john-okeefe
420af7978a
- Fix type assertion panics in auth.go (9 handlers)
* GetProfile, UpdateProfile, UpdateTheme, UpdateUsername
* UpdateEmail, UpdatePassword, DeleteAccount
* UpdateScanSettings, GetScanSettings, Register admin check
* Replace c.Get("user_id").(string) with MustGetAuthenticatedUser()
- Fix type assertion panic in library.go
* GetUserVisibleLibraries now uses MustGetAuthenticatedUser()
- Add path traversal protection to AddLibraryFolder
* Detect and block ".." in paths
* Clean paths with filepath.Clean()
* Verify path is a directory before adding
- Remove debug logging from Login handler
* Removed all fmt.Printf statements
* No more plaintext password logging
- Create safe context helper functions
* internal/handlers/context.go added
* GetAuthenticatedUser() for safe retrieval
* MustGetAuthenticatedUser() for post-auth middleware
Security: Critical
Tests: All 62 integration tests pass
Breaking: None - backward compatible
30 lines
923 B
Go
30 lines
923 B
Go
package handlers
|
|
|
|
import (
|
|
"bookmann/internal/database"
|
|
"net/http"
|
|
|
|
"github.com/labstack/echo/v4"
|
|
)
|
|
|
|
// GetAuthenticatedUser safely retrieves the authenticated user from context
|
|
// Returns an error if the user is not found in context or type assertion fails
|
|
func GetAuthenticatedUser(c echo.Context) (database.Users, error) {
|
|
user, ok := c.Get("user").(database.Users)
|
|
if !ok {
|
|
return database.Users{}, echo.NewHTTPError(http.StatusInternalServerError, "authentication context error")
|
|
}
|
|
return user, nil
|
|
}
|
|
|
|
// MustGetAuthenticatedUser gets user or panics
|
|
// Only use this after authentication middleware has verified the user
|
|
// Panicking here indicates a serious bug in the middleware chain
|
|
func MustGetAuthenticatedUser(c echo.Context) database.Users {
|
|
user, err := GetAuthenticatedUser(c)
|
|
if err != nil {
|
|
panic(err) // Should never happen if authentication middleware is working correctly
|
|
}
|
|
return user
|
|
}
|