Added csurf protection, and setup passport

4 files changed, 72 insertions, 0 deletions

diff --git a/app.js b/app.js
index e4d0843..ac78e16 100644
--- a/app.js
+++ b/app.js
@@ -6,6 +6,9 @@ var bodyParser = require('body-parser');
 var hbs = require('express-handlebars');
 var dbFile = require("./node_simple.js");
 var sanitizer  = require ("sanitizer");
+var session = require('express-session');
+var passport = require('passport');
+var flash = require('connect-flash');
 
 var routes = require('./routes/index');
 var app = express();
@@ -23,6 +26,12 @@ app.set('view engine', '.hbs');
 app.use(bodyParser.json());
 app.use(bodyParser.urlencoded({extended: true}));
 app.use(cookieParser());
+app.use(session({secret: 'pickbetterlater', resave: false, saveUninitialized: false}));
+app.use(flash());
+app.use(passport.initialize());
+app.use(passport.session());
+
+require('./config/passport'); // simply need to load it
 
 /*LOADS ALL STATIC FILES FROM THE DIRECTORY __dirname*/
 app.use(express.static(__dirname));
diff --git a/config/passport.js b/config/passport.js
new file mode 100644
index 0000000..63ea1fd
--- /dev/null
+++ b/config/passport.js
@@ -0,0 +1,3 @@
+/**
+ * Created by nanalelfe on 2016-07-20.
+ */
diff --git a/routes/index.js b/routes/index.js
index 457fbd1..60a2c28 100644
--- a/routes/index.js
+++ b/routes/index.js
@@ -1,6 +1,11 @@
 var dbFile  = require("../node_simple.js");
 var express = require('express');
 var router = express.Router();
+var csrf = require('csurf'); // Cross-Site Request Forgery prevention
+var passport = require('passport');
+
+var csrfProtection = csrf();
+router.use(csrfProtection); // router is protected
 
 /* Render/GET homepage. */
 router.get('/', function(req, res, next) {
@@ -40,6 +45,21 @@ router.get('/search', function(req, res, next) {
     res.redirect('/exams/' + courseName);
 });
 
+router.get('/signup', function(req, res, next) {
+    res.render('signup', {csrfToken: req.csrfToken()});
+});
+
+router.post('/signup', function(req, res, next) {
+    res.redirect('/');
+});
+
+/*router.post('/signup', passport.authenticate('local.signup', {
+    sucessRedirect: '/profile',
+    failureRedirect: '/signup',
+    failureFlash: true
+}));*/
+
+
 /*
 app.get('/exams',function (req,res) {
     console.log(req.query.search);
@@ -55,6 +75,8 @@ app.get('/exams.html', function (req,res) {
 });*/
 
 
+
+
 function getExamsForCourseCode(courseCode) {
     dbFile.get_all_exams(courseCode, function (exams) {
         if (exams.length == 0){
diff --git a/views/signup.hbs b/views/signup.hbs
new file mode 100644
index 0000000..a389b63
--- /dev/null
+++ b/views/signup.hbs
@@ -0,0 +1,38 @@
+<main id="solutions-main">
+<div class="row" id="solutions-main">
+    <div class="col-md-4 col-md-offset-4 col-sm-6 sol-sm-offset-3">
+        <h2><i class="fa fa-user-plus" aria-hidden="true"></i> Sign Up</h2>
+        <form action="" method="post">
+            <div class="form-group">
+                <input type="text" class="form-control" placeholder="First Name">
+            </div>
+
+            <div class="form-group">
+                <input type="text" class="form-control" placeholder="Last Name">
+            </div>
+
+            <div class="form-group">
+                <input type="email" class="form-control" placeholder="Email">
+            </div>
+
+            <div class="form-group">
+                <input type="email" class="form-control" placeholder="New Username">
+            </div>
+            <div class="form-group">
+                <input type="password" class="form-control" placeholder="New Password">
+            </div>
+
+            <div class="form-group">
+                <input type="text" class="form-control" placeholder="University (optional)">
+            </div>
+
+            <div class="form-group">
+                <input type="text" class="form-control" placeholder="Department (optional)">
+            </div>
+            <input type="hidden" name="_csrf" value="{{ csrfToken }}">
+            <button type="submit" class="btn btn-primary">Sign Up</button>
+        </form>
+    </div>
+
+</div>
+</main>
\ No newline at end of file