vw_small

commit 0718a090e1b008b53da0d8a97854ff531f5248dc
parent 9e1f030a80b97288090827113f80f609f3bec0db
Author: Daniel García <dani-garcia@users.noreply.github.com>
Date:   Thu,  7 Mar 2019 20:21:50 +0100

Trim spaces from admin token during authentication and validate that the admin panel token is not empty

Diffstat:
M
src/api/admin.rs
 | 
2
+-
M
src/config.rs
 | 
6
++++++

2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/src/api/admin.rs b/src/api/admin.rs
@@ -89,7 +89,7 @@ fn post_admin_login(data: Form<LoginForm>, mut cookies: Cookies, ip: ClientIp) -
 fn _validate_token(token: &str) -> bool {
     match CONFIG.admin_token().as_ref() {
         None => false,
-        Some(t) => crate::crypto::ct_eq(t, token),
+        Some(t) => crate::crypto::ct_eq(t.trim(), token.trim()),
     }
 }
 
diff --git a/src/config.rs b/src/config.rs
@@ -317,6 +317,12 @@ make_config! {
 }
 
 fn validate_config(cfg: &ConfigItems) -> Result<(), Error> {
+    if let Some(ref token) = cfg.admin_token {
+        if token.trim().is_empty() {
+            err!("`ADMIN_TOKEN` is enabled but has an empty value. To enable the admin page without token, use `DISABLE_ADMIN_TOKEN`")
+        }
+    }
+
     if cfg.yubico_client_id.is_some() != cfg.yubico_secret_key.is_some() {
         err!("Both `YUBICO_CLIENT_ID` and `YUBICO_SECRET_KEY` need to be set for Yubikey OTP support")
     }