Mlab 486

• loggedInUser global variable is deleted.
• getLoggedInUserData(email) method is added.
• Authentication checking when accessing a protected page is done only using req.isAuthenticated().
• As the result, getLoggedInUserData(email) should be called whenever a protected page is accessed. This approach might be heavier for the system, but it is more secure.

routes/routes-account.js

@@ -21,8 +21,6 @@ const projectRepo = require('../classes/repo')
 
 module.exports = function (app, config, passport, i18n) {
 
-  var loggedInUser
-
   // =========== PASSPORT =======
   passport.serializeUser(function (user, done) {
     done(null, user);
@@ -112,28 +110,27 @@ module.exports = function (app, config, passport, i18n) {
   var updatePasswordMailSubject = "Ihr Passwort für das Transferportal wurde gespeichert."
   var updatePasswordMailContent = '<div>Lieber Nutzer,<br/><br/>Ihr Passwort wurde erfolgreich geändert.<br/><br/>' + mailSignature + '</div>';
 
-  app.get('/', function (req, res) {
+  async function getLoggedInUserData(email) {
+    let user = await methods.getUserByEmail(email)
+    let loggedInUser = new portalUser(
+      user.id, email, user.salutation, user.title, user.firstname, user.lastname, user.industry, user.organisation, user.speciality, user.m4lab_idp, null, user.verificationStatus
+    )
+    
+    let userGitlabId = await methods.getGitlabId(loggedInUser.id)
+    loggedInUser.setGitlabUserId(userGitlabId)
+
+    return loggedInUser
+  }
+
+  app.get('/', async function (req, res) {
     if ( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
-      methods.getUserByEmail(req.user.email, function(data, err){
-        if (!err) {
-          // Initialize user
-          if (!loggedInUser) {
-            loggedInUser = new portalUser(
-              data.id, req.user.email, data.salutation, data.title, data.firstname, data.lastname, data.industry, data.organisation, data.speciality, data.m4lab_idp, null, data.verificationStatus
-            )
-            methods.getGitlabId(data.id, function(gitlabUserId, err){
-              if(!err) {
-                loggedInUser.setGitlabUserId(gitlabUserId)
-              }
-            })
-          }
-          res.render(lang+'/account/home', {
-            user: loggedInUser
-          });
-        }
-      })
+      let loggedInUser = await getLoggedInUserData(req.user.email)
+      
+      res.render(lang+'/account/home', {
+        user: loggedInUser
+      });
     }
   });
 
@@ -166,10 +163,11 @@ module.exports = function (app, config, passport, i18n) {
     });
   });
 
-  app.get('/profile', function (req, res) {
-    if(!req.isAuthenticated() && !loggedInUser) {
+  app.get('/profile', async function (req, res) {
+    if ( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
       if(loggedInUser.getVerificationStatus() != 1) {
         res.redirect('/account/')
       } else {
@@ -181,9 +179,10 @@ module.exports = function (app, config, passport, i18n) {
   })
 
   app.get('/services', async function(req, res){
-    if(!req.isAuthenticated() && !loggedInUser) {
+    if( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
       if(loggedInUser.getVerificationStatus() != 1) { // unverified users
         res.redirect('/account/')
       } else {
@@ -235,10 +234,11 @@ module.exports = function (app, config, passport, i18n) {
     }
   })
 
-  app.get('/security', function (req, res) {
-    if (!req.isAuthenticated() && !loggedInUser) {
+  app.get('/security', async function (req, res) {
+    if ( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
       if(loggedInUser.getVerificationStatus() == 1 && loggedInUser.getIdpStatus() == 1) {
         res.render(lang+'/account/security', {
           user: loggedInUser
@@ -249,7 +249,7 @@ module.exports = function (app, config, passport, i18n) {
     }
   })
 
-  app.post('/updateProfile', function (req, res) {
+  app.post('/updateProfile', async function (req, res) {
     var userData = {
       salutation: req.body.inputSalutation,
       title: req.body.inputTitle,
@@ -261,9 +261,10 @@ module.exports = function (app, config, passport, i18n) {
       speciality: req.body.inputSpeciality,
     }
 
-    if (!req.isAuthenticated() && !loggedInUser) {
+    if ( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
       if (userData.email) {
         dbconn.user.query('UPDATE user SET ? WHERE email = "' +userData.email+'"', userData, function (err, rows, fields) {
             if (err) {
@@ -280,10 +281,12 @@ module.exports = function (app, config, passport, i18n) {
     }
   });
 
-  app.post('/changePwd', function (req, res) {
-    if(!req.isAuthenticated() && !loggedInUser) {
+  app.post('/changePwd', async function (req, res) {
+    if( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
+
       var currPwd = req.body.inputCurrPwd
       var newPwd = req.body.inputNewPwd
       var retypePwd = req.body.inputConfirm
@@ -461,9 +464,10 @@ module.exports = function (app, config, passport, i18n) {
   // ============= NEW GITLAB PAGES ===========================
   
   app.get('/newInformation', async function(req, res){
-    if (!req.isAuthenticated() && !loggedInUser) {
+    if ( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
       let gitlabUser = await gitlab.getUserByEmail(loggedInUser.getEmail())
       if (!gitlabUser) { // no user found
         res.redirect('/account/service')
@@ -475,10 +479,12 @@ module.exports = function (app, config, passport, i18n) {
       }
     }
   })
-  app.post('/newInformation', function(req, res) {
-    if(!req.isAuthenticated() && !loggedInUser) {
+  app.post('/newInformation', async function(req, res) {
+    if( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
+
       if (!req.body.name && !req.body.description) {
         res.flash('error', 'Bitte geben Sie die benötigten Daten ein')
         res.redirect('/account/newInformation')
@@ -531,9 +537,11 @@ module.exports = function (app, config, passport, i18n) {
   })
 
   app.get('/updateInformation', async function(req, res){
-    if(!req.isAuthenticated() && !loggedInUser) {
+    if( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
+
       if(!req.query.id) {
         res.redirect('/account/services')
       } else {
@@ -557,10 +565,12 @@ module.exports = function (app, config, passport, i18n) {
     }
   })
 
-  app.post('/updateInformation', function(req, res){
-    if(!req.isAuthenticated() && !loggedInUser) {
+  app.post('/updateInformation', async function(req, res){
+    if( !req.isAuthenticated() ) {
       res.redirect('/login')
     } else {
+      let loggedInUser = await getLoggedInUserData(req.user.email)
+
       if (!req.body.name && !req.body.description) {
         res.flash('error', 'Bitte geben Sie die benötigten Daten ein')
         res.redirect('/account/updateInformation')
@@ -705,7 +715,6 @@ module.exports = function (app, config, passport, i18n) {
 
   // ============= USER VERIFICATION ================================
   app.get("/verifyAccount", function(req, res){
-    console.log(req.query)
     methods.getUserIdByVerificationToken(req.query.token, function(userId, err){
       if (userId) {
         let userData = {
@@ -743,9 +752,6 @@ module.exports = function (app, config, passport, i18n) {
               }
             })
 
-            if(!loggedInUser) {
-              loggedInUser.setVerificationStatus(userData.verificationStatus)
-            }
             res.render(lang+'/account/verification', {
               status: true
             });