Private forum plugin

flex

@julian I tried this already.
But this is not secure, as the API can still be requested manually (for example user pages are public).

Using a middleware I can filter all requests and only serve the login or register page.

Front code is not secure because the user can remove it.

PitaJ

@flex you're on the right track with what you have there. Try it out!

You'll probably want to redirect instead. Here's a helpful handler to assist:

NodeBB/src/controllers/helpers.js at master · NodeBB/NodeBB

Node.js based forum software built for the modern web - NodeBB/src/controllers/helpers.js at master · NodeBB/NodeBB

GitHub (github.com)

flex

Hello guys,

I am starting to develop the plugin, but I did not understand how to add my code as a middleware and use the req object.
For now it is not working because I don't know how to get the req object (undefinied).

Here's my plugin:

'use strict';

const plugin = {};
var winston = module.parent.require('winston');
const helpers = require.main.require('./src/controllers/helpers');

plugin.init = function (params, callback) {

        const { app, middleware, router } = params;
        var allowedPages=["/login", "/register", "/reset"];

        console.log("==================================");
        console.log(" Plugin Private Forum Initialized ");
        console.log("==================================");

        if (allowedPages.indexOf(req.url) < 0) {
                helpers.notAllowed(req, res, next);
        } else {
                console.log("PLUGIN PRIVATE FORUM: req.url="+req.url+", user is logged");
                winston.log("PLUGIN PRIVATE FORUM: req.url="+req.url+", user is logged");
                next();
        }
};

module.exports = plugin;

You can see it here: https://github.com/LM1LC3N7/nodebb-plugin-private-forum/blob/master/library.js

Of course there are errors:

2020-06-03T15:55:06.696Z [4567/1731] - verbose: [plugins/fireHook] static:app.load
==================================
 Plugin Private Forum Initialized
==================================
2020-06-03T15:55:06.733Z [4567/1731] - error: [plugins] Error executing 'static:app.load' in plugin 'nodebb-plugin-private-forum'
2020-06-03T15:55:06.734Z [4567/1731] - error: ReferenceError: req is not defined
    at Object.plugin.init [as method] (/etc/nodebb/nodebb-plugin-private-forum/library.js:16:27)
    at /nodebb/src/plugins/hooks.js:176:30
    at /nodebb/node_modules/async/dist/async.js:2154:44
    at eachOfArrayLike (/nodebb/node_modules/async/dist/async.js:500:13)
    at eachOf (/nodebb/node_modules/async/dist/async.js:551:16)
    at awaitable (/nodebb/node_modules/async/dist/async.js:208:32)
    at Object.eachLimit (/nodebb/node_modules/async/dist/async.js:2216:16)
    at /nodebb/node_modules/async/dist/async.js:216:25
    at new Promise (<anonymous>)
    at Object.awaitable (/nodebb/node_modules/async/dist/async.js:211:20)

Maybe @julian or @PitaJ you can help me on this?

flex

This post is deleted!

flex

FYI @julian and @PitaJ I have edited my last answer with new elements.

PitaJ

You need to wrap the middleware in a function and apply that function with app.use

flex

@PitaJ thanks!

Do you know if there is an helper to check if the user is connected?

PitaJ

@flex what do you mean by connected? You can check if a user is logged in by checking if req.uid is greater than (not equal to) 0.

flex

Thank you again, now it seems to work well!

Can you review the code and maybe test the module?
I would like to be sure that I have not forgot something.

GitHub - LM1LC3N7/nodebb-plugin-private-forum: A NodeBB plugin to lockdown the forum to non-registered users.

A NodeBB plugin to lockdown the forum to non-registered users. - LM1LC3N7/nodebb-plugin-private-forum

GitHub (github.com)

flex

The plugin is now live on npm and should be automatically updated when I create a new release version on GitHub.

flex

Do you know why there is still this message?

package.json

  "nbbpm": {
    "compatibility": "^1.11.2"
  }

julian

@flex as the plugin is installed by people, we will get information about whether it is stable (e.g. crashes NodeBB). If all is well, then you will automatically get a green check mark

I don't recall the exact logic that @baris used when he wrote it though

flex

@julian ok, I was thinking that the nbbpm was here for that!
Thank you for your answer!