From bf127a85bd4dc595bd0dd2bef5b68f8e58d189cd Mon Sep 17 00:00:00 2001 From: Antonio Roberto Silva Date: Wed, 3 May 2023 13:07:55 -0300 Subject: [PATCH 1/4] add recaptcha and cloudflare ip gem --- services/catarse/Gemfile | 5 +++++ services/catarse/Gemfile.lock | 7 +++++++ .../controllers/registrations_controller.rb | 19 +++++++++++++++++++ services/catarse/config/routes.rb | 4 ++-- 4 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 services/catarse/app/controllers/registrations_controller.rb diff --git a/services/catarse/Gemfile b/services/catarse/Gemfile index a2f839f21f..b9411cb4b5 100644 --- a/services/catarse/Gemfile +++ b/services/catarse/Gemfile @@ -76,11 +76,16 @@ gem 'video_info', '3.0.1' gem 'webpacker', '5.4.3', require: false gem 'whenever', '1.0.0' gem 'zendesk_api', '1.33.0' +gem "recaptcha" group :production do gem 'fog-aws', '3.12.0' end +group :production, :sandbox do + gem 'cloudflare-rails' +end + group :development do gem 'brakeman', '5.1.2' gem 'letter_opener', '1.7.0' diff --git a/services/catarse/Gemfile.lock b/services/catarse/Gemfile.lock index a59177719c..d516d2c4d3 100644 --- a/services/catarse/Gemfile.lock +++ b/services/catarse/Gemfile.lock @@ -177,6 +177,10 @@ GEM chronic_duration (0.10.6) numerizer (~> 0.1.1) chunky_png (1.4.0) + cloudflare-rails (3.0.0) + actionpack (>= 6.0, < 7.1.0) + activesupport (>= 6.0, < 7.1.0) + railties (>= 6.0, < 7.1.0) concurrent-ruby (1.1.9) connection_pool (2.2.5) countries (4.0.1) @@ -473,6 +477,7 @@ GEM ffi (~> 1.0) rdstation-ruby-client (0.0.5) httparty (~> 0.12) + recaptcha (5.14.0) redcarpet (3.5.1) redis (4.5.1) regexp_parser (2.2.0) @@ -674,6 +679,7 @@ DEPENDENCIES catarse_pagarme! catarse_scripts! catarse_settings_db (= 0.2.0) + cloudflare-rails concurrent-ruby (= 1.1.9) countries (= 4.0.1) cpf_cnpj (= 0.5.0) @@ -718,6 +724,7 @@ DEPENDENCIES rails-observers (= 0.1.5) ranked-model (= 0.4.7) rdstation-ruby-client (= 0.0.5) + recaptcha redactor-rails (= 0.7.0)! redis (= 4.5.1) responders (= 3.0.1) diff --git a/services/catarse/app/controllers/registrations_controller.rb b/services/catarse/app/controllers/registrations_controller.rb new file mode 100644 index 0000000000..edc29fd626 --- /dev/null +++ b/services/catarse/app/controllers/registrations_controller.rb @@ -0,0 +1,19 @@ +# frozen_string_literal: true + +class RegistrationsController < Devise::RegistrationsController + prepend_before_action :check_captcha, only: [:create] + private + + def check_captcha + return if verify_recaptcha # verify_recaptcha(action: 'signup') for v3 + + self.resource = resource_class.new sign_up_params + resource.validate + set_minimum_password_length + + respond_with_navigational(resource) do + flash.discard(:recaptcha_error) + render :new + end + end +end diff --git a/services/catarse/config/routes.rb b/services/catarse/config/routes.rb index 51a74990a1..38c598e98d 100644 --- a/services/catarse/config/routes.rb +++ b/services/catarse/config/routes.rb @@ -23,12 +23,12 @@ def matches?(request) devise_for(:users, path: '', path_names: { sign_in: :login, sign_out: :logout, sign_up: :sign_up }, - controllers: { passwords: :passwords, sessions: :sessions }, + controllers: { passwords: :passwords, sessions: :sessions, registrations: :registrations }, skip: :omniauth_callbacks ) devise_scope :user do - post '/sign_up', { to: 'devise/registrations#create', as: :sign_up } + post '/sign_up', { to: 'registrations#create', as: :sign_up } get '/not-my-account', to: 'sessions#destroy_and_redirect', as: :not_my_account end From 50ddd143f539d02bf017d7895cca9f99eeed17cf Mon Sep 17 00:00:00 2001 From: Antonio Roberto Silva Date: Wed, 3 May 2023 13:33:31 -0300 Subject: [PATCH 2/4] missing recaptcha tags --- .../views/catarse_bootstrap/devise/registrations/new.html.slim | 2 ++ 1 file changed, 2 insertions(+) diff --git a/services/catarse/app/views/catarse_bootstrap/devise/registrations/new.html.slim b/services/catarse/app/views/catarse_bootstrap/devise/registrations/new.html.slim index 31557f7a39..c935f15b77 100644 --- a/services/catarse/app/views/catarse_bootstrap/devise/registrations/new.html.slim +++ b/services/catarse/app/views/catarse_bootstrap/devise/registrations/new.html.slim @@ -28,6 +28,8 @@ .u-marginbottom-20 = form.input_field :newsletter, as: :boolean, boolean_style: :inline, class: 'checkbox-fix', checked: false label.w-form-label.fontsize-smallest= t('.form.labels.newsletter') + .u-marginbottom-20 + = recaptcha_tags .w-row.u-marginbottom-20 .w-col.w-col-6.w-col-small-6.w-col-tiny-6 = form.button :submit, t('.form.inputs.submit'), class:'btn btn-large' From 896155d48053981449c19d09e83d5a5295c3218c Mon Sep 17 00:00:00 2001 From: Antonio Roberto Silva Date: Wed, 3 May 2023 18:38:18 -0300 Subject: [PATCH 3/4] get real user ip from cloudflare header --- services/catarse/app/models/user.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/services/catarse/app/models/user.rb b/services/catarse/app/models/user.rb index 786fbc9cf1..4bd1270767 100644 --- a/services/catarse/app/models/user.rb +++ b/services/catarse/app/models/user.rb @@ -413,7 +413,7 @@ def generate_reset_password_token def update_tracked_fields(request) super - login_activities.build(ip_address: current_sign_in_ip) + login_activities.build(ip_address: (request.headers['CF-Connecting-IP'].presence || current_sign_in_ip)) end def account_active? @@ -521,4 +521,10 @@ def cancel_all_subscriptions common_wrapper.cancel_subscription(_sub) end end + + protected + + def extract_ip_from(request) + request.headers['CF-Connecting-IP'].presence || request.remote_ip + end end From d9f19a2eb8c34a4aa7ea1ea74e0ed42a96b055bb Mon Sep 17 00:00:00 2001 From: Thiago Maia Date: Tue, 1 Aug 2023 19:28:20 +1000 Subject: [PATCH 4/4] =?UTF-8?q?Ajusta=20propor=C3=A7=C3=A3o=20do=20video?= =?UTF-8?q?=20do=20youtube=20para=20ficar=2016/9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../app/assets/stylesheets/catarse_bootstrap/_main.scss | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/services/catarse/app/assets/stylesheets/catarse_bootstrap/_main.scss b/services/catarse/app/assets/stylesheets/catarse_bootstrap/_main.scss index d3c1b9e6ac..0358328a70 100644 --- a/services/catarse/app/assets/stylesheets/catarse_bootstrap/_main.scss +++ b/services/catarse/app/assets/stylesheets/catarse_bootstrap/_main.scss @@ -737,9 +737,10 @@ a:hover { } .project-video { - height: 488px; + height: auto; margin-bottom: 30px; background-color: hsla(0, 0%, 87.1%, 0.57); + aspect-ratio: 16 / 9; } .fontsize-smaller { @@ -5106,7 +5107,7 @@ html.w-mod-js *[data-ix="display-0-on-load"] { margin-top: 8px; } .project-video { - height: 358px; + height: auto; } .fontsize-smaller { font-size: 13px;