:06 +0100 Subject: [PATCH 02/12] show otp_secret when setting up 2fa solves #2389 --- bookwyrm/templates/preferences/2fa.html | 79 +++++++++++++++++++ bookwyrm/views/preferences/two_factor_auth.py | 9 ++- 2 files changed, 86 insertions(+), 2 deletions(-) diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html index b0703bc4a..397cf7d71 100644 --- a/bookwyrm/templates/preferences/2fa.html +++ b/bookwyrm/templates/preferences/2fa.html @@ -46,6 +46,58 @@
{{ qrcode | safe }}
+
+ + {{ form.otp }} + {% include 's{% extends 'preferences/layout.html' %} +{% load i18n %} + +{% block title %}{% trans "Two Factor Authentication" %}{% endblock %} + +{% block header %} +{% trans "Two Factor Authentication" %} +{% endblock %} + +{% block panel %} +
+ {% if success %} +
+ + + {% trans "Successfully updated 2FA settings" %} + +
+ {% endif %} + {% if backup_codes %} +
+

Backup codes

+
+

{% trans "Write down or copy and paste these codes somewhere safe." %}

+

{% trans "You must use them in order, and they will not be displayed again." %}

+
+
    + {% for code in backup_codes %} +
  • {{ code }}
    • + {% endfor%} +
+
+ {% elif request.user.two_factor_auth %} +
+

{% trans "Two Factor Authentication is active on your account." %}

+ {% trans "Disable 2FA" %} +
+
+

{% trans "You can generate backup codes to use in case you do not have access to your authentication app. If you generate new codes, any backup codes previously generated will no longer work." %}

+ {% trans "Generate backup codes" %} +
+ {% elif password_confirmed %} +
+ {% csrf_token %} +

{% trans "Scan the QR code with your authentication app and then enter the code from your app below to confirm your app is set up." %}

+
+
+
{{ qrcode | safe }}
+
{{ code | safe }}
{{ form.otp }} @@ -76,3 +128,30 @@ {% endif %}
{% endblock %} +nippets/form_errors.html' with errors_list=form.otp.errors id="desc_otp" %} +
+ +
+
+
+ {% else %} +

+ {% trans "You can make your account more secure by using Two Factor Authentication (2FA). This will require you to enter a one-time code using a phone app like Authy, Google Authenticator or Microsoft Authenticator each time you log in." %} +

+

{% trans "Confirm your password to begin setting up 2FA." %}

+
+
+
+ {% csrf_token %} +
+ + {{ form.password }} + {% include 'snippets/form_errors.html' with errors_list=form.password.errors id="desc_password" %} +
+ +
+
+
+ {% endif %} +
+{% endblock %} diff --git a/bookwyrm/views/preferences/two_factor_auth.py b/bookwyrm/views/preferences/two_factor_auth.py index f3b04eb3c..192cdaff7 100644 --- a/bookwyrm/views/preferences/two_factor_auth.py +++ b/bookwyrm/views/preferences/two_factor_auth.py @@ -35,10 +35,12 @@ class Edit2FA(View): if not form.is_valid(): data = {"form": form} return TemplateResponse(request, "preferences/2fa.html", data) + data = self.create_qr_code(request.user) qr_form = forms.Confirm2FAForm() data = { "password_confirmed": True, - "qrcode": self.create_qr_code(request.user), + "qrcode": data[0], + "code": data[1], "form": qr_form, } return TemplateResponse(request, "preferences/2fa.html", data) @@ -57,7 +59,10 @@ class Edit2FA(View): qr_code.add_data(provisioning_url) qr_code.make(fit=True) img = qr_code.make_image(attrib={"fill": "black"}) - return str(img.to_string(), "utf-8") # to_string() returns a byte string + return [ + str(img.to_string(), "utf-8"), + otp_secret, + ] # to_string() returns a byte string @method_decorator(login_required, name="dispatch") From a98dbb97a5d80507cc85622b202ed98b536ee8c9 Mon Sep 17 00:00:00 2001 From: Jascha Urbach Date: Wed, 16 Nov 2022 20:32:40 +0100 Subject: [PATCH 03/12] fix error fix my copy paste error -.- --- bookwyrm/templates/preferences/2fa.html | 78 ------------------------- 1 file changed, 78 deletions(-) diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html index 397cf7d71..9d58d7cc1 100644 --- a/bookwyrm/templates/preferences/2fa.html +++ b/bookwyrm/templates/preferences/2fa.html @@ -7,57 +7,6 @@ {% trans "Two Factor Authentication" %} {% endblock %} -{% block panel %} -
- {% if success %} -
- - - {% trans "Successfully updated 2FA settings" %} - -
- {% endif %} - {% if backup_codes %} -
-

Backup codes

-
-

{% trans "Write down or copy and paste these codes somewhere safe." %}

-

{% trans "You must use them in order, and they will not be displayed again." %}

-
-
    - {% for code in backup_codes %} -
  • {{ code }}
    • - {% endfor%} -
-
- {% elif request.user.two_factor_auth %} -
-

{% trans "Two Factor Authentication is active on your account." %}

- {% trans "Disable 2FA" %} -
-
-

{% trans "You can generate backup codes to use in case you do not have access to your authentication app. If you generate new codes, any backup codes previously generated will no longer work." %}

- {% trans "Generate backup codes" %} -
- {% elif password_confirmed %} -
- {% csrf_token %} -

{% trans "Scan the QR code with your authentication app and then enter the code from your app below to confirm your app is set up." %}

-
-
-
{{ qrcode | safe }}
-
- - {{ form.otp }} - {% include 's{% extends 'preferences/layout.html' %} -{% load i18n %} - -{% block title %}{% trans "Two Factor Authentication" %}{% endblock %} - -{% block header %} -{% trans "Two Factor Authentication" %} -{% endblock %} - {% block panel %}
{% if success %} @@ -128,30 +77,3 @@ {% endif %}
{% endblock %} -nippets/form_errors.html' with errors_list=form.otp.errors id="desc_otp" %} -
- -
-
-
- {% else %} -

- {% trans "You can make your account more secure by using Two Factor Authentication (2FA). This will require you to enter a one-time code using a phone app like Authy, Google Authenticator or Microsoft Authenticator each time you log in." %} -

-

{% trans "Confirm your password to begin setting up 2FA." %}

-
-
-
- {% csrf_token %} -
- - {{ form.password }} - {% include 'snippets/form_errors.html' with errors_list=form.password.errors id="desc_password" %} -
- -
-
-
- {% endif %} -
-{% endblock %} From 170aa7460aab37d79dc3e11978a44e49a9d3a102 Mon Sep 17 00:00:00 2001 From: Jascha Urbach Date: Wed, 16 Nov 2022 20:35:28 +0100 Subject: [PATCH 04/12] Update 2fa.html Or now, because obviously I can not write HTML^^ --- bookwyrm/templates/preferences/2fa.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html index 9d58d7cc1..b6bce604f 100644 --- a/bookwyrm/templates/preferences/2fa.html +++ b/bookwyrm/templates/preferences/2fa.html @@ -46,7 +46,7 @@
{{ qrcode | safe }}
-
{{ code | safe }} +
{{ code | safe }}
{{ form.otp }} From c5fb710f29095534c905efbedc048768eee20c26 Mon Sep 17 00:00:00 2001 From: Mouse Reeve Date: Fri, 18 Nov 2022 08:23:53 -0800 Subject: [PATCH 05/12] Fixes code of conduct link --- bookwyrm/templates/snippets/footer.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bookwyrm/templates/snippets/footer.html b/bookwyrm/templates/snippets/footer.html index eacb6d6b7..77be88bfe 100644 --- a/bookwyrm/templates/snippets/footer.html +++ b/bookwyrm/templates/snippets/footer.html @@ -24,7 +24,7 @@

- {% trans "Code of Conduct" %} + {% trans "Code of Conduct" %}

{% trans "Privacy Policy" %} From c7ac936a9a7fd272d40639001f8a7c10e539066f Mon Sep 17 00:00:00 2001 From: Henry <64515030+henryistaken@users.noreply.github.com> Date: Fri, 18 Nov 2022 23:24:18 -0800 Subject: [PATCH 06/12] Fix Quick Typo --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 558d42d45..f8b2eb1f6 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ Keep track of what books you've read, and what books you'd like to read in the f Federation allows you to interact with users on other instances and services, and also shares metadata about books and authors, which collaboratively builds a decentralized database of books. ### Privacy and moderation -Users and administrators can control who can see thier posts and what other instances to federate with. +Users and administrators can control who can see their posts and what other instances to federate with. ## Tech Stack Web backend From e11811d461f078ea8170a9dcb569d55747aaba96 Mon Sep 17 00:00:00 2001 From: Mouse Reeve Date: Sat, 19 Nov 2022 09:48:44 -0800 Subject: [PATCH 07/12] Fancier UI around OTP codes --- bookwyrm/templates/preferences/2fa.html | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html index b6bce604f..10de2993f 100644 --- a/bookwyrm/templates/preferences/2fa.html +++ b/bookwyrm/templates/preferences/2fa.html @@ -46,7 +46,29 @@

{{ qrcode | safe }}
-
{{ code | safe }}
+
+ + + {% trans "Use setup key" %} + + + +
+
+ {% trans "Account name:" %} +
+
+ {{ user.username }} +
+ +
+ {% trans "Code:" %} +
+
+ {{ code | safe }} +
+
+
{{ form.otp }} From 6baa58260ab841088c3c721a01fb0319825a28f8 Mon Sep 17 00:00:00 2001 From: Hugh Rundle Date: Sun, 20 Nov 2022 04:51:18 +1100 Subject: [PATCH 08/12] 2fa qrcode fixes (#2407) * 2fa qrcode fixes - add light background to qr code when using dark theme - show OTP secret code under qr code for manual entry on apps if required fixes #2386 fixes #2389 * fix code formatting * revert changes re visible code This conflicts with an existing PR. * i code pretty --- bookwyrm/static/css/themes/bookwyrm-dark.scss | 4 ++++ bookwyrm/templates/preferences/2fa.html | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/bookwyrm/static/css/themes/bookwyrm-dark.scss b/bookwyrm/static/css/themes/bookwyrm-dark.scss index a2eb94efb..b98422688 100644 --- a/bookwyrm/static/css/themes/bookwyrm-dark.scss +++ b/bookwyrm/static/css/themes/bookwyrm-dark.scss @@ -92,6 +92,10 @@ $family-secondary: $family-sans-serif; color: $grey-light !important; } +#qrcode svg { + background-color: #a6a6a6; +} + @import "../bookwyrm.scss"; @import "../vendor/icons.css"; @import "../vendor/shepherd.scss"; diff --git a/bookwyrm/templates/preferences/2fa.html b/bookwyrm/templates/preferences/2fa.html index b0703bc4a..29a011380 100644 --- a/bookwyrm/templates/preferences/2fa.html +++ b/bookwyrm/templates/preferences/2fa.html @@ -45,7 +45,7 @@

{% trans "Scan the QR code with your authentication app and then enter the code from your app below to confirm your app is set up." %}

-
{{ qrcode | safe }}
+
{{ qrcode | safe }}
{{ form.otp }} From 7d51a69c7118badadc126240b611a155f19c86d4 Mon Sep 17 00:00:00 2001 From: Mouse Reeve Date: Sat, 19 Nov 2022 10:03:40 -0800 Subject: [PATCH 09/12] Expand robots.txt --- bookwyrm/templates/robots.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/bookwyrm/templates/robots.txt b/bookwyrm/templates/robots.txt index a328b6e90..4aa091277 100644 --- a/bookwyrm/templates/robots.txt +++ b/bookwyrm/templates/robots.txt @@ -73,6 +73,14 @@ User-agent: PetalBot Disallow: / +User-agent: DataForSeoBot +Disallow: / + +User-agent: YisouSpider +Disallow: / + + User-agent: * +Crawl-delay: 10 Disallow: /static/js/ Disallow: /static/css/ From cc3cd5c98c72ee1a381df3f48a2b6e4e682bab37 Mon Sep 17 00:00:00 2001 From: Mouse Reeve Date: Sun, 20 Nov 2022 19:39:08 -0800 Subject: [PATCH 10/12] Don't use task for password reset emails --- bookwyrm/emailing.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bookwyrm/emailing.py b/bookwyrm/emailing.py index 80aacf7f4..03cf4772e 100644 --- a/bookwyrm/emailing.py +++ b/bookwyrm/emailing.py @@ -38,7 +38,7 @@ def password_reset_email(reset_code): data = email_data() data["reset_link"] = reset_code.link data["user"] = reset_code.user.display_name - send_email.delay(reset_code.user.email, *format_email("password_reset", data)) + send_email(reset_code.user.email, *format_email("password_reset", data)) def moderation_report_email(report): From 55bab0b70d4dd0f370b3105b4ec729010ad2183d Mon Sep 17 00:00:00 2001 From: Joel Bradshaw Date: Wed, 23 Nov 2022 19:26:09 +0000 Subject: [PATCH 11/12] Slice queryset before we resolve it This was accidentally querying ALL books in the database to generate suggestions if we didn't have enough, which broke some stuff --- bookwyrm/views/list/list.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bookwyrm/views/list/list.py b/bookwyrm/views/list/list.py index 3797997a9..1adf7a679 100644 --- a/bookwyrm/views/list/list.py +++ b/bookwyrm/views/list/list.py @@ -110,8 +110,8 @@ def get_list_suggestions(book_list, user, query=None): s.default_edition for s in models.Work.objects.filter( ~Q(editions__in=book_list.books.all()), - ).order_by("-updated_date") - ][: 5 - len(suggestions)] + ).order_by("-updated_date")[: 5 - len(suggestions)] + ] return suggestions From dd83e32f32a141c4484861aaf2f82a45b30c474c Mon Sep 17 00:00:00 2001 From: Mouse Reeve Date: Wed, 23 Nov 2022 22:00:34 -0800 Subject: [PATCH 12/12] Fixes unit test --- bookwyrm/tests/test_emailing.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bookwyrm/tests/test_emailing.py b/bookwyrm/tests/test_emailing.py index ecfbd9448..b2af59f4f 100644 --- a/bookwyrm/tests/test_emailing.py +++ b/bookwyrm/tests/test_emailing.py @@ -11,6 +11,7 @@ from bookwyrm import emailing, models class Emailing(TestCase): """every response to a get request, html or json""" + # pylint: disable=invalid-name def setUp(self): """we need basic test data and mocks""" self.factory = RequestFactory() @@ -41,10 +42,12 @@ class Emailing(TestCase): self.assertEqual(args[1], "You're invited to join BookWyrm!") self.assertEqual(len(args), 4) - def test_password_reset_email(self, email_mock): + def test_password_reset_email(self, _): """load the password reset email""" reset = models.PasswordReset.objects.create(user=self.local_user) - emailing.password_reset_email(reset) + + with patch("bookwyrm.emailing.send_email") as email_mock: + emailing.password_reset_email(reset) self.assertEqual(email_mock.call_count, 1) args = email_mock.call_args[0]