diff --git a/Gemfile b/Gemfile index 83bca90f..dcaf606a 100644 --- a/Gemfile +++ b/Gemfile @@ -80,5 +80,6 @@ group :test do platform :mri, :rbx do gem 'simplecov', require: nil + gem 'm' end end diff --git a/Gemfile.lock b/Gemfile.lock index ee90e90c..8ec16f93 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -96,6 +96,9 @@ GEM kgio (2.9.2) launchy (2.4.2) addressable (~> 2.3) + m (1.3.4) + method_source (>= 0.6.7) + rake (>= 0.9.2.2) magic (0.2.6) ffi (>= 0.6.3) mail (2.5.4) @@ -274,6 +277,7 @@ DEPENDENCIES jdbc-postgres jruby-openssl json + m magic mail minitest diff --git a/app/create.rb b/app/create.rb index a9df8649..d0af94c0 100644 --- a/app/create.rb +++ b/app/create.rb @@ -54,7 +54,15 @@ end post '/create' do content_type :json - require_unbanned_ip + + if banned?(true) + signout + session[:banned] = true if !session[:banned] + + flash[:error] = 'There was an error, please contact support to log in.' + redirect '/' + end + dashboard_if_signed_in @site = Site.new( diff --git a/app_helpers.rb b/app_helpers.rb index 27a0e116..7c9e5e5b 100644 --- a/app_helpers.rb +++ b/app_helpers.rb @@ -14,7 +14,7 @@ end def require_login_ajax halt 'You are not logged in!' unless signed_in? - halt 'You are banned.' if current_site.is_banned? || parent_site.is_banned? + halt 'Please contact support.' if banned? end def csrf_safe? @@ -31,11 +31,7 @@ end def require_login redirect '/' unless signed_in? - if session[:banned] || current_site.is_banned || parent_site.is_banned - signout - session[:banned] = true - redirect '/' - end + enforce_ban if banned? end def signed_in? @@ -52,15 +48,18 @@ def parent_site current_site.parent? ? current_site : current_site.parent end -def require_unbanned_ip - if session[:banned] || (is_banned_ip = Site.banned_ip?(request.ip)) - signout - session[:banned] = request.ip if !session[:banned] +def banned?(ip_check=false) + return true if session[:banned] + return true if current_site && (current_site.is_banned || parent_site.is_banned) - flash[:error] = 'Site creation has been banned due to a Terms of Service violation from your location. '+ - 'If you believe this to be in error, contact the site admin.' - return {result: 'error'}.to_json - end + return true if ip_check && Site.banned_ip?(request.ip) + false +end + +def enforce_ban + signout + session[:banned] = true + redirect '/' end def title diff --git a/models/site.rb b/models/site.rb index 3da82121..296aea24 100644 --- a/models/site.rb +++ b/models/site.rb @@ -294,6 +294,7 @@ class Site < Sequel::Model end def banned_ip?(ip) + return false if ENV['RACK_ENV'] == 'production' && ip == '127.0.0.1' return true if Site.where(is_banned: true). where(ip: hash_ip(ip)). where(['updated_at > ?', Time.now-BANNED_TIME]). diff --git a/tests/acceptance/signup_tests.rb b/tests/acceptance/signup_tests.rb index d5018b26..32e1b70d 100644 --- a/tests/acceptance/signup_tests.rb +++ b/tests/acceptance/signup_tests.rb @@ -35,12 +35,14 @@ describe 'signup' do after do Capybara.default_driver = :rack_test + BlockedIp.where(ip: '127.0.0.1').delete + DB[:sites].where(is_banned: true).delete end it 'succeeds with valid data' do fill_in_valid click_signup_button - site_created?.must_equal true + site_created? index_file_path = File.join Site::SITE_FILES_ROOT, @site[:username], 'index.html' File.exist?(index_file_path).must_equal true @@ -54,6 +56,27 @@ describe 'signup' do site.ip.must_equal Site.hash_ip('127.0.0.1') end + it 'fails if site with same ip has been banned' do + @banned_site = Fabricate :site + @banned_site.is_banned = true + @banned_site.save_changes + + fill_in_valid + click_signup_button + Site[username: @site[:username]].must_be_nil + current_path.must_equal '/' + page.wont_have_content 'Welcome to Neocities' + end + + it 'fails if IP is banned from blocked ips list' do + DB[:blocked_ips].insert(ip: '127.0.0.1', created_at: Time.now) + fill_in_valid + click_signup_button + Site[username: @site[:username]].must_be_nil + current_path.must_equal '/' + page.wont_have_content 'Welcome to Neocities' + end + it 'fails to create for existing site' do @existing_site = Fabricate :site fill_in_valid