diff options
Diffstat (limited to 'internal/admin/server.go')
| -rw-r--r-- | internal/admin/server.go | 25 |
1 files changed, 15 insertions, 10 deletions
diff --git a/internal/admin/server.go b/internal/admin/server.go index 418a693..8facc4a 100644 --- a/internal/admin/server.go +++ b/internal/admin/server.go @@ -212,12 +212,11 @@ func (s *AdminServer) checkAuth(r *http.Request) bool { } func (s *AdminServer) isAdminAccount(name string) bool { - for _, a := range s.cfg.AdminHTTPS.AdminAccounts { - if strings.EqualFold(a, name) { - return true - } + acc, err := s.accountStore.LoadAccount(name) + if err != nil { + return false } - return false + return acc.Admin } func (s *AdminServer) setAuthCookie(w http.ResponseWriter, account string) { @@ -249,17 +248,17 @@ func (s *AdminServer) handleLogin(w http.ResponseWriter, r *http.Request) { account := strings.TrimSpace(r.FormValue("account")) password := r.FormValue("password") - if !s.isAdminAccount(account) { - s.renderPage(w, r, "login.html", map[string]any{"Error": "Account is not authorized as admin."}) - return - } - acc, err := s.accountStore.LoadAccount(account) if err != nil || !player.CheckPassword(password, acc.PasswordHash) { s.renderPage(w, r, "login.html", map[string]any{"Error": "Invalid account name or password."}) return } + if !acc.Admin { + s.renderPage(w, r, "login.html", map[string]any{"Error": "Account is not authorized as admin."}) + return + } + s.setAuthCookie(w, account) http.Redirect(w, r, "/", http.StatusFound) } @@ -355,6 +354,12 @@ func writeJSON(w http.ResponseWriter, data any) { } } +func writeJSONError(w http.ResponseWriter, msg string, code int) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(code) + json.NewEncoder(w).Encode(map[string]any{"error": msg}) +} + func readJSON(r *http.Request, v any) error { body, err := io.ReadAll(r.Body) if err != nil { |