|
| 1 | +const express = require("express"); |
| 2 | +const session = require("express-session"); |
| 3 | +const MongoStore = require("connect-mongo")(session); |
| 4 | +const flash = require("connect-flash"); |
| 5 | +const markdown = require("marked"); |
| 6 | +const csrf = require("csurf"); |
| 7 | +const app = express(); |
| 8 | +const sanitizeHTML = require("sanitize-html"); |
| 9 | + |
| 10 | +app.use(express.urlencoded({ extended: false })); |
| 11 | +app.use(express.json()); |
| 12 | + |
| 13 | +app.use("/api", require("./router-api")); |
| 14 | + |
| 15 | +let sessionOptions = session({ |
| 16 | + secret: "JavaScript is sooooooooo coool", |
| 17 | + store: new MongoStore({ client: require("./db") }), |
| 18 | + resave: false, |
| 19 | + saveUninitialized: false, |
| 20 | + cookie: { maxAge: 1000 * 60 * 60 * 24, httpOnly: true }, |
| 21 | +}); |
| 22 | + |
| 23 | +app.use(sessionOptions); |
| 24 | +app.use(flash()); |
| 25 | + |
| 26 | +app.use(function (req, res, next) { |
| 27 | + // make our markdown function available from within ejs templates |
| 28 | + res.locals.filterUserHTML = function (content) { |
| 29 | + return sanitizeHTML(markdown(content), { |
| 30 | + allowedTags: [ |
| 31 | + "p", |
| 32 | + "br", |
| 33 | + "ul", |
| 34 | + "ol", |
| 35 | + "li", |
| 36 | + "strong", |
| 37 | + "bold", |
| 38 | + "i", |
| 39 | + "em", |
| 40 | + "h1", |
| 41 | + "h2", |
| 42 | + "h3", |
| 43 | + "h4", |
| 44 | + "h5", |
| 45 | + "h6", |
| 46 | + ], |
| 47 | + allowedAttributes: {}, |
| 48 | + }); |
| 49 | + }; |
| 50 | + |
| 51 | + // make all error and success flash messages available from all templates |
| 52 | + res.locals.errors = req.flash("errors"); |
| 53 | + res.locals.success = req.flash("success"); |
| 54 | + |
| 55 | + // make current user id available on the req object |
| 56 | + if (req.session.user) { |
| 57 | + req.visitorId = req.session.user._id; |
| 58 | + } else { |
| 59 | + req.visitorId = 0; |
| 60 | + } |
| 61 | + |
| 62 | + // make user session data available from within view templates |
| 63 | + res.locals.user = req.session.user; |
| 64 | + next(); |
| 65 | +}); |
| 66 | + |
| 67 | +const router = require("./router"); |
| 68 | + |
| 69 | +app.use(express.static("public")); |
| 70 | +app.set("views", "views"); |
| 71 | +app.set("view engine", "ejs"); |
| 72 | + |
| 73 | +app.use(csrf()); |
| 74 | + |
| 75 | +app.use(function (req, res, next) { |
| 76 | + res.locals.csrfToken = req.csrfToken(); |
| 77 | + next(); |
| 78 | +}); |
| 79 | + |
| 80 | +app.use("/", router); |
| 81 | + |
| 82 | +app.use(function (err, req, res, next) { |
| 83 | + if (err) { |
| 84 | + if (err.code == "EBADCSRFTOKEN") { |
| 85 | + req.flash("errors", "Cross site request forgery detected."); |
| 86 | + req.session.save(() => res.redirect("/")); |
| 87 | + } else { |
| 88 | + res.render("404"); |
| 89 | + } |
| 90 | + } |
| 91 | +}); |
| 92 | + |
| 93 | +const server = require("http").createServer(app); |
| 94 | +const io = require("socket.io")(server); |
| 95 | + |
| 96 | +io.use(function (socket, next) { |
| 97 | + sessionOptions(socket.request, socket.request.res, next); |
| 98 | +}); |
| 99 | + |
| 100 | +io.on("connection", function (socket) { |
| 101 | + if (socket.request.session.user) { |
| 102 | + let user = socket.request.session.user; |
| 103 | + |
| 104 | + socket.emit("welcome", { username: user.username, avatar: user.avatar }); |
| 105 | + |
| 106 | + socket.on("chatMessageFromBrowser", function (data) { |
| 107 | + socket.broadcast.emit("chatMessageFromServer", { |
| 108 | + message: sanitizeHTML(data.message, { |
| 109 | + allowedTags: [], |
| 110 | + allowedAttributes: {}, |
| 111 | + }), |
| 112 | + username: user.username, |
| 113 | + avatar: user.avatar, |
| 114 | + }); |
| 115 | + }); |
| 116 | + } |
| 117 | +}); |
| 118 | + |
| 119 | +module.exports = server; |
0 commit comments