Made having a confirmed email required to manage blog posts.

Made having a confirmed email required to manage info pages.
Made having a confirmed email required to manage forums.
2017-11-19 15:33:02 -05:00 · 2017-11-11 20:45:25 -05:00 · 2017-11-11 20:23:10 -05:00 · 2017-11-11 19:53:51 -05:00 · 2017-11-11 19:41:03 -05:00 · 2017-11-10 16:00:18 -05:00
53 changed files with 418 additions and 428 deletions
@@ -7,17 +7,16 @@ gem 'jquery-rails'
 gem 'bcrypt' # To use ActiveModel's has_secure_password
 gem 'sanitize'
 gem 'strip_attributes'
-gem 'redcarpet'
+gem 'redcarpet', '~> 3.2.3'
 gem 'hirb' # pretty console output
 gem 'rb-readline'
 gem 'rest-client'
 gem 'activerecord-session_store'
 gem 'highlight_js-rails', github: 'RedstonerServer/highlight_js-rails'
 gem 'kaminari', github: 'jomo/kaminari', branch: 'patch-2' # pagination
-gem 'jquery-textcomplete-rails' # @mentions
+gem 'jquery-textcomplete-rails', github: 'RedstonerServer/jquery-textcomplete-rails' # @mentions
 gem 'actionpack-action_caching', github: 'antulik/actionpack-action_caching', ref: '8c6e52c69315d67437f480da5dce4b7c8737fb32'
 gem 'mail-gpg', github: 'jomo/mail-gpg', ref: 'a666b48ee866dfa3eaa700f9c5edf4d195d0f8c9'
-gem 'totp'

 # Gems used only for assets and not required
 # in production environments by default.
@@ -5,6 +5,15 @@ GIT
    highlight_js-rails (8.4)
      rails (>= 3.1.1)

+GIT
+  remote: git://github.com/RedstonerServer/jquery-textcomplete-rails.git
+  revision: 8bf23af2d8fa1c5226c2b6889c7796adfe1f8772
+  specs:
+    jquery-textcomplete-rails (0.1.4)
+      coffee-rails (>= 3.2.0)
+      railties (>= 3.2.0)
+      sass-rails (>= 3.2.0)
+
 GIT
  remote: git://github.com/antulik/actionpack-action_caching.git
  revision: 8c6e52c69315d67437f480da5dce4b7c8737fb32
@@ -33,224 +42,202 @@ GIT

 GIT
  remote: git://github.com/rails/rails.git
-  revision: 3804d017333da16d76d9fc6633faf5635c7b03d7
+  revision: 2c8f567e53580872d8c6dfe61201e58793ca131e
  branch: 4-2-stable
  specs:
-    actionmailer (4.2.10)
-      actionpack (= 4.2.10)
-      actionview (= 4.2.10)
-      activejob (= 4.2.10)
+    actionmailer (4.2.5.1)
+      actionpack (= 4.2.5.1)
+      actionview (= 4.2.5.1)
+      activejob (= 4.2.5.1)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.10)
-      actionview (= 4.2.10)
-      activesupport (= 4.2.10)
+    actionpack (4.2.5.1)
+      actionview (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      rack (~> 1.6)
      rack-test (~> 0.6.2)
      rails-dom-testing (~> 1.0, >= 1.0.5)
      rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.10)
-      activesupport (= 4.2.10)
+    actionview (4.2.5.1)
+      activesupport (= 4.2.5.1)
      builder (~> 3.1)
      erubis (~> 2.7.0)
      rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.10)
-      activesupport (= 4.2.10)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (4.2.5.1)
+      activesupport (= 4.2.5.1)
      globalid (>= 0.3.0)
-    activemodel (4.2.10)
-      activesupport (= 4.2.10)
+    activemodel (4.2.5.1)
+      activesupport (= 4.2.5.1)
      builder (~> 3.1)
-    activerecord (4.2.10)
-      activemodel (= 4.2.10)
-      activesupport (= 4.2.10)
+    activerecord (4.2.5.1)
+      activemodel (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      arel (~> 6.0)
-    activesupport (4.2.10)
+    activesupport (4.2.5.1)
      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
      minitest (~> 5.1)
      thread_safe (~> 0.3, >= 0.3.4)
      tzinfo (~> 1.1)
-    rails (4.2.10)
-      actionmailer (= 4.2.10)
-      actionpack (= 4.2.10)
-      actionview (= 4.2.10)
-      activejob (= 4.2.10)
-      activemodel (= 4.2.10)
-      activerecord (= 4.2.10)
-      activesupport (= 4.2.10)
+    rails (4.2.5.1)
+      actionmailer (= 4.2.5.1)
+      actionpack (= 4.2.5.1)
+      actionview (= 4.2.5.1)
+      activejob (= 4.2.5.1)
+      activemodel (= 4.2.5.1)
+      activerecord (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.10)
+      railties (= 4.2.5.1)
      sprockets-rails
-    railties (4.2.10)
-      actionpack (= 4.2.10)
-      activesupport (= 4.2.10)
+    railties (4.2.5.1)
+      actionpack (= 4.2.5.1)
+      activesupport (= 4.2.5.1)
      rake (>= 0.8.7)
      thor (>= 0.18.1, < 2.0)

 GEM
  remote: https://rubygems.org/
  specs:
-    activerecord-session_store (1.1.1)
-      actionpack (>= 4.0)
-      activerecord (>= 4.0)
-      multi_json (~> 1.11, >= 1.11.2)
-      rack (>= 1.5.2, < 3)
-      railties (>= 4.0)
-    airbrussh (1.3.0)
-      sshkit (>= 1.6.1, != 1.7.0)
-    arel (6.0.4)
-    base32 (0.3.2)
-    bcrypt (3.1.11)
-    better_errors (2.4.0)
+    activerecord-session_store (0.1.2)
+      actionpack (>= 4.0.0, < 5)
+      activerecord (>= 4.0.0, < 5)
+      railties (>= 4.0.0, < 5)
+    arel (6.0.3)
+    bcrypt (3.1.10)
+    better_errors (2.1.1)
      coderay (>= 1.0.0)
-      erubi (>= 1.0.0)
+      erubis (>= 2.6.6)
      rack (>= 0.9.0)
-    binding_of_caller (0.8.0)
+    binding_of_caller (0.7.2)
      debug_inspector (>= 0.0.1)
-    builder (3.2.3)
-    capistrano (3.10.1)
-      airbrussh (>= 1.0.0)
+    builder (3.2.2)
+    capistrano (3.4.0)
      i18n
      rake (>= 10.0.0)
-      sshkit (>= 1.9.0)
+      sshkit (~> 1.3)
    capistrano-bundler (1.1.4)
      capistrano (~> 3.1)
      sshkit (~> 1.2)
-    capistrano-rails (1.1.8)
+    capistrano-rails (1.1.6)
      capistrano (~> 3.1)
      capistrano-bundler (~> 1.1)
-    capistrano-rbenv (2.1.3)
+    capistrano-rbenv (2.0.4)
      capistrano (~> 3.1)
      sshkit (~> 1.3)
    choice (0.2.0)
-    coderay (1.1.2)
-    coffee-rails (4.2.2)
+    coderay (1.1.0)
+    coffee-rails (4.1.1)
      coffee-script (>= 2.2.0)
-      railties (>= 4.0.0)
+      railties (>= 4.0.0, < 5.1.x)
    coffee-script (2.4.1)
      coffee-script-source
      execjs
-    coffee-script-source (1.12.2)
-    concurrent-ruby (1.0.5)
-    crass (1.0.3)
-    debug_inspector (0.0.3)
-    domain_name (0.5.20170404)
+    coffee-script-source (1.10.0)
+    concurrent-ruby (1.0.0)
+    crass (1.0.2)
+    debug_inspector (0.0.2)
+    domain_name (0.5.25)
      unf (>= 0.0.5, < 1.0.0)
-    erubi (1.7.1)
    erubis (2.7.0)
-    execjs (2.7.0)
-    ffi (1.9.23)
-    globalid (0.4.1)
-      activesupport (>= 4.2.0)
-    gpgme (2.0.16)
-      mini_portile2 (~> 2.3)
+    execjs (2.6.0)
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
+    gpgme (2.0.11)
+      mini_portile (>= 0.5.0)
    hirb (0.7.3)
-    http-cookie (1.0.3)
+    http-cookie (1.0.2)
      domain_name (~> 0.5)
-    i18n (0.9.5)
-      concurrent-ruby (~> 1.0)
-    jquery-rails (4.3.1)
-      rails-dom-testing (>= 1, < 3)
+    i18n (0.7.0)
+    jquery-rails (4.1.0)
+      rails-dom-testing (~> 1.0)
      railties (>= 4.2.0)
      thor (>= 0.14, < 2.0)
-    jquery-textcomplete-rails (0.1.5)
-      coffee-rails (>= 3.2.0)
-      railties (>= 3.2.0)
-      sass-rails (>= 3.2.0)
-    kgio (2.11.2)
-    loofah (2.2.2)
-      crass (~> 1.0.2)
+    json (1.8.3)
+    kgio (2.10.0)
+    loofah (2.0.3)
      nokogiri (>= 1.5.9)
-    mail (2.7.0)
-      mini_mime (>= 0.1.1)
-    mime-types (3.1)
-      mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0521)
-    mini_mime (1.0.0)
-    mini_portile2 (2.3.0)
-    minitest (5.11.3)
-    multi_json (1.13.1)
-    mysql2 (0.4.10)
+    mail (2.6.3)
+      mime-types (>= 1.16, < 3)
+    mime-types (2.99)
+    mini_portile (0.6.2)
+    mini_portile2 (2.0.0)
+    minitest (5.8.4)
+    mysql2 (0.4.2)
    net-scp (1.2.1)
      net-ssh (>= 2.6.5)
-    net-ssh (4.2.0)
+    net-ssh (3.0.2)
    netrc (0.11.0)
-    nokogiri (1.8.2)
-      mini_portile2 (~> 2.3.0)
-    nokogumbo (1.5.0)
+    nokogiri (1.6.7.2)
+      mini_portile2 (~> 2.0.0.rc2)
+    nokogumbo (1.4.7)
      nokogiri
-    rack (1.6.9)
+    rack (1.6.4)
    rack-test (0.6.3)
      rack (>= 1.0)
    rails-deprecated_sanitizer (1.0.3)
      activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.9)
-      activesupport (>= 4.2.0, < 5.0)
-      nokogiri (~> 1.6)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
      rails-deprecated_sanitizer (>= 1.0.1)
-    rails-erd (1.5.2)
+    rails-erd (1.4.5)
      activerecord (>= 3.2)
      activesupport (>= 3.2)
      choice (~> 0.2.0)
      ruby-graphviz (~> 1.2)
-    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.2, >= 2.2.2)
-    raindrops (0.19.0)
-    rake (12.3.0)
-    rb-fsevent (0.10.3)
-    rb-inotify (0.9.10)
-      ffi (>= 0.5.0, < 2)
-    rb-readline (0.5.5)
-    redcarpet (3.4.0)
-    rest-client (2.0.2)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    raindrops (0.15.0)
+    rake (10.5.0)
+    rb-readline (0.5.3)
+    redcarpet (3.2.3)
+    rest-client (1.8.0)
      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.8)
-    ruby-graphviz (1.2.3)
-    sanitize (4.6.4)
+      mime-types (>= 1.16, < 3.0)
+      netrc (~> 0.7)
+    ruby-graphviz (1.2.2)
+    sanitize (4.0.1)
      crass (~> 1.0.2)
      nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4)
-    sass (3.5.5)
-      sass-listen (~> 4.0.0)
-    sass-listen (4.0.0)
-      rb-fsevent (~> 0.9, >= 0.9.4)
-      rb-inotify (~> 0.9, >= 0.9.7)
-    sass-rails (5.0.7)
-      railties (>= 4.0.0, < 6)
+      nokogumbo (~> 1.4.1)
+    sass (3.4.21)
+    sass-rails (5.0.4)
+      railties (>= 4.0.0, < 5.0)
      sass (~> 3.1)
      sprockets (>= 2.8, < 4.0)
      sprockets-rails (>= 2.0, < 4.0)
      tilt (>= 1.1, < 3)
-    sprockets (3.7.1)
+    sprockets (3.5.2)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
-    sprockets-rails (3.2.1)
+    sprockets-rails (3.0.0)
      actionpack (>= 4.0)
      activesupport (>= 4.0)
      sprockets (>= 3.0.0)
-    sqlite3 (1.3.13)
-    sshkit (1.16.0)
+    sqlite3 (1.3.11)
+    sshkit (1.8.1)
      net-scp (>= 1.1.2)
      net-ssh (>= 2.8.0)
-    strip_attributes (1.8.0)
-      activemodel (>= 3.0, < 6.0)
-    thor (0.20.0)
-    thread_safe (0.3.6)
-    tilt (2.0.8)
-    totp (1.0.0)
-      base32
-    tzinfo (1.2.5)
+    strip_attributes (1.7.1)
+      activemodel (>= 3.0, < 5.0)
+    thor (0.19.1)
+    thread_safe (0.3.5)
+    tilt (2.0.2)
+    tzinfo (1.2.2)
      thread_safe (~> 0.1)
-    uglifier (4.1.8)
-      execjs (>= 0.3.0, < 3)
+    uglifier (2.7.2)
+      execjs (>= 0.3.0)
+      json (>= 1.8.0)
    unf (0.1.4)
      unf_ext
-    unf_ext (0.0.7.5)
-    unicorn (5.4.0)
+    unf_ext (0.0.7.1)
+    unicorn (5.0.1)
      kgio (~> 2.6)
+      rack
      raindrops (~> 0.7)
-    webrick (1.4.2)
+    webrick (1.3.1)

 PLATFORMS
  ruby
@@ -267,24 +254,23 @@ DEPENDENCIES
  highlight_js-rails!
  hirb
  jquery-rails
-  jquery-textcomplete-rails
+  jquery-textcomplete-rails!
  kaminari!
  mail-gpg!
  mysql2
  rails!
  rails-erd
  rb-readline
-  redcarpet
+  redcarpet (~> 3.2.3)
  rest-client
  sanitize
  sass-rails
  sqlite3
  strip_attributes
-  totp
  tzinfo-data
  uglifier
  unicorn
  webrick

 BUNDLED WITH
-   1.16.2
+   1.11.2
@@ -103,12 +103,3 @@ textarea {
 .notice {
    color:white;
 }
-.info-suggestions {
-    a:not(:hover) {
-        color: gray;
-    }
-
-    a:first-child {
-        border-right: 1px solid white !important;
-    }
-}
@@ -1,6 +1,6 @@
 class ApplicationController < ActionController::Base
  protect_from_forgery
-  before_filter :update_ip, :update_seen, :check_banned, :check_2fa
+  before_filter :update_ip, :update_seen, :check_banned
  # TODO: use SSL


@@ -41,14 +41,6 @@ class ApplicationController < ActionController::Base
    end
  end

-  def check_2fa
-    # Over complicated way of asking if the user is logged in as a mod without TOTP enabled while they are not on their login settings screen, logging out, or updating their login settings.
-    if current_user && current_user.mod? && !current_user.totp_enabled? && !(controller_name == "users" && action_name == "edit_login") && !(controller_name == "sessions" && action_name == "destroy") && !(controller_name == "users" && action_name == "update_login")
-      flash[:alert] = "Due to your staff rank, you are required to enable 2FA."
-      redirect_to :controller => "users", :action => "edit_login", :id => current_user.id
-    end
-  end
-

  #roles
  def disabled?
@@ -69,7 +69,7 @@ class BlogpostsController < ApplicationController
  end

  def auth
-    unless mod?
+    unless mod? && current_user.confirmed?
      flash[:alert] = "You are not allowed to edit posts!"
      redirect_to @post ? @post : blogposts_path
    end
@@ -17,7 +17,7 @@ class ForumgroupsController < ApplicationController
  end

  def update
-    if admin?
+    if admin? && current_user.confirmed?
      @group = Forumgroup.find(params[:id])
      if @group.update_attributes(group_params)
        flash[:notice] = "Forum group updated"
@@ -41,7 +41,7 @@ class ForumgroupsController < ApplicationController
  end

  def create
-    if admin?
+    if admin? && current_user.confirmed?
      @group = Forumgroup.new(group_params)
      if @group.save
        flash[:notice] = "Forum group created."
@@ -57,7 +57,7 @@ class ForumgroupsController < ApplicationController
  end

  def destroy
-    if admin?
+    if admin? && current_user.confirmed?
      @group = Forumgroup.find(params[:id])
      if @group.destroy
        flash[:notice] = "forum group deleted."
@@ -34,7 +34,7 @@ class ForumsController < ApplicationController
  end

  def update
-    if admin?
+    if admin? && current_user.confirmed?
      if @forum.update_attributes(forum_params)
        flash[:notice] = "Forum updated"
        redirect_to @forum
@@ -48,7 +48,7 @@ class ForumsController < ApplicationController
  end

  def create
-    if admin?
+    if admin? && current_user.confirmed?
      @forum = Forum.new(forum_params([:forumgroup_id]))
      if @forum.save
        flash[:notice] = "Forum created."
@@ -64,7 +64,7 @@ class ForumsController < ApplicationController
  end

  def destroy
-    if admin?
+    if admin? && current_user.confirmed?
      if @forum.destroy
        flash[:notice] = "Forum deleted."
      else
@@ -22,9 +22,9 @@ class InfoController < ApplicationController
  def create
    @info = Info.new(info_params)
    if @info.save
-      redirect_to @info, notice: 'Info has been created.'
+      redirect_to @info, notice: 'The info page has been created!'
    else
-      flash[:alert] = "Error creating info"
+      flash[:alert] = "An error occured while creating the info page."
      render action: "new"
    end
  end
@@ -32,18 +32,18 @@ class InfoController < ApplicationController
  def update
    @info.attributes = info_params()
    if @info.save
-      redirect_to @info, notice: 'Info has been updated.'
+      redirect_to @info, notice: 'The info page has been updated!'
    else
-      flash[:alert] = "There was a problem while updating the info"
+      flash[:alert] = "An error occured while updating the info page."
      render action: "edit"
    end
  end

  def destroy
    if @info.destroy
-      flash[:notice] = "Info deleted!"
+      flash[:notice] = "The info page has been deleted!"
    else
-      flash[:alert] = "There was a problem while deleting this info"
+      flash[:alert] = "An error occured while deleting the info page."
    end
    redirect_to info_index_path
  end
@@ -62,8 +62,8 @@ class InfoController < ApplicationController
  end

  def auth
-    unless mod?
-      flash[:alert] = "You are not allowed to edit info!"
+    unless mod? && current_user.confirmed?
+      flash[:alert] = "You are not allowed to edit info pages!"
      redirect_to @info ? @info : info_index_path
    end
  end
@@ -21,10 +21,6 @@ class SessionsController < ApplicationController
          flash[:alert] = "Your account has been disabled!"
        elsif user.banned?
          flash[:alert] = "You are banned!"
-        elsif user.totp_enabled && !TOTP.valid?(user.totp_secret, params[:totp_code].to_i)
-          flash[:alert] = "You're doing it wrong!"
-          render action: 'new'
-          return
        else
          session[:user_id] = user.id
          flash[:notice] = "Logged in!"
@@ -20,7 +20,7 @@ class StaticsController < ApplicationController
    @players = []
    @count = 0
    begin
-      json = JSON.parse(File.read("/etc/minecraft/info/players.json"))
+      json = JSON.parse(File.read("/etc/minecraft/redstoner/plugins/ModuleLoader/players.json"))
    rescue
      flash.now[:alert] = "The server is currently offline."
    else
@@ -17,9 +17,13 @@ class UsersController < ApplicationController

  def show
    begin
-      @ban_json = JSON.parse(File.read("/etc/minecraft/info/banned-players.json")).detect {|u| u["uuid"].tr("-", "") == @user.uuid}
+      @ban_json = JSON.parse(File.read("/etc/minecraft/redstoner/banned-players.json")).detect {|u| u["uuid"].tr("-", "") == @user.uuid}
    rescue
-      flash.now[:alert] = "An error occured while checking if this user is banned from the server!"
+      if @user.is?(current_user)
+        flash.now[:alert] = "An error occured while checking if you are banned from the server!"
+      else
+        flash.now[:alert] = "An error occured while checking if this user is banned from the server!"
+      end
      @ban_json = nil
    end
  end
@@ -87,12 +91,6 @@ class UsersController < ApplicationController
        @user.uuid = user_profile["id"]
        @user.ign  = user_profile["name"] # correct case

-        if User.find_by(uuid: @user.uuid)
-          flash[:alert] = "You already have a Redstoner account associated with this Minecraft account. Please log in instead."
-          redirect_to login_path
-          return
-        end
-
        if validate_token(@user.uuid, @user.email, params[:registration_token])
          destroy_token(params[:email])
          @user.last_ip = request.remote_ip # showing in mail
@@ -137,7 +135,7 @@ class UsersController < ApplicationController
  end

  def resend_mail
-    if (@user.is?(current_user) || mod?) && !@user.confirmed?
+    if (@user.is?(current_user) || (mod? && current_user.confirmed?)) && !@user.confirmed?
      RedstonerMailer.register_mail(@user, false).deliver_now
      flash[:notice] = "Check your inbox for the confirmation mail."
    else
@@ -147,7 +145,7 @@ class UsersController < ApplicationController
  end

  def update
-    if (mod? && current_user.role >= @user.role ) || (@user.is?(current_user) && confirmed?)
+    if (mod? && current_user.role >= @user.role && current_user.confirmed?) || (@user.is?(current_user) && confirmed?)
      if mod?
        userdata = user_params([:name, :skype, :youtube, :twitter, :about, :role, :badge, :confirmed, :header_scroll, :utc_time, :dark])
      else
@@ -190,7 +188,7 @@ class UsersController < ApplicationController
  end

  def ban
-    if mod? && current_user.role >= @user.role
+    if mod? && current_user.role >= @user.role && current_user.confirmed?
      @user.role = Role.get :banned
      flash[:notice] = "'#{@user.name}' has been banned!"
    else
@@ -200,7 +198,7 @@ class UsersController < ApplicationController
  end

  def unban
-    if mod? && current_user.role >= @user.role
+    if mod? && current_user.role >= @user.role && current_user.confirmed?
      @user.role = Role.get :normal
      flash[:notice] = "\"#{@user.name}\" has been unbanned!"
    else
@@ -210,7 +208,7 @@ class UsersController < ApplicationController
  end

  def destroy
-    if superadmin?
+    if superadmin? && current_user.confirmed?
      if @user.destroy
        flash[:notice] = "User deleted forever."
        redirect_to users_url
@@ -225,33 +223,28 @@ class UsersController < ApplicationController
  end

  def edit_notifications
-    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
+    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
      flash[:alert] = "You are not allowed to edit this user's notification settings!"
      redirect_to @user
    end
  end

  def edit_login
-    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
+    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
      flash[:alert] = "You are not allowed to edit this user's login details!"
      redirect_to @user
-      return
-    end
-
-    if !@user.totp_enabled
-      @user.update(totp_secret: TOTP.secret)
    end
  end

  def edit_website_settings
-    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
+    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
      flash[:alert] = "You are not allowed to edit this user's website settings!"
      redirect_to @user
    end
  end

  def update_login
-    if @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
+    if @user.is?(current_user) || (admin? && current_user.role > @user.role && current_user.confirmed?) || (superadmin? && current_user.confirmed?)
      authenticated = !@user.is?(current_user) || @user.authenticate(params[:current_password])
      if params[:user][:password].present?
        @user.password              = params[:user][:password]
@@ -262,18 +255,6 @@ class UsersController < ApplicationController
      @user.email_token = SecureRandom.hex(16) if mail_changed
      @user.confirmed   = !mail_changed

-      if params[:user][:totp_enabled] == "1" && !@user.totp_enabled
-        if TOTP.valid?(@user.totp_secret, params[:totp_code].to_i)
-          @user.totp_enabled = true
-        else
-          flash[:alert] = "Wrong TOTP code!"
-          render action: "edit_login"
-          return
-        end
-      elsif params[:user][:totp_enabled] == "0" && @user.totp_enabled
-        @user.totp_enabled = false
-      end
-
      # checking here for password so we can send back changes to the view
      if authenticated
        if @user.save
@@ -381,7 +362,7 @@ class UsersController < ApplicationController
  end

  def user_params(add = [])
-    a = [:ign, :email, :password, :password_confirmation, :mail_own_thread_reply, :mail_other_thread_reply, :mail_own_blogpost_comment, :mail_other_blogpost_comment, :mail_mention, :public_key, :totp_code] + add
+    a = [:ign, :email, :password, :password_confirmation, :mail_own_thread_reply, :mail_other_thread_reply, :mail_own_blogpost_comment, :mail_other_blogpost_comment, :mail_mention, :public_key] + add
    params.require(:user).permit(a)
  end
 end
@@ -1,8 +1,8 @@
 class RedstonerMailer < ActionMailer::Base

  add_template_helper(ApplicationHelper)
-  default from: "\"Redstoner\" <noreply@redstoner.com>"
-  default reply_to: "staff@redstoner.com"
+  default from: "info@redstoner.com"
+  default reply_to: "redstonerserver+website@gmail.com"

  def register_mail(user, uses_mc_pass)
    @user = user
@@ -1,10 +1,20 @@
-<% title "Edit Post: #{@post.title}" %>
+<% title "Edit News: #{@post.title}" %>

-<h1>Edit Post: #{@post.title}</h1>
+<%
+  def can_edit?
+    mod? && current_user.confirmed?
+  end
+%>
+
+<h1>Edit post</h1>
 <%= form_for @post do |f|%>
-  <%= f.text_field :title %>
-  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content} %>
-  <p><%= f.submit "Update Post", class: "btn blue left" %></p>
+  <%= f.text_field :title, disabled: !can_edit? %>
+  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content, options: {disabled: !can_edit?}} %>
+  <p><%= f.submit "Update Post", class: "btn blue left", disabled: !can_edit? %></p>
 <% end %>
-<p><%= button_to "Delete Post", @post, method: "delete", data: {confirm: "Delete post & comments forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete post", @post, method: "delete", data: {confirm: "Delete post & comments forever?"}, class: "btn red right", disabled: !can_edit? %></p>
 <div class="clear"></div>
+
+<% if !current_user.confirmed? %>
+  <span class='red-alert'>You must confirm your email before you can edit blog posts.</span>
+<% end %>
@@ -1,7 +1,7 @@
 <% title "News" %>

 <h1>News</h1>
-<%= link_to 'New Post', new_blogpost_path, class: "btn blue" if mod? %>
+<%= link_to 'Make new Post', new_blogpost_path, class: "btn blue" if mod? %>
 <div id="posts">
  <% @posts.each do |p| %>
    <div class="item-group with-avatar" id="post-<%= p.id %>">
@@ -1,9 +1,19 @@
 <% title "New Blog Post" %>

+<%
+  def can_create?
+    admin? && current_user.confirmed?
+  end
+%>
+
 <h1>New Post</h1>
 <%= form_for @post do |f|%>
-  <%= f.text_field :title, placeholder: "Title" %>
-  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content} %>
-  <p><%= f.submit "Create Post", class: "btn blue left" %></p>
+  <%= f.text_field :title, placeholder: "Title", disabled: !can_create? %>
+  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content, options: {disabled: !can_create?}} %>
+  <p><%= f.submit "Create Post", class: "btn blue left", disabled: !can_create? %></p>
  <div class="clear"></div>
+
+  <% if !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your email before you can create new blog posts.</span>
+  <% end %>
 <% end %>
@@ -1,4 +1,4 @@
-<h3>New Comment</h3>
+<h3>New comment</h3>
 <%= form_for [@post, @comment] do |f| %>
  <%= render partial: "md_editor", locals: {name: "comment[content]", content: @comment.content} %>
  <p><%= f.submit class: "btn blue" %></p>
@@ -1,10 +1,10 @@
 <% title "Edit Comment: #{@comment.blogpost.title}" %>

-<h1>Edit Comment</h1>
+<h1>Edit comment</h1>

 <%= form_for [@comment.blogpost, @comment] do |f| %>
  <%= render partial: "md_editor", locals: {name: "comment[content]", content: @comment.content} %>
  <p><%= f.submit "Update Comment", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete Comment", [@comment.blogpost, @comment] , method: "delete", data: {confirm: "Delete comment forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete comment", [@comment.blogpost, @comment] , method: "delete", data: {confirm: "Delete comment forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>
@@ -1,5 +1,11 @@
 <% title "Manage Forums" %>

+<%
+  def can_edit?
+    admin? && current_user.confirmed?
+  end
+%>
+
 <h1>Manage Forums</h1>
 <div class="item-group">
  <div class="header">
@@ -19,22 +25,26 @@
  <table>
    <tr>
      <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name" %></td>
+      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_edit? %></td>
    </tr>
    <tr>
      <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position" %></td>
+      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_edit? %></td>
    </tr>
    <tr>
      <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
+      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_edit? } %></td>
    </tr>
    <tr>
      <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
+      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_edit? } %></td>
    </tr>
  </table>
-  <p><%= f.submit "Update Group", class: "btn blue left" %></p>
+  <p><%= f.submit "Update group", class: "btn blue left", disabled: !can_edit? %></p>
 <% end %>
-<p><%= button_to "Delete Group", @group, :method => "delete", data: {confirm: "Delete group?\nForums + Threads will not be accessible!"}, class: "btn red right" %></p>
+<p><%= button_to "Delete group", @group, :method => "delete", data: {confirm: "Delete group?\nForums + Threads will not be accessible!"}, class: "btn red right", disabled: !can_edit? %></p>
 <div class="clear"></div>
+
+<% if !current_user.confirmed? %>
+  <span class='red-alert'>You must confirm your email before you can edit forum groups.</span>
+<% end %>
@@ -1,26 +1,36 @@
 <% title "New Forum: #{@group.name}" %>

-<h1>New Forum Group</h1>
+<%
+  def can_create?
+    admin? && current_user.confirmed?
+  end
+%>
+
+<h1>New forum group</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
 <%= form_for @group do |f|%>
  <table>
    <tr>
      <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name" %></td>
+      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_create? %></td>
    </tr>
    <tr>
      <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position" %></td>
+      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_create? %></td>
    </tr>
    <tr>
      <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
+      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_create? } %></td>
    </tr>
    <tr>
      <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
+      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_create? } %></td>
    </tr>
  </table>
-  <p><%= f.submit "Create Group", class: "btn blue left" %></p>
+  <p><%= f.submit "Create group", class: "btn blue left", disabled: !can_create? %></p>
  <div class="clear"></div>
+
+  <% if !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your email before you can create new forum groups.</span>
+  <% end %>
 <% end %>
@@ -1,5 +1,11 @@
 <% title "Edit Forum: #{@forum.name}" %>

+<%
+  def can_edit?
+    admin? && current_user.confirmed?
+  end
+%>
+
 <%= link_to "(Edit) #{@forum.group.name}", edit_forumgroup_path(@forum.group) %> →  <%= @forum.name %>
 <h1>Edit Forum</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
@@ -7,26 +13,30 @@
  <table>
    <tr>
      <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name" %></td>
+      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_edit? %></td>
    </tr>
    <tr>
      <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position" %></td>
+      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_edit? %></td>
    </tr>
    <tr>
      <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
+      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_edit? } %></td>
    </tr>
    <tr>
      <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
+      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_edit? } %></td>
    </tr>
    <tr>
      <td><%= f.label :necro_length, "Necropost warning delay (in days)" %></td>
-      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)" %></td>
+      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)", disabled: !can_edit? %></td>
    </tr>
  </table>
-  <p><%= f.submit "Update Forum", class: "btn blue left" %></p>
+  <p><%= f.submit "Update forum", class: "btn blue left", disabled: !can_edit? %></p>
 <% end %>
-<p><%= button_to "Delete Forum", @forum, method: "delete", data: {confirm: "Delete forum forever?\nThreads won't be accessible!"}, class: "btn red right" %></p>
+<p><%= button_to "Delete forum", @forum, method: "delete", data: {confirm: "Delete forum forever?\nThreads won't be accessible!"}, class: "btn red right", disabled: !can_edit? %></p>
 <div class="clear"></div>
+
+<% if !current_user.confirmed? %>
+  <span class='red-alert'>You must confirm your email before you can edit forums.</span>
+<% end %>
@@ -1,6 +1,6 @@
 <% title "Forums" %>

-<%= link_to "All Threads", forumthreads_path, class: "btn blue right" %>
+<%= link_to "All threads", forumthreads_path, class: "btn blue right" %>
 <br>
 <div id="forum_groups">
  <% @groups.each do |group| %>
@@ -56,6 +56,4 @@

 <% if admin? %>
  <%= link_to "New group", new_forumgroup_path, class: "btn blue" %>
-<% elsif mod? %>
-  <%= link_to "New group", "#", class: "btn blue", disabled: true %>
 <% end %>
@@ -1,5 +1,11 @@
 <% title "New Forum: #{@forum.group.name}" %>

+<%
+  def can_create?
+    admin? && current_user.confirmed?
+  end
+%>
+
 <%= link_to @forum.group, forumgroup_path(@forum.group) %> →  New forum
 <h1>New Forum</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
@@ -7,26 +13,30 @@
  <table>
    <tr>
      <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name" %></td>
+      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_create? %></td>
    </tr>
    <tr>
      <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position" %></td>
+      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_create? %></td>
    </tr>
    <tr>
      <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
+      <td><%= f.select :role_read_id, role_selection, { include_blank: "None"}, { disabled: !can_create? } %></td>
    </tr>
    <tr>
      <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
+      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_create? } %></td>
    </tr>
    <tr>
      <td><%= f.label :necro_length, "Necropost warning delay (in days)" %></td>
-      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)" %></td>
+      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)", disabled: !can_create? %></td>
    </tr>
  </table>
  <%= f.hidden_field :forumgroup_id %>
-  <p><%= f.submit "Create Forum", class: "btn blue left" %></p>
+  <p><%= f.submit "Create forum", class: "btn blue left", disabled: !can_create? %></p>
  <div class="clear"></div>
+
+  <% if !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your email before you can create new forums.</span>
+  <% end %>
 <% end %>
@@ -1,19 +0,0 @@
-atom_feed do |feed|
-  feed.title @forum.name + "'s Latest Threads"
-  feed.updated Time.now
-
-  @threads.limit(10).each do |thread|
-    unless thread.sticky?
-      feed.entry thread do |entry|
-        entry.updated thread.updated_at
-        entry.author do |a|
-          a.name thread.author.name
-          a.uri user_url(thread.author)
-        end
-        entry.url forumthread_url(thread)
-        entry.title thread.title
-        entry.content render_md(thread.content).html_safe, :type => 'html'
-      end
-    end
-  end
-end
@@ -6,7 +6,7 @@
 </h1>
 <% if @forum.can_write?(current_user) %>
  <p>
-    <%= link_to "New Thread", new_forumthread_path(forum: @forum), class: "btn blue" %>
+    <%= link_to "New thread", new_forumthread_path(forum: @forum), class: "btn blue" %>
  </p>
 <% end %>

@@ -11,7 +11,7 @@
  end
 %>

-<h1>Edit Thread</h1>
+<h1>Edit thread</h1>
 <%= link_to @thread.forum.group, forumgroup_path(@thread.forum.group) %> → <%= link_to @thread.forum, @thread.forum %> → <%= link_to @thread, @thread %> → Edit thread
 <%= form_for @thread do |f|%>
  <table>
@@ -35,7 +35,7 @@
    <%= f.text_field :title, placeholder: "Title" %>
  </div>
  <%= render partial: "md_editor", locals: {name: "forumthread[content]", content: @thread.content} %>
-  <p><%= f.submit "Update Thread", class: "btn blue left" %></p>
+  <p><%= f.submit "Update thread", class: "btn blue left" %></p>
 <% end %>
-<%= button_to "Delete Thread", @thread, :method => "delete", data: {confirm: "Delete thread & comments forever?"}, class: "btn red right" %>
+<%= button_to "Delete thread", @thread, :method => "delete", data: {confirm: "Delete thread & comments forever?"}, class: "btn red right" %>
 <div class="clear"></div>
@@ -10,14 +10,14 @@
    if params[:forum]
      text = "forum '#{Forum.find(params[:forum]).name}'"
      if params_list.except(:forum).any?
-        text = "Search Results in #{text} (#{@threads.total_count})"
+        text = "Search results in #{text} (#{@threads.total_count})"
      else
        text = text.capitalize
      end
    elsif params_list.any?
-      text = "Search Results (#{@threads.total_count})"
+      text = "Search results (#{@threads.total_count})"
    else
-      text = "All Threads"
+      text = "All threads"
    end
  %>
  <%= title text %>
@@ -8,7 +8,7 @@
 %>

 <%= link_to @thread.forum.group, forumgroup_path(@thread.forum.group) %> → <%= link_to @thread.forum, @thread.forum %> → New thread
-<h1>New Thread</h1>
+<h1>New thread</h1>
 <%= form_for @thread do |f|%>
  <table>
    <% if mod? %>
@@ -30,6 +30,6 @@
  </div>
  <%= render partial: "md_editor", locals: {name: "forumthread[content]", content: @thread.content} %>
  <%= f.hidden_field :forum_id %>
-  <p><%= f.submit "Create Thread", class: "btn blue left" %></p>
+  <p><%= f.submit "Create thread", class: "btn blue left" %></p>
  <div class="clear"></div>
 <% end %>
@@ -1,10 +1,20 @@
 <% title "Edit Info: #{@info.title}" %>

+<%
+  def can_edit?
+    mod? && current_user.confirmed?
+  end
+%>
+
 <h1>Edit Info</h1>
 <%= form_for @info do |f|%>
-  <%= f.text_field :title%>
-  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content} %>
-  <p><%= f.submit "Update Info", class: "btn blue left" %></p>
+  <%= f.text_field :title, disabled: !can_edit? %>
+  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content, options: {disabled: !can_edit?}} %>
+  <p><%= f.submit "Update Info", class: "btn blue left", disabled: !can_edit? %></p>
 <% end %>
-<p><%= button_to "Delete Info", @info, method: "delete", data: {confirm: "Delete Info forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete Info", @info, method: "delete", data: {confirm: "Are you sure you want to delete this info page?"}, class: "btn red right", disabled: !can_edit? %></p>
 <div class="clear"></div>
+
+<% if !current_user.confirmed? %>
+  <span class='red-alert'>You must confirm your email before you can edit info pages.</span>
+<% end %>
@@ -1,9 +1,19 @@
 <% title "New Info" %>

+<%
+  def can_create?
+    mod? && current_user.confirmed?
+  end
+%>
+
 <h1>New Info</h1>
 <%= form_for @info, url: info_index_path do |f|%>
-  <%= f.text_field :title, placeholder: "Title" %>
-  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content} %>
-  <p><%= f.submit "Create Info", class: "btn blue left" %></p>
+  <%= f.text_field :title, placeholder: "Title", disabled: !can_create? %>
+  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content, options: {disabled: !can_create?}} %>
+  <p><%= f.submit "Create Info", class: "btn blue left", disabled: !can_create? %></p>
  <div class="clear"></div>
+
+  <% if !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your email before you can create new info pages.</span>
+  <% end %>
 <% end %>
@@ -17,8 +17,8 @@
    <%= link_to "https://mstdn.io/@RedstonerServer", title: "Redstoner on Mastodon" do %>
      Mastodon <%= image_tag("mastodon.png") %>
    <% end %> |
-    <%= link_to "https://discord.gg/QjfcPEJ", title: "Redstoner's Official Discord" do %>
-      Discord <%= image_tag("discord.png") %>
+    <%= link_to "http://rdstnr4biap5nao2.onion", title: "Redstoner over Tor" do %>
+      Onion Service <%= image_tag("tor.png") %>
    <% end %>
    <% if current_user %>
      | <%= link_to "/slack/?" + {mail: current_user.try(:email)}.to_param do %>
@@ -26,7 +26,7 @@
        <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
      </p>
    </div>
  </div>
@@ -25,7 +25,7 @@
        <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
      </p>
    </div>
  </div>
@@ -22,7 +22,7 @@
        <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
      </p>
    </div>
  </div>
@@ -24,7 +24,7 @@
        <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
      </p>
    </div>
  </div>
@@ -27,7 +27,7 @@
      <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
      <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
      <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-      <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+      <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
    </p>
  </div>
 </div>
@@ -38,7 +38,7 @@
        <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
        <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
      </p>
    </div>
  </div>
@@ -1,6 +1,6 @@
-<% title "Log In" %>
+<% title "Log in" %>

-<h1>Log In</h1>
+<h1>Log in</h1>
 <p>Not a member? <%= link_to "Join us", signup_path %>!</p>
 <%= form_tag login_path do |f| %>
  <table>
@@ -16,14 +16,6 @@
      <td></td>
      <td><%= link_to "Lost your password?", lost_password_users_path %></td>
    </tr>
-    <tr>
-      <td><%= label_tag :totp_code %></td>
-      <td><%= text_field_tag :totp_code, nil, placeholder: "123456", required: false %></td>
-    </tr>
-    <tr>
-      <td></td>
-      <td>Leave this field blank if you do not have 2FA enabled.</td>
-    </tr>
  </table>
  <p><%= submit_tag "Log in", class: "btn blue" %></p>
 <% end %>
@@ -1,4 +1,4 @@
-<% title "Edit Reply: #{@reply.thread.title}" %>
+<% title "Edit Thread Reply: #{@reply.thread.title}" %>

 <%
  position = @reply.thread.replies.order(:id).index(@reply)
@@ -6,10 +6,10 @@
 %>

 <%= link_to @reply.thread.forum.group, forumgroup_path(@reply.thread.forum.group) %> → <%= link_to @reply.thread.forum, @reply.thread.forum %> → <%= link_to @reply.thread, forumthread_path(@reply.thread, page: page) + "#reply-#{@reply.id}" %> → Edit reply
-<h1>Edit Reply</h1>
+<h1>Edit reply</h1>
 <%= form_for [@reply.thread, @reply] do |f| %>
  <%= render partial: "md_editor", locals: {name: "threadreply[content]", content: @reply.content} %>
  <p><%= f.submit "Reply", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete Reply", [@reply.thread, @reply], method: "delete", data: {confirm: "Delete reply forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete reply", [@reply.thread, @reply], method: "delete", data: {confirm: "Delete reply forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>
@@ -1,6 +1,6 @@
 <% title "Change Password" %>

-<h1>Change Password</h1>
+<h1>Change password</h1>

 <%= form_for @user do |f| %>
  <%= f.text_field :current_password %>
@@ -2,12 +2,12 @@

 <%
  def can_edit?
-    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role)
+    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
  end
 %>

 <%= link_to @user.name, @user %> → Edit
-<h1>Edit Profile</h1>
+<h1>Edit profile</h1>

 <%= form_for @user do |f| %>
  <table>
@@ -23,7 +23,7 @@
          <td>Role</td>
          <td>
            <% if current_user.role >= @user.role %>
-              <%= f.select :role, Role.all_to(current_user.role) %>
+              <%= f.select :role, Role.all_to(current_user.role), {}, { disabled: !can_edit? } %>
            <% end %>
          </td>
        </tr>
@@ -31,7 +31,7 @@
          <td>Badge</td>
          <td>
            <% if current_user.role >= Role.get(:mod) %>
-              <%= f.select :badge, Badge.all %>
+              <%= f.select :badge, Badge.all, {}, { disabled: !can_edit? } %>
            <% end %>
          </td>
        </tr>
@@ -57,7 +57,7 @@
      <tr>
        <td>Twitter username</td>
        <td>
-          <%= f.text_field :twitter, placeholder: "Twitter username", disabled: !(@user.is?(current_user) && confirmed? || (mod? && current_user.role >= @user.role)) %>
+          <%= f.text_field :twitter, placeholder: "Twitter username", disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
@@ -69,15 +69,17 @@
    </tbody>
  </table>

-<p><%= f.submit "Save Profile", class: "btn variable-size left", disabled: (!@user.confirmed? && @user.is?(current_user)) %></p>
+<p><%= f.submit "Save profile", class: "btn variable-size left", disabled: !can_edit? %></p>
 <p>
-  <%= link_to "Login Settings", edit_login_user_path(@user), class: "btn variable-size right" %>
-  <%= link_to "Notification Settings", edit_notifications_user_path(@user), class: "btn variable-size right" %>
-  <%= link_to "Website Settings", edit_website_settings_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Edit login details", edit_login_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Notification settings", edit_notifications_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Website settings", edit_website_settings_user_path(@user), class: "btn variable-size right" %>
 </p>
 <div class="clear"></div>

-<% if !@user.confirmed? %>
+<% if !@user.is?(current_user) && !current_user.confirmed? %>
+  <span class='red-alert'>You must confirm your own email before you can edit other profiles.</span>
+<% elsif !@user.confirmed? %>
  <% if @user.is?(current_user) %>
      <span class='red-alert'>Please confirm your email address first!</span>
    <% else %>
@@ -1,7 +1,7 @@
 <% title "Edit Login Credentials: #{@user.name}" %>

-<%= link_to @user.name, @user %> → Edit Login settings
-<h1>Edit Login Settings</h1>
+<%= link_to @user.name, @user %> → Edit Login credentials
+<h1>Edit Login credentials</h1>


 <%= form_for @user, url: update_login_user_path(@user), method: :put do |f| %>
@@ -25,51 +25,14 @@
          <%= f.password_field :password_confirmation %>
        </td>
      </tr>
-    </tbody>
-  </table>
-  <hr>
-  <table>
-    <tbody>
-      <tr>
-        <td>2FA Enabled</td>
-        <td>
-          <%= f.check_box :totp_enabled %>
-        </td>
-      </tr>
-      <tr>
-        <td>TOTP Secret</td>
-        <td>
-          <% if !@user.totp_enabled? %>
-          <%= f.text_field :totp_secret, :readonly => true %>
-          <% else %>
-          <i>2FA is currently enabled. Disable 2FA to generate a new secret.</i>
-          <% end %>
-        </td>
-      </tr>
-    </tbody>
-  </table>
-  <hr>
-  <table>
-    <tbody>
      <tr>
        <td>Current password</td>
        <td>
          <%= password_field_tag :current_password, nil, disabled: !@user.is?(current_user) %>
        </td>
      </tr>
-      <% if !@user.totp_enabled? %>
-      <tr>
-        <td>TOTP Code</td>
-        <td>
-          <%= text_field_tag :totp_code, nil, disabled: !@user.is?(current_user) %>
-        </td>
-      </tr>
-      <tr>
-        <td></td>
-        <td><i>Leave this field blank if you are not enabling 2FA.</i></td>
-      <% end %>
    </tbody>
  </table>
-  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
+  <p><%= f.submit "Save changes", class: "btn blue left" %></p>
  <div class="clear"></div>
 <% end %>
@@ -1,5 +1,11 @@
 <% title "Edit Notification Settings: #{@user.name}" %>

+<%
+  def can_edit?
+    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
+  end
+%>
+
 <%= link_to @user.name, @user %> → Edit Notification Settings
 <h1>Edit Notification Settings</h1>

@@ -11,13 +17,13 @@
      <tr>
        <td>replies to my thread</td>
        <td>
-          <%= f.check_box :mail_own_thread_reply %>
+          <%= f.check_box :mail_own_thread_reply, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
        <td>replies to a thread I already replied to</td>
        <td>
-          <%= f.check_box :mail_other_thread_reply %>
+          <%= f.check_box :mail_other_thread_reply, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
@@ -26,13 +32,13 @@
          <i>(Currently used for staff only)</i>
        </td>
        <td>
-          <%= f.check_box :mail_own_blogpost_comment %>
+          <%= f.check_box :mail_own_blogpost_comment, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
        <td>comments a blog post I already commented</td>
        <td>
-          <%= f.check_box :mail_other_blogpost_comment %>
+          <%= f.check_box :mail_other_blogpost_comment, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
@@ -40,14 +46,20 @@
          mentions me in a thread or comment
        </td>
        <td>
-          <%= f.check_box :mail_mention %>
+          <%= f.check_box :mail_mention, disabled: !can_edit? %>
        </td>
      </tr>
    </tbody>
  </table>
  <h3>Public Key</h1>
  <p>All notification emails will be encrypted with this key if you supply it.</p>
-  <%= f.text_area :public_key, placeholder: "-----BEGIN PGP PUBLIC KEY BLOCK-----" %>
-  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
+  <%= f.text_area :public_key, placeholder: "-----BEGIN PGP PUBLIC KEY BLOCK-----", disabled: !can_edit? %>
+  <p><%= f.submit "Save changes", class: "btn blue left", disabled: !can_edit? %></p>
  <div class="clear"></div>
+
+  <% if !@user.is?(current_user) && !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your own email before you can edit other user's notification settings.</span>
+  <% elsif !@user.confirmed? && @user.is?(current_user) %>
+    <span class='red-alert'>You need to confirm your email before you can edit your notification settings.</span>
+  <% end %>
 <% end %>
@@ -1,5 +1,11 @@
 <% title "Edit Website Settings: #{@user.name}" %>

+<%
+  def can_edit?
+    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
+  end
+%>
+
 <%= link_to @user.name, @user %> → Edit Website Settings
 <h1>Edit Website Settings</h1>

@@ -8,25 +14,33 @@
  <table>
    <tbody>
      <tr>
-        <td>Header moves with scrolling</td>
+        <td>Header moves with scrolling (Experimental - do not report bugs)</td>
        <td>
-          <%= f.check_box :header_scroll %>
+          <%= f.check_box :header_scroll, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
        <td>Show exact UTC times</td>
        <td>
-          <%= f.check_box :utc_time %>
+          <%= f.check_box :utc_time, disabled: !can_edit? %>
        </td>
      </tr>
      <tr>
-        <td>Dark theme</td>
+        <td>Dark theme*</td>
        <td>
-          <%= f.check_box :dark %>
+          <%= f.check_box :dark, disabled: !can_edit? %>
        </td>
      </tr>
    </tbody>
  </table>
-  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
+  <p><%= f.submit "Save changes", class: "btn blue left", disabled: !can_edit? %></p>
  <div class="clear"></div>
+
+  <% if !@user.is?(current_user) && !current_user.confirmed? %>
+    <span class='red-alert'>You must confirm your own email before you can edit other user's website settings.</span>
+  <% elsif !@user.confirmed? && @user.is?(current_user) %>
+    <span class='red-alert'>You need to confirm your email before you can edit your website settings.</span>
+  <% end %>
 <% end %>
+<br><br><br>
+*Warning: If as a result to enabling this style your eyes get infected with a severe case of eye cancer, we are not reliable for any damage. Please contact your doctor in advance to ensure that in case of infection you will be treated accordingly. Quality theme  brought to you by Redempt™.
@@ -1,6 +1,6 @@
-<% title "Reset Password" %>
+<% title "Reset password" %>

-<h1>Reset Password</h1>
+<h1>Reset password</h1>
 <p>You lost your password? Don't do that!</p>
 <p>Luckily for you, you can reset your password. Please use the command <code>/gettoken &lt;your email address&gt;</code>, then fill in the form below:</p>
 <%= form_tag reset_password_users_path do |f| %>
@@ -22,5 +22,5 @@
      <td><%= password_field_tag :new_password, nil, placeholder: "secret", required: true, pattern: ".{8,}", title: "minimum 8 characters", "x-moz-errormessage" => "minimum 8 characters" %></td>
    </tr>
  </table>
-  <p><%= submit_tag "Reset Password", class: "btn blue" %></p>
+  <p><%= submit_tag "Reset password", class: "btn blue" %></p>
 <% end %>
@@ -1,6 +1,6 @@
-<% title "Sign Up" %>
+<% title "Sign up" %>

-<h1>Sign Up</h1>
+<h1>Sign up</h1>

 <%= form_for @user do |f| %>
  <table>
@@ -38,7 +38,7 @@
    You can find more details in our info page about <a href="/info/15">tokens and website registration</a>.
  </p>

-  <%= f.submit "Sign Up", class: "btn blue" %>
+  <%= f.submit "Sign up", class: "btn blue" %>

  <p>Contact us ingame if you have problems signing up!</p>
 <% end %>
@@ -16,16 +16,27 @@

  <div class="clear"></div>
  <% if @ban_json && (@ban_json["expires"] == "forever" || !(DateTime.parse(@ban_json["expires"]) <= DateTime.now)) %>
-    <span class="user-banned">This user is banned on the server for "<%=@ban_json["reason"]%>"<%=" until #{@ban_json["expires"]}" unless @ban_json["expires"] == "forever"%></span>
+    <% if @user.is?(current_user) %>
+      <span class="user-banned">You are banned on the server for "<%=@ban_json["reason"]%>"<%=" until #{@ban_json["expires"]}" unless @ban_json["expires"] == "forever"%></span>
+    <% else %>
+      <span class="user-banned">This user is banned on the server for "<%=@ban_json["reason"]%>"<%=" until #{@ban_json["expires"]}" unless @ban_json["expires"] == "forever"%></span>
+    <% end %>
  <% end %>
  <% if @user.banned? %>
+    <% if @user.is?(current_user) %>
+      <span class="user-banned">You are banned on the website!</span>
+    <% else %>
      <span class="user-banned">This user is banned on the website!</span>
+    <% end %>
  <% end %>
  <br>
  <% if !@user.confirmed? %>
-    <% if @user.is?(current_user) || mod? %>
-      <span class="user-unconfirmed">Please confirm your email <u><%= @user.email %></u> !</span>
+    <% if @user.is?(current_user) %>
+      <span class="user-unconfirmed">You haven't confirmed your email "<u><%= @user.email %></u>" yet!</span>
      <%= button_to "Resend the confirmation mail", resend_mail_user_path, class: "btn dark", form_class: "inline-block", data: {confirm: "Did you check your spam folder?"} %>
+    <% elsif mod? %>
+      <span class="user-unconfirmed">This user hasn't confirmed their email "<u><%= @user.email %></u>" yet!</span>
+      <%= button_to "Resend the confirmation mail", resend_mail_user_path, class: "btn dark", form_class: "inline-block" %>
    <% else %>
      <span class="user-unconfirmed">This user hasn't confirmed their email yet!</span>
    <% end %>
@@ -1,5 +1,5 @@
 # config valid only for current version of Capistrano
-lock '3.10.1'
+lock '3.4.0'

 set :repo_url, 'https://github.com/RedstonerServer/redstoner.com'

@@ -13,9 +13,9 @@ set :default_environment, {

 set :keep_releases, 5

-set :deploy_to, -> { "/var/www/#{fetch(:application)}" }
+set :deploy_to, -> { "/home/www-data/apps/#{fetch(:application)}" }

-set :rbenv_ruby, '2.5.0-dev'
+set :rbenv_ruby, '2.0.0-p648'

 set :bundle_without, %w{development test}.join(' ')

@@ -37,12 +37,12 @@ Redstoner::Application.configure do
  }

  config.action_mailer.smtp_settings = {
-    address:        ENV["SMTP_ADDRESS"],
-    port:           ENV["SMTP_PORT"],
-    domain:         "redstoner.com",
-    authentication: ENV["SMTP_AUTH"],
-    user_name:      ENV["SMTP_USERNAME"],
-    password:       ENV["SMTP_PASSWORD"],
+    address:        "smtp.gmail.com",
+    port:           587,
+    domain:         "google.com",
+    authentication: "plain",
+    user_name:      "redstonerserver@gmail.com",
+    password:       ENV["GMAIL_PASSWORD"],
  }

 end
@@ -71,12 +71,12 @@ Redstoner::Application.configure do
  }

  config.action_mailer.smtp_settings = {
-    address:        ENV["SMTP_ADDRESS"],
-    port:           ENV["SMTP_PORT"],
-    domain:         "redstoner.com",
-    authentication: ENV["SMTP_AUTH"],
-    user_name:      ENV["SMTP_USERNAME"],
-    password:       ENV["SMTP_PASSWORD"],
+    address:        "smtp.gmail.com",
+    port:           587,
+    domain:         "google.com",
+    authentication: "plain",
+    user_name:      "redstonerserver@gmail.com",
+    password:       ENV["GMAIL_PASSWORD"],
  }

 end
@@ -3,8 +3,8 @@ timeout 15
 preload_app true


-stderr_path "/var/www/redstoner/shared/log/unicorn.stderr.log"
-stdout_path "/var/www/redstoner/shared/log/unicorn.stdout.log"
+stderr_path "/home/www-data/apps/redstoner/shared/log/unicorn.stderr.log"
+stdout_path "/home/www-data/apps/redstoner/shared/log/unicorn.stdout.log"

 before_fork do |server, worker|
  Signal.trap 'TERM' do
@@ -1,6 +0,0 @@
-class AddTotpToUsers < ActiveRecord::Migration
-  def change
-    add_column :users, :totp_secret, :string
-    add_column :users, :totp_enabled, :boolean, default: false
-  end
-end
@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.

-ActiveRecord::Schema.define(version: 20180606223258) do
+ActiveRecord::Schema.define(version: 20171013001146) do

  create_table "badges", force: :cascade do |t|
    t.string  "name",   limit: 191
@@ -154,8 +154,6 @@ ActiveRecord::Schema.define(version: 20180606223258) do
    t.boolean  "header_scroll",                             default: false
    t.boolean  "dark",                                      default: false
    t.text     "public_key",                  limit: 65535
-    t.string   "totp_secret",                   limit: 255
-    t.boolean  "totp_enabled",                              default: false
  end

  add_index "users", ["email"], name: "index_users_on_email", unique: true, using: :btree
Author	SHA1	Message	Date
Logan Fick	40337f9e68	Made having a confirmed email required to manage blog posts.	2017-11-19 15:33:02 -05:00
Logan Fick	42722d03a0	Made having a confirmed email required to manage info pages.	2017-11-11 20:45:25 -05:00
Logan Fick	94fc2bd1a9	Made having a confirmed email required to manage forums.	2017-11-11 20:23:10 -05:00
Logan Fick	780598ca6d	Made having a confirmed email not required to view edit pages.	2017-11-11 19:53:51 -05:00
Logan Fick	ec085121a4	Made new group button not appear to moderators.	2017-11-11 19:41:03 -05:00
Logan Fick	b807a8f4ab	Made having a confirmed email required to manage forum groups.	2017-11-10 16:00:18 -05:00
Logan Fick	e7cd6d6e99	Made the website settings page not editable if user's email is not confirmed.	2017-11-10 15:17:22 -05:00
Logan Fick	badb94ff07	Made the notification settings page not editable if user's email is not confirmed.	2017-11-10 15:05:43 -05:00
Logan Fick	5a534a4dda	Made having a confirmed email required to edit other user profile pages.	2017-11-10 14:33:14 -05:00
Logan Fick	ac583b7351	Changed messages shown by info pages.	2017-11-10 14:31:29 -05:00
Logan Fick	b4af851ad0	Made messages shown on user profile pages more accurate based on who is viewing.	2017-11-10 14:29:19 -05:00