From 17769e952c4a3a1b40ed0baf48d9f64affe6e4f9 Mon Sep 17 00:00:00 2001
From: Jason McBrayer <jmcbray@carcosa.net>
Date: Tue, 15 May 2018 09:52:07 -0400
Subject: [PATCH] Allow old login method with suitable warning.

---
 brutaldon/static/images/sensitive.png      | Bin 0 -> 3619 bytes
 brutaldon/templates/setup/login-oauth.html |   8 ++++++++
 brutaldon/templates/setup/login.html       |   6 ++++--
 brutaldon/urls.py                          |   1 +
 4 files changed, 13 insertions(+), 2 deletions(-)
 create mode 100644 brutaldon/static/images/sensitive.png

diff --git a/brutaldon/static/images/sensitive.png b/brutaldon/static/images/sensitive.png
new file mode 100644
index 0000000000000000000000000000000000000000..8745489a85989761568b78d5741a3097ca9dc709
GIT binary patch
literal 3619
zcmb_f_ct40_fM=)t5)sODy>q)Y-5j7yUI(|2r7yiwW%5%sMf62T0v{i)}BFHRLsPP
z6-8~L(vTo{)9*j<{pJ1P-g};V&U5ZP_kNzwy-)moGXvHO0v7-P0IT6Wy$4hq{ZAMf
zs2Zu^jG`I_7h?lGfH^=5@Sl6(_V!c{)3bZF0RR9q*FOOQvUB;UPEeqs>0Qt=Jv*z2
z{DmZ49jZ&%!|Gw6uCKQ@%qNg~1ORmXVa|atSJ4oUKzC6CL(}`NGB6M|bey4{wpHlt
zZeEyG`t(Ay2p@whzcMV2!yX8;5Pf@f*~bg*t|&3?t~7~7XaD$E>~ZQ@ZTL6BO=0p;
zfSRr1EwDsiM6#*?kk?8}Pnn*MeulJrLi@Luj+<LMbuoZ#y+a{jQ8fe~fjhy4Kf$wi
zmg>OEbvM3k81uXZykZpnUn{jLzWLFih8h`@P*0(VV^VKl6G*~MVt(l7ira`Or>x`J
z_wjq2F0$&xjG~~RrD1Vq3&Dz`KYLOw+;FlMVS|x~H%PhB_-GjA8wY+dQFjRwJNzPM
zi1?Jf5l|}|nX&XamgZu>mQa*KgGtz}Kzqh~M?7F>rV0MV_-9C7zt}YGkb|5->AtZs
z>YllAX;BA_)KjUpxrdLvTuiLp4s{pFfKN6G87m3;{Q&CKgm9Ok>R9zCJ0L#2Urapu
zQ(yXca@@^i#KX?~-JIYDmJXP);f?L3Rn?0D%=Kn|P>S1vzR%j4vwNA_^i(Iibh6o%
z=+4jT3=9V|*RGe;t<HIyq9-P&{P4shGX=Sd%Ie3XO%d#B$!1^%IR%xK?OSl#`}S5k
z*r6;*=^Jg8YD2daO(K>&j>CxB+a==HRpT1crM&DB@lxeBL1>M$iQ8)kNET6wzvE=&
zT;89;$Uskadg{wOk(!;}mn3p{k)LBSp(@xUSMf45O5{2A0Pu@iX8)S?XM~5`C&8Bs
z+A6aB%o8Mb4vqj-P{9$>`O!<>HI2~;{<J;v9o#vboxJIOO{+evqt*3_t^o_s32C#)
zakknFS!d@z<MWkupz9u|<#<6R@sO+xglB2Fc`v1142eI>Kb6CLBy94E>?2j|?mYj+
zrxHMTq!v|>e4W}Q`bxYttC+hAZ-b8v9UHULB<Shwj&t|4zqyTORcFT-iO~~s*ou<7
zs8rT@4sAQT<S09v(D$MrwN5UcMQJ#_?KkyP|3YBfSNelHXW4e{R54!U6B^Tt?sf(a
z?iWTF%-S0WD>G7@Hm_3_D?+|*`NR}w&<8|nrrFAxURRb#dL5qpY^U3=qM{-@_lc+5
zprElMvKReo@SRapWb<nj)6d%;!k-`!oP82~RJ`PragC>ErYmLCmVHDq8Gex{wn%{v
z)QyQA6ZaCkx-=}Gm`ri}Vt>CTl_(OhrDk!xh}yiOIMa~hHd0|piT;y$f-&2!x{l7g
zc%)JoP1l(QzzbKGfeqL<%0}^~;UAipn&)59tOXcLG24fezE9y|w{2Cn+FjJuDX}aJ
z1)_))g;X%9I0>Q`EjV*W`eS{{3?k>}+pkEA%E>aTn;oF=C3Wn3UZmSs=Y^0RY(q|4
zTde9xKs~&t7fll#710u_dm<oRQ&Z()hLu)a6X-J$`Z1NLn%%L7uRb9^_iiDC_Ln$R
zF+pQ88pV@F*s!XzsTrRVEmXwXNOcSaRSgN^zS0;;gQxcpAGD7%SZH2R($_g<B{+g8
zR+WFts;gHwUNYwA%3HK9H%B120PM0MRNw-HR6}!TXJ=0y7zj6UKD4*$9b7$k!`C}k
zo$P2rNaBgDv8_?LNO)#v;hY2eAx%L=#k(|)@iG>xLFh^hS62Q=^-WzEjEBjOmD$vK
zDidIpZu3m6{me)~8N9Yz{QeI+0Xa5MhXgq!h8K7LioVo-e&S%T+s4UwKgFiI<j*ay
z3yZJpL~JA|&xIaKB<U4D*vH<Fx(rv$cgP_X)Yc|{e*gMg3U}8^<=mRby3^biNmlCC
zG=G6|etuUMnaAoT&&wVl9RujTt?iFb1NB~K!GinivcYcwl3A99re?@S8}oTk+haE$
zeLrU~P<J~#lgdNa`k*xk$Xt2SY%!>1A<p4+{K<=^<$%>z?K9lqEMTMYrpRNi73Hi|
z@)A7sBsuDe{8c0VWIllkCKk3|B5)blAkk2GidkshGAc%puZ)qAfNU-0N*Xy}T?mz%
z<_K~f;}E%hYSiZM6;^3iQ(kjLN`d)FHCF~thMJ0BrvKtoS!!SQanMZ6aEqWuq$3L}
zzs{esLMlp15M*fscD);~zgZ6#9^k8m;z+{IYaN?>d=n)7sYHEJoZ!NWYEjbcJS}l+
zyAS0X1HRD>ia0HqX+7|R;a>3uJ&%F6a@$0)D=5mlQqmqnb}mTEO0EC?dP5^}53Z-L
zM_cfqd}FfN=KZ?0m6dV=xXo@6bF#k9^N)}LRMgWYSDlZDUcqzPewu-J%(edu#Uc!T
zW5K1vuXH7SYs-_$OgCv|R6(j<yWRo|a1{2NUppc6boLp|Yg#!a1sDz`yG%uTOThl`
zg`xiM6MS~zb_~bQzwMasS=w8nOZ;U{pMihIOWLCbN<<L=O9e~ns9|9v{s-*}b8Gx)
zzQT~L{MUnpb@KN*&#&Lh-Nj_opw4|%^GhU|o~_7EMQr}K1t&mJ%0o4W2shdSNWfD8
zc?G#{+&EjfLA%7Jzwd9tcsu+<SmP3^pkrQ5Bhpu#8AlPmlzE9RhK`e)6C3z-AVjND
zs_Bl`j#s+m=59aZ^?Rm9Pr<di;mLm}J5Q*zSO}h$3%~{DsXekAN$W4VAt}={G1L%g
zWaD7^y=TP~-S{tb^bh8&<&{0tfih<*7k$M$C&m=h7mFAFUR_J|Q%XagBy*l(JhnV@
zMmj&6=U(+%t2Ftf5#NRH^qYb>ySV8%YjfP0x$_;`f?e~)RNR!B;qKx$_hqlDs+MaW
zD=4is*LDPc+MK>kSOMpiPv=pSSZWOOmESJrA9OLZ&<69{DBR`>syTpFR9syiV_MDm
zQEvfmcF^%1g`m@-1ST6(;cw#q-wk1G#NEN+;n8Y;)zO|2b%<qTZhF$FDFj>?QO~Oj
zsDt(S!vD_|n0ZP}7GPjE)`p-WpK}!CZAhPN-i;0}YCR>6DPGpvz+P1AT=3gnNJD>+
zm+5m{Mon&)Rn)jmkU8jB4*Gxo;K(q#JGjcN9Mzsj%@eY>y0OzuzTUsQxtkOeB1NUV
z3k2pCKlM23G}&Ll>kgkqD}}mV)Qtt9>$5Hi&RzaJKOlYw9OGbjNSIY+u4`-_kLUQK
zu-n*tp2}Gup8XzF0G@VQcY1%GqFu(y3Rbk*?!a&FA+;7?N{6pU2s7n2B&jLwGUYWW
z2P<Q-Gru-hd;VA;v+074kwr%dr;{5JF#jnChdhMbwCXe3dFo&Uh$av&ERX!~6IT)z
z6BE-nXZ$fXaR10V!tGc|CO5ITrR<G!p*Hpo*2Sq{IsPYCAl=)<_;t@m5D-a7f|}|#
zw7k82UKm~lv*A1^ETZYF(?=KJdJYDtb*cvnXyRX}t(*5haCFp$l5lFuLr|tP%*R9A
z+~O)7_UzOwFBBkYSpMeL3#MpH>XV1ZQ<~}1hdzs=h^bmFC=?FV$cG$JN8UH5L!G>J
z&SlQ>sw$TyIMljk9!~!e^4WQ1qvlq)?cbk|@&b4}c=|S&3QY&+aN#E+<sQE}pPdou
zSFr;F_tqP$hP(*=+qx5cIeee3EA58%JUx*T)^T?2LBRRv?KB6#%e@Hf*brmWQ8mwQ
zXEOqI02p52OyBRW-VjLi=t#w2Cq7nCV&#-BJL0J?4BZ^%o7-R(xb60ZORkq_eVf1W
zQT056nZRr(45$=4JPZi~3VaUX4R4H6IH#A;ByC$4S65dTx3w|Q(oQ;b8W{9zZV+f1
zo-2=I3_U1>Z~hw4&Lrk1E|M}bJ@fX+!CH+eL#U-C@}O$_Hbm9Q16HU<bdLvdoEM-H
zfq439$49HT389MN&AZnXP6c9)VutnQY2PAJ3WQX6rRrMw0ctH|5Sn)WWrF@3hV~UD
zG;%}{{h`(g=3V~%&x!aF)Jv3#JAHk9lkCH5O~J~!@$Y)NwPI=!$!2w>eSxkNT8@H@
zFZO2Q@>k#W$I?4_xeV3Umo$Z%jU3opN7TjE#mJ6RiJiKNwN^_fZkCZjSGyg)QGDTY
zegr!GB<3F6c+!Ut56~F&%;AEWegdmSZ->g-z}e$#;@AEXiH1b{c5G*wdRS{%ZlXrq
z)Nl+CcX_zW#^AfAJLZ?|GHpYiCW4g7spY@li|{)$@hX*Ur(E07aPo1k5rU!ywya>h
zz}dHb_PTqKK3Wl9(7D^KSGzyYjtzsor?_DPe1crln;Ka!6}?eqlb%x)68wue^a{0L
zGt)Jg&N!tmpazv_E1=}^@}-<w<#&MOtFLJzz+j~wBuY5h?p&?{JUOZKqRGX(l$`92
z&|AeroZ=Pt^CV?%F6mFPZk0g~EX%FZ)6-MZQ%s2Fr4Jilu$GFA1`m!(V7g_JSZMA7
jwCOJD{g2h<M`t21#Z(ZmUQF!YU(N8YnO=>K)2sgiUaHZ!

literal 0
HcmV?d00001

diff --git a/brutaldon/templates/setup/login-oauth.html b/brutaldon/templates/setup/login-oauth.html
index ba7baa0..0547216 100644
--- a/brutaldon/templates/setup/login-oauth.html
+++ b/brutaldon/templates/setup/login-oauth.html
@@ -22,5 +22,13 @@
         </div>
     </form>
 
+    <div class="notification">
+        <button class="delete"></button>
+        <div>
+            Not able to log in with this form? Maybe your brutaldon instance isn't
+            visible on the internet to your Mastodon instance? If so, you can use
+            the <a href="{% url "oldlogin" %}">old login form</a>.
+        </div>
+    </div>
 
 {% endblock %}
diff --git a/brutaldon/templates/setup/login.html b/brutaldon/templates/setup/login.html
index 7c703e2..6d3c015 100644
--- a/brutaldon/templates/setup/login.html
+++ b/brutaldon/templates/setup/login.html
@@ -4,7 +4,7 @@
 {% block content %}
     <h1 class="title">Log in to your instance</h1>
 
-    <form method="post" action="{% url "login" %}">
+    <form method="post" action="{% url "oldlogin" %}">
         {% csrf_token %}
         <div class="field">
             <label class="label">{{ form.instance.label  }}</label>
@@ -46,7 +46,9 @@
             This information is only used to log you in to your instance for the
             first time. Brutaldon never stores your username and password; it
             only uses it to acquire a token which you can disable from the
-            settings page of your Mastodon instance.
+            settings page of your Mastodon instance. However, you do need to
+            absolutely trust the person running this copy of brutaldon! If that's
+            not the case, use the <a href="{% url "login" %}">OAuth login form</a>.
         </p>
     </div>
 
diff --git a/brutaldon/urls.py b/brutaldon/urls.py
index 637c312..86d0e41 100644
--- a/brutaldon/urls.py
+++ b/brutaldon/urls.py
@@ -21,6 +21,7 @@ urlpatterns = [
     path('admin/', admin.site.urls),
     path('home', views.home, name='home'),
     path('login', views.login, name="login"),
+    path('oldlogin', views.old_login, name="oldlogin"),
     path('logout', views.logout, name='logout'),
     path('oauth_callback', views.oauth_callback, name="oauth_callback"),
     path('error', views.error, name='error'),