Merge pull request #17 from ockibagusp/test-without-csrf

Test without csrf

Author: ockibagusp

.gitignore

@@ -8,5 +8,6 @@ golang-website-example
 golang-website-example.exe
 
 # air
+bin
 .air.toml
 tmp

README.md

@@ -5,7 +5,7 @@ Golang Echo and html template.
 
 
 - [x] Website is ok
-- [ ] **Test failed: All from Session and CSRF.**
+- [ ] **Test failed: All from Session.**
 
 
 ### Visual Studio Code

controllers/home_controller.go

@@ -32,7 +32,7 @@ func (controller Controller) Home(c echo.Context) error {
 		var user models.User
 		if err := controller.DB.Select("name").Where(
 			"username = ?", session.Values["username"],
-		).First(&user); err.Error != nil { // TODO: why?
+		).First(&user); err.Error != nil { // why?
 			log.Warnf(`session values "username" error: %v`, err.Error)
 		}
 

controllers/user_controller.go

@@ -29,6 +29,11 @@ func (controller *Controller) Users(c echo.Context) error {
 	})
 	log.Info("START request method GET for users")
 
+	log.Println(session.ID)
+	log.Println(session.IsNew)
+	log.Println(session.Options)
+	log.Println(session.Values)
+
 	is_auth_type := session.Values["is_auth_type"]
 	if is_auth_type == -1 {
 		log.Warn("for GET to users without no-session [@route: /login]")
@@ -149,7 +154,7 @@ func (controller *Controller) CreateUser(c echo.Context) error {
 		}
 
 		// userForm: type of a user
-		_userForm := types.UserForm{
+		userForm := types.UserForm{
 			Username:        c.FormValue("username"),
 			Email:           c.FormValue("email"),
 			Password:        c.FormValue("password"),
@@ -159,19 +164,19 @@ func (controller *Controller) CreateUser(c echo.Context) error {
 			Photo:           c.FormValue("photo"),
 		}
 
-		// _userForm: Validate of a validate user
+		// userForm: Validate of a validate user
 		err := validation.Errors{
 			"username": validation.Validate(
-				_userForm.Username, validation.Required, validation.Length(4, 15),
+				userForm.Username, validation.Required, validation.Length(4, 15),
 			),
-			"email": validation.Validate(_userForm.Email, validation.Required, is.Email),
+			"email": validation.Validate(userForm.Email, validation.Required, is.EmailFormat),
 			"password": validation.Validate(
-				_userForm.Password, validation.Required, validation.Length(6, 18),
-				validation.By(types.PasswordEquals(_userForm.ConfirmPassword)),
+				userForm.Password, validation.Required, validation.Length(6, 18),
+				validation.By(types.PasswordEquals(userForm.ConfirmPassword)),
 			),
-			"name":  validation.Validate(_userForm.Name, validation.Required),
-			"city":  validation.Validate(_userForm.City),
-			"photo": validation.Validate(_userForm.Photo),
+			"name":  validation.Validate(userForm.Name, validation.Required),
+			"city":  validation.Validate(userForm.City),
+			"photo": validation.Validate(userForm.Photo),
 		}.Filter()
 		/* if err = validation.Errors{...}.Filter(); err != nil {
 			...
@@ -196,20 +201,20 @@ func (controller *Controller) CreateUser(c echo.Context) error {
 		}
 
 		// Password Hash
-		hash, err := middleware.PasswordHash(_userForm.Password)
+		hash, err := middleware.PasswordHash(userForm.Password)
 		if err != nil {
 			log.Warnf("for POST to create user without middleware.PasswordHash error: `%v`", err)
 			log.Warn("END request method POST for create user: [-]failure")
 			return err
 		}
 
 		user := models.User{
-			Username: _userForm.Username,
-			Email:    _userForm.Email,
+			Username: userForm.Username,
+			Email:    userForm.Email,
 			Password: hash,
-			Name:     _userForm.Name,
-			City:     _userForm.City,
-			Photo:    _userForm.Photo,
+			Name:     userForm.Name,
+			City:     userForm.City,
+			Photo:    userForm.Photo,
 		}
 
 		// _, err := user.Save(...): be able
@@ -403,9 +408,9 @@ func (controller *Controller) UpdateUser(c echo.Context) error {
 			Email:    c.FormValue("email"),
 			Name:     c.FormValue("name"),
 			City:     city,
-			// TODO: photo
+			// TODO: photo, insyaallah
 			Photo: "",
-			// TODO: is admin
+			// TODO: is admin, insyaallah
 			IsAdmin: 0,
 		}
 
@@ -666,9 +671,12 @@ func (controller *Controller) DeleteUser(c echo.Context) error {
 		for example:
 		username ockibagusp delete 'ockibagusp': ok
 		username ockibagusp delete 'sugriwa': no
+
+		insyaallah
 	*/
+	oldUsername := session.Values["username"]
 	_, err = models.User{}.FirstByIDAndUsername(
-		controller.DB, id, session.Values["username"].(string),
+		controller.DB, id, oldUsername.(string),
 	)
 
 	if !middleware.IsAdmin(is_auth_type) {

go.mod

@@ -1,34 +1,57 @@
 module github.com/ockibagusp/golang-website-example
 
-go 1.14
+go 1.18
 
 require (
+	github.com/gavv/httpexpect/v2 v2.3.1
+	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
+	github.com/gorilla/sessions v1.2.1
+	github.com/labstack/echo-contrib v0.11.0
+	github.com/labstack/echo/v4 v4.6.1
+	github.com/sirupsen/logrus v1.8.1
+	github.com/stretchr/testify v1.7.0
+	github.com/tkanos/gonfig v0.0.0-20210106201359-53e13348de2f
+	golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871
+	gorm.io/driver/mysql v1.2.0
+	gorm.io/gorm v1.22.3
+)
+
+require (
+	github.com/ajg/form v1.5.1 // indirect
 	github.com/andybalholm/brotli v1.0.4 // indirect
+	github.com/asaskevich/govalidator v0.0.0-20200108200545-475eaeb16496 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/structs v1.1.0 // indirect
-	github.com/gavv/httpexpect/v2 v2.3.1
 	github.com/ghodss/yaml v1.0.0 // indirect
-	github.com/go-ozzo/ozzo-validation/v4 v4.3.0
+	github.com/go-sql-driver/mysql v1.6.0 // indirect
+	github.com/golang-jwt/jwt v3.2.2+incompatible // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/gorilla/sessions v1.2.1
+	github.com/gorilla/context v1.1.1 // indirect
+	github.com/gorilla/securecookie v1.1.1 // indirect
+	github.com/gorilla/websocket v1.4.2 // indirect
 	github.com/imkira/go-interpol v1.1.0 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.2 // indirect
 	github.com/klauspost/compress v1.13.6 // indirect
-	github.com/labstack/echo-contrib v0.11.0
-	github.com/labstack/echo/v4 v4.6.1
 	github.com/labstack/gommon v0.3.1 // indirect
 	github.com/mattn/go-colorable v0.1.11 // indirect
+	github.com/mattn/go-isatty v0.0.14 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/sergi/go-diff v1.2.0 // indirect
-	github.com/sirupsen/logrus v1.8.1
-	github.com/stretchr/testify v1.7.0
-	github.com/tkanos/gonfig v0.0.0-20210106201359-53e13348de2f
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/valyala/fasthttp v1.31.0 // indirect
+	github.com/valyala/fasttemplate v1.2.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871
+	github.com/yalp/jsonpath v0.0.0-20180802001716-5cc68e5049a0 // indirect
+	github.com/yudai/gojsondiff v1.0.0 // indirect
+	github.com/yudai/golcs v0.0.0-20170316035057-ecda9a501e82 // indirect
 	golang.org/x/net v0.0.0-20211205041911-012df41ee64c // indirect
 	golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e // indirect
+	golang.org/x/text v0.3.7 // indirect
 	golang.org/x/time v0.0.0-20211116232009-f0f3c7e86c11 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gorm.io/driver/mysql v1.2.0
-	gorm.io/gorm v1.22.3
+	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	moul.io/http2curl v1.0.1-0.20190925090545-5cd742060b0e // indirect
 )