From d214371423f4519fe91e48adc20f1d5c174c01b8 Mon Sep 17 00:00:00 2001 From: strawberry Date: Sun, 24 Dec 2023 00:36:14 -0500 Subject: [PATCH] add option for explicit opt-in allow open registration and make it clear Signed-off-by: strawberry --- conduit-example.toml | 15 +++++++++++++-- src/config/mod.rs | 7 ++++++- src/main.rs | 17 +++++++++++++++++ src/service/globals/mod.rs | 7 +++++++ 4 files changed, 43 insertions(+), 3 deletions(-) diff --git a/conduit-example.toml b/conduit-example.toml index 6f43a82c..ff5de38f 100644 --- a/conduit-example.toml +++ b/conduit-example.toml @@ -35,8 +35,19 @@ port = 6167 # Max size for uploads max_request_size = 20_000_000 # in bytes -# Enables registration. If set to false, no users can register on this server. -allow_registration = true +# Enables open registration. If set to false, no users can register on this +# server (unless a token is configured). +# If set to true, users can register with no form of 2nd step only if you set +# `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` to +# in your config. If you would like +# registration only via token reg, please set this to *false* and configure the +# `registration_token` key. +allow_registration = false + +# A static registration token that new users will have to provide when creating +# an account. If unset and `allow_registration` is true, registration is open +# without any condition. YOU NEED TO EDIT THIS. +registration_token = "change this token for something specific to your server" allow_federation = true allow_check_for_updates = true diff --git a/src/config/mod.rs b/src/config/mod.rs index 58395e63..2e9be567 100644 --- a/src/config/mod.rs +++ b/src/config/mod.rs @@ -50,6 +50,8 @@ pub struct Config { pub max_fetch_prev_events: u16, #[serde(default = "false_fn")] pub allow_registration: bool, + #[serde(default = "false_fn")] + pub yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse: bool, pub registration_token: Option, #[serde(default = "true_fn")] pub allow_encryption: bool, @@ -197,7 +199,10 @@ impl fmt::Display for Config { "Maximum concurrent requests", &self.max_concurrent_requests.to_string(), ), - ("Allow registration", &self.allow_registration.to_string()), + ( + "Allow registration (open registration)", + &self.allow_registration.to_string(), + ), ( "Allow guest registration", &self.allow_guest_registration.to_string(), diff --git a/src/main.rs b/src/main.rs index 576e17c3..82ff5a45 100644 --- a/src/main.rs +++ b/src/main.rs @@ -156,6 +156,23 @@ async fn main() { }; let config = &services().globals.config; + if config.allow_registration + && !config.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse + { + error!("!! WARNING: You have `allow_registration` enabled in your config which means you are allowing ANYONE to register on your conduwuit instance without any 2nd-step (e.g. registration token).\n + If this is not the intended behaviour, please disable `allow_registration` and set a registration token.\n + For security and safety reasons, conduwuit will shut down. If you are extra sure this is the desired behaviour you want, please set the following config option to true: + `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`"); + return; + } + + if config.allow_registration + && config.yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse + { + error!("Open registration is enabled via setting `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse` and `allow_registration` to true. You are expected to be aware of the risks now.\n + If this is not the desired behaviour, please disable `allow_registration` and set a registration token."); + } + info!("Starting server"); run_server().await.unwrap(); diff --git a/src/service/globals/mod.rs b/src/service/globals/mod.rs index 228424f5..87c812c7 100644 --- a/src/service/globals/mod.rs +++ b/src/service/globals/mod.rs @@ -307,6 +307,13 @@ impl Service<'_> { self.config.allow_guest_registration } + pub fn yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse( + &self, + ) -> bool { + self.config + .yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse + } + pub fn allow_encryption(&self) -> bool { self.config.allow_encryption }