This is a first attempt at adding CSRF support. I've modeled the implementation closely after the Express.js CSRF middleware and Django's CSRF middleware.

I preferred some of the subtleties found in Express' version, namely that tokens weren't stored "as-is" in the session cookie, but rather a secret that was used to generate them lazily. Django had some additional strictness with the HTTP referer which I thought was important as well.

Usage is pretty simple. Add csrf.CsrfFilter to the app's filters (it must come after the revel.SessionFilter), and you're good to go. To add CSRF fields to a form, use the template tag {{ csrftoken . }}. The filter adds a function closure to the RenderArgs that can pull out the secret and make the token as-needed, caching the value in the request. Ajax support provided through the X-CSRFToken header.

The csrf.RefreshSecret should be called after a user logs in.

Like I said, first stab at things. Happy to make/discuss improvements.

@robfig @landr0id @verdverm

I've discussed this briefly in the past with Rob. I'd like to move Revel to github.com/gorevel so that we can manage the team better when Rob is MIA. It would also allow us to consider adding additional repos (e.g. skeleton templates, the new mailer and other Revel modules).

Rob also has github.com/revelframework IIRC.

looking into GH's process for moving repos, it seems GH will forward all traffic on github.com/robfig/revel to the new URL we choose, so it shouldn't affect anything too dramatically. Not sure about the GH pages site though. I'd love to setup a dedicated domain for Revel anyway, so maybe now's a good time to introduce that.

My last concern is Rob's other Go packages (e.g. config and pathtree). I am fine with leaving them with Rob since they are essentially free standing. Also, moving them may affect other projects who import them.

Thoughts?

I want to bring this up now..

But what we ideally want is the "domain" for revel moving forwards..

I got my little subdomain at http://revel-docs.daffodil.uk.com/ doing things..

But Ideally what we want is some applications that make revel work,,

Compile things, even test things..

So I kinda want to create the.. revel-samples.daffodil.uk.com site

Which will compile the samples and run as an application... So that its interactive and live online...and reflext real app

Of course, this will be a revel application.. Get the idea ;-)))

in long term, we need a domain, but can be party to this with dedicates and jenkins and job.. hell revel should be able to run itself.. is the idea..

We cant get that outta github.. with the docs tied to their sandbox, cannot run code etc.. We need to seperate ourselves from the "markdown" and move more stuff into go code.. as lines of text..

Feedback appreciated on dog food..

Maybe the revel-devel.daffodil.uk.com is the first one and this check status of all git modules and latest patches et all..

A couple of questions/issues I have come across:

1. What is the intended relationship between a plugin and a module?

2. When I want to create a plugin to add functionality (for instance using OnAppStart()), there doesn't seem to be a way for it to register itself.

   Even when embedding it in a module, I couldn't really find a way to let it hook into Revel in order for it to register itself apart from adding a dummy Controller. Am I missing something or is it just not possible at the moment?

suppose i have two controllers both named UserController under controllers/api/v1/ and controllers/api/v2. since controllers is currently only indexed by their names, please add support for fully qualified package name in the routes file.

For #281. I tried to get this as simple and as decoupled as I could to allow for customization on the app side.

This is aimed at apps with stored user information that either use auth.User or embeds it in another struct.

Usage

package app

import (
    "github.com/robfig/revel"
    "github.com/slogsdon/acvte/app/controllers"
    "github.com/slogsdon/acvte/modules/db"
    "github.com/robfig/revel/modules/auth"
)

func init() {
    // Filters is the default set of global filters.
    revel.Filters = []revel.Filter{
        revel.PanicFilter,
        revel.RouterFilter,
        revel.FilterConfiguringFilter,
        revel.ParamsFilter,
        revel.SessionFilter,
        revel.FlashFilter,
        revel.ValidationFilter,
        revel.I18nFilter,
        revel.InterceptorFilter,
        revel.ActionInvoker,
    }
    // tell auth module how to grab our user
    auth.GetHash = func(username string) *auth.User {
        user := new(auth.User)
        db.Db.WhereEqual("username", username).Limit(1).Find(user)
        return user
    }
    // the Admin controller requires authentication
    revel.InterceptFunc(auth.CheckSession, revel.BEFORE, &controllers.Admin{})
}

I've been working on a new revel app and have been switching back and forth between 2 computers. On one computer the app builds in about 1 second, on the other it takes more than 30 seconds. By "the app builds" I mean after typing revel run /path/to/my/app and then refreshing the browser and waiting for the page to load.

They are both running ubuntu 13.04, are both new computers with decent processors, both have go 1.1.1 installed. I can get more info later (one of them is at work), but just wanted to see if anyone else has had problems with a slow build. It makes development a challenge.

Given that the following controller exists in its own file everything works fine type ( FooController struct {*revel.Controller} )

But if I add a second structure inside the type this controller is not found type ( FooController struct {*revel.Controller} Bar struct {a string} )

If I break them out it works type FooController struct {*revel.Controller} type Bar struct {a string}

After upgrading to 0.9.0 I get

INFO  2014/02/26 15:53:03 revel.go:320: Loaded module static
INFO  2014/02/26 15:53:03 revel.go:320: Loaded module testrunner
INFO  2014/02/26 15:53:03 revel.go:320: Loaded module jobs
INFO  2014/02/26 15:53:03 main.go:33: Running revel server
panic: reflect: call of reflect.Value.Type on zero Value

goroutine 1 [running]:
runtime.panic(0x4558160, 0xc2100489c0)
    /Users/len/Projects/go/src/pkg/runtime/panic.c:266 +0xb6
reflect.Value.Type(0x0, 0x0, 0x0, 0x0, 0x0)
    /Users/len/Projects/go/src/pkg/reflect/value.go:1698 +0x79
github.com/revel/revel.findControllers(0x5727ea8, 0x461e2c0, 0xc210048980, 0x1, 0x1)
    /Users/len/Projects/gw/src/github.com/revel/revel/controller.go:294 +0x25a
github.com/revel/revel.RegisterController(0x4618b80, 0x0, 0xc210099480, 0x5, 0x5)
    /Users/len/Projects/gw/src/github.com/revel/revel/controller.go:373 +0x1f3
main.main()
    /Users/len/Projects/gw/src/github.com/CloudAfrica/cog/app/tmp/main.go:81 +0x822

goroutine 3 [syscall]:
runtime.goexit()
    /Users/len/Projects/go/src/pkg/runtime/proc.c:1394

It seems that when making main.go it has some missing character under windows exemple :: It may be some kind of backslash plague ?

here \ontrollers instead of \controllers

    C:\Documents and Settings\jmartinbertdel-tp\Mes documents\Mercurial\Gopa
    th\src\github.com\robfig\revel\samples\booking\app\ontrollers (from $GOPATH)

the output of my compilation https://github.com/bussiere/booking/blob/master/Error_Compiling_windows.txt

This is the draft version of mail support with minimum implementation. The parsing from view template is not implemented yet.

SendMail and SendFromTemplate are two helper methods for most use cases. SendMails sends the emails in a single connection.

It support both plain text and html or both.

Thinking about the queue, but before that, please help to review the design and suggest what I need to adjust.

What happened？

There are 1 security vulnerabilities found in gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c

• CVE-2022-28948

What did I do？

Upgrade gopkg.in/yaml.v3 from v3.0.0-20200313102051-9f266ea9e77c to 3.0.0 for vulnerability fix

What did you expect to happen？

Ideally, no insecure libs should be used.

The specification of the pull request

PR Specification from OSCS

The filename returned by RenderFileName does not escape the " character. This PR suppresses incorrect behavior when downloading files with special file names.

Details were sent to @brendensoares, @notzippy on gitter.

Hi! I can't seem to get the jobs module to work anymore. Not when running built app or using revel run, in either dev or prod mode.

I updated my revel project to use Go 1.17, revel/revel v1.1.0, revel/modules v1.1.0 and installed revel/cmd/revel v1.1.2. Inidirect dependenccies (from go.mod): github.com/revel/config v1.1.0 // indirect github.com/revel/cron v1.1.0 // indirect github.com/revel/log15 v2.11.20+incompatible // indirect github.com/revel/pathtree v0.0.0-20140121041023-41257a1839e9 // indirect

Running on Ubuntu 20.04.4 LTS.

In my browser running locally I get: (port used 9020) localhost:9020/@jobs -> Not Found No matching route found: /@jobs

and also the jobs are not run at the time indicated.

Jobs worked when I was using Go 1.16 and revel 1.0.0.

I've followed the manual and my app.conf has module.jobs = github.com/revel/modules/jobs and the conf/routes file module:jobs

Module testrunner works but jobs not...

Any help would be much appreciated!

Verify that the method in X-HTTP-Method-Override is a valid method before use using it. Validation is performed using the same logic as net/http dose. This prevents a routing confusion vulnerability that allowed an attacker to control the entire internal revel routing path (used to find a controller) via the override header. This issue can be problematic in instances where authentication is based on the path for example in a revel.Filter or if the revel app is behind a reverse proxy.