From 12701942c67a5207151ed995aacfaea0a419ba2b Mon Sep 17 00:00:00 2001 From: Cristian Date: Thu, 3 May 2018 10:35:48 -0300 Subject: [PATCH 1/8] RECAPTCHA_WINDOW and RECAPTCHA_INCORRECT_TRIGGER now can be set with env vars --- config.js | 6 ++++++ services/users.js | 8 +++++--- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/config.js b/config.js index a99e08923..7eb7f9280 100644 --- a/config.js +++ b/config.js @@ -212,6 +212,12 @@ const CONFIG = { RECAPTCHA_PUBLIC: process.env.TALK_RECAPTCHA_PUBLIC, RECAPTCHA_SECRET: process.env.TALK_RECAPTCHA_SECRET, + // RECAPTCHA_WINDOW is the rate limit's time interval + RECAPTCHA_WINDOW: process.env.RECAPTCHA_WINDOW || '10m', + + // After RECAPTCHA_INCORRECT_TRIGGER incorrect attempts, recaptcha will be required. + RECAPTCHA_INCORRECT_TRIGGER: process.env.RECAPTCHA_INCORRECT_TRIGGER || 5, + // WEBSOCKET_LIVE_URI is the absolute url to the live endpoint. WEBSOCKET_LIVE_URI: process.env.TALK_WEBSOCKET_LIVE_URI || null, diff --git a/services/users.js b/services/users.js index e53df4119..1e84c8ff1 100644 --- a/services/users.js +++ b/services/users.js @@ -18,12 +18,14 @@ const { ErrCannotIgnoreStaff, } = require('../errors'); const { difference, sample, some, merge, random } = require('lodash'); -const { ROOT_URL } = require('../config'); +const { + ROOT_URL, + RECAPTCHA_WINDOW, + RECAPTCHA_INCORRECT_TRIGGER, +} = require('../config'); const { jwt: JWT_SECRET } = require('../secrets'); const debug = require('debug')('talk:services:users'); const User = require('../models/user'); -const RECAPTCHA_WINDOW = '10m'; // 10 minutes. -const RECAPTCHA_INCORRECT_TRIGGER = 5; // after 5 incorrect attempts, recaptcha will be required. const Actions = require('./actions'); const mailer = require('./mailer'); const i18n = require('./i18n'); From 8b35f2300a184254758c79f86debc85348275038 Mon Sep 17 00:00:00 2001 From: Cristian Date: Thu, 3 May 2018 13:06:47 -0300 Subject: [PATCH 2/8] Added TALK_ prefix to constants RECAPTCHA_WINDOW and RECAPTCHA_INCORRECT_TRIGGER --- config.js | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/config.js b/config.js index 7eb7f9280..6a1f999a7 100644 --- a/config.js +++ b/config.js @@ -213,10 +213,11 @@ const CONFIG = { RECAPTCHA_SECRET: process.env.TALK_RECAPTCHA_SECRET, // RECAPTCHA_WINDOW is the rate limit's time interval - RECAPTCHA_WINDOW: process.env.RECAPTCHA_WINDOW || '10m', + RECAPTCHA_WINDOW: process.env.TALK_RECAPTCHA_WINDOW || '10m', // After RECAPTCHA_INCORRECT_TRIGGER incorrect attempts, recaptcha will be required. - RECAPTCHA_INCORRECT_TRIGGER: process.env.RECAPTCHA_INCORRECT_TRIGGER || 5, + RECAPTCHA_INCORRECT_TRIGGER: + process.env.TALK_RECAPTCHA_INCORRECT_TRIGGER || 5, // WEBSOCKET_LIVE_URI is the absolute url to the live endpoint. WEBSOCKET_LIVE_URI: process.env.TALK_WEBSOCKET_LIVE_URI || null, From 0e20ddb2fde76907314eca3aafde9968d5481160 Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Thu, 3 May 2018 10:40:06 -0600 Subject: [PATCH 3/8] added docs --- docs/source/02-02-advanced-configuration.md | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/source/02-02-advanced-configuration.md b/docs/source/02-02-advanced-configuration.md index b2ad29ad0..5b638401d 100644 --- a/docs/source/02-02-advanced-configuration.md +++ b/docs/source/02-02-advanced-configuration.md @@ -316,6 +316,18 @@ default to providing only a time based lockout. Refer to [reCAPTCHA](https://www.google.com/recaptcha/intro/index.html) for information on getting an account setup. +## TALK_RECAPTCHA_WINDOW + +The rate limit time interval that there can be [TALK_RECAPTCHA_INCORRECT_TRIGGER](#talk_recaptcha_incorrect_trigger) incorrect attempts until the reCAPTCHA is +marked as required, parsed by +[ms](https://www.npmjs.com/package/ms). (Default `10m`) + +## TALK_RECAPTCHA_INCORRECT_TRIGGER + +The number of times that an incorrect login can be entered before within a time +perioud indicated by [TALK_RECAPTCHA_WINDOW](#talk_recaptcha_window) until the +reCAPTCHA is marked as required. (Default `5`) + ## TALK_REDIS_CLIENT_CONFIGURATION Configuration overrides for the redis client configuration in a JSON encoded @@ -531,4 +543,4 @@ Sets the logging level for the context logger (from [Bunyan](https://github.com/ A JSON string representing the configuration passed to the [fetch](https://www.npmjs.com/package/node-fetch) call for the scraper. It can be used to set an authorization header, or change the user agent. (Default -`{}`) \ No newline at end of file +`{}`) From 287cff289b8b66b121b99d7418bccf963843ce72 Mon Sep 17 00:00:00 2001 From: Kim Gardner Date: Thu, 3 May 2018 13:04:05 -0400 Subject: [PATCH 4/8] Update copy to reflect ability to take action up until account is deleted --- plugins/talk-plugin-profile-data/client/translations.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/plugins/talk-plugin-profile-data/client/translations.yml b/plugins/talk-plugin-profile-data/client/translations.yml index 2a0c9e334..c5fbb8485 100644 --- a/plugins/talk-plugin-profile-data/client/translations.yml +++ b/plugins/talk-plugin-profile-data/client/translations.yml @@ -12,10 +12,10 @@ en: day: "{0} day" download_preparing: "Account Download Preparing - Check your email shortly for a download link" delete_request: - account_deletion_cancelled: 'Account Deletion Request Cancelled - Your request to delete your account has been cancelled. You may now write comments, reply to comments, and select reactions.' + account_deletion_cancelled: 'Account Deletion Request Cancelled - Your request to delete your account has been cancelled."' account_deletion_requested: 'Account Deletion Requested' received_on: "A request to delete your account was received on " - cancel_request_description: "If you would like to continue leaving comments, replies or reactions, you may cancel your request to delete your account below" + cancel_request_description: "If you would like to reactivate your account, you may cancel your request to delete your account below" before: "before" cancel_account_deletion_request: "Cancel Account Deletion Request" delete_my_account: "Delete My Account" @@ -40,7 +40,7 @@ en: subtitle: "When will my account be deleted?" description: "Your account will be deleted 24 hours after your request has been submitted." subtitle_2: "Can I still write comments until my account is deleted?" - description_2: "No. Once you have requested account deletion, you can no longer write comments, reply to comments, or select reactions." + description_2: "Yes, you can still comment, reply, and react to comments until the 24 hours expires." step_2: description: "Before your account is deleted, we recommend you download your comment history for your records. After your account is deleted, you will be unable to request your comment history." to_download: "To download your comment history go to:" From 06b08756e7b89fa7f8accea5bebc118026bb3b8a Mon Sep 17 00:00:00 2001 From: Wyatt Johnson Date: Thu, 3 May 2018 11:36:07 -0600 Subject: [PATCH 5/8] added durations to configuration file --- .../AccountDeletionRequestedSign.js | 3 ++- .../client/components/DeleteMyAccountStep1.js | 5 ++-- .../components/DownloadCommentHistory.js | 6 +++-- .../client/translations.yml | 6 ++--- plugins/talk-plugin-profile-data/config.json | 4 +++ .../server/mutators.js | 26 +++++++++++++------ 6 files changed, 34 insertions(+), 16 deletions(-) create mode 100644 plugins/talk-plugin-profile-data/config.json diff --git a/plugins/talk-plugin-profile-data/client/components/AccountDeletionRequestedSign.js b/plugins/talk-plugin-profile-data/client/components/AccountDeletionRequestedSign.js index 60e4d4bc6..e0d5ab255 100644 --- a/plugins/talk-plugin-profile-data/client/components/AccountDeletionRequestedSign.js +++ b/plugins/talk-plugin-profile-data/client/components/AccountDeletionRequestedSign.js @@ -6,6 +6,7 @@ import moment from 'moment'; import { Button, Icon } from 'plugin-api/beta/client/components/ui'; import styles from './AccountDeletionRequestedSign.css'; import { getErrorMessages } from 'coral-framework/utils'; +import { scheduledDeletionDelayHours } from '../../config.json'; class AccountDeletionRequestedSign extends React.Component { cancelAccountDeletion = async () => { @@ -25,7 +26,7 @@ class AccountDeletionRequestedSign extends React.Component { 'MMM Do YYYY, h:mm a' ); const deletionScheduledOn = moment(scheduledDeletionDate) - .subtract(24, 'hours') + .subtract(scheduledDeletionDelayHours, 'hours') .format('MMM Do YYYY, h:mm a'); return ( diff --git a/plugins/talk-plugin-profile-data/client/components/DeleteMyAccountStep1.js b/plugins/talk-plugin-profile-data/client/components/DeleteMyAccountStep1.js index dc137e41e..491c962cf 100644 --- a/plugins/talk-plugin-profile-data/client/components/DeleteMyAccountStep1.js +++ b/plugins/talk-plugin-profile-data/client/components/DeleteMyAccountStep1.js @@ -4,16 +4,17 @@ import cn from 'classnames'; import { Button } from 'plugin-api/beta/client/components/ui'; import styles from './DeleteMyAccountStep.css'; import { t } from 'plugin-api/beta/client/services'; +import { scheduledDeletionDelayHours } from '../../config.json'; const DeleteMyAccountStep1 = props => (

{t('delete_request.step_1.subtitle')}

- {t('delete_request.step_1.description')} + {t('delete_request.step_1.description', scheduledDeletionDelayHours)}

{t('delete_request.step_1.subtitle_2')}

- {t('delete_request.step_1.description_2')} + {t('delete_request.step_1.description_2', scheduledDeletionDelayHours)}