Made line in info suggestions white instead of black

Gemfile

@@ -7,16 +7,17 @@ gem 'jquery-rails'
 gem 'bcrypt' # To use ActiveModel's has_secure_password
 gem 'sanitize'
 gem 'strip_attributes'
-gem 'redcarpet', '~> 3.2.3'
+gem 'redcarpet'
 gem 'hirb' # pretty console output
 gem 'rb-readline'
 gem 'rest-client'
 gem 'activerecord-session_store'
 gem 'highlight_js-rails', github: 'RedstonerServer/highlight_js-rails'
 gem 'kaminari', github: 'jomo/kaminari', branch: 'patch-2' # pagination
-gem 'jquery-textcomplete-rails', github: 'RedstonerServer/jquery-textcomplete-rails' # @mentions
+gem 'jquery-textcomplete-rails' # @mentions
 gem 'actionpack-action_caching', github: 'antulik/actionpack-action_caching', ref: '8c6e52c69315d67437f480da5dce4b7c8737fb32'
 gem 'mail-gpg', github: 'jomo/mail-gpg', ref: 'a666b48ee866dfa3eaa700f9c5edf4d195d0f8c9'
+gem 'totp'
 
 # Gems used only for assets and not required
 # in production environments by default.

Gemfile.lock

@@ -5,15 +5,6 @@ GIT
     highlight_js-rails (8.4)
       rails (>= 3.1.1)
 
-GIT
-  remote: git://github.com/RedstonerServer/jquery-textcomplete-rails.git
-  revision: 8bf23af2d8fa1c5226c2b6889c7796adfe1f8772
-  specs:
-    jquery-textcomplete-rails (0.1.4)
-      coffee-rails (>= 3.2.0)
-      railties (>= 3.2.0)
-      sass-rails (>= 3.2.0)
-
 GIT
   remote: git://github.com/antulik/actionpack-action_caching.git
   revision: 8c6e52c69315d67437f480da5dce4b7c8737fb32
@@ -42,202 +33,224 @@ GIT
 
 GIT
   remote: git://github.com/rails/rails.git
-  revision: 2c8f567e53580872d8c6dfe61201e58793ca131e
+  revision: 3804d017333da16d76d9fc6633faf5635c7b03d7
   branch: 4-2-stable
   specs:
-    actionmailer (4.2.5.1)
+    actionmailer (4.2.10)
-      actionpack (= 4.2.5.1)
+      actionpack (= 4.2.10)
-      actionview (= 4.2.5.1)
+      actionview (= 4.2.10)
-      activejob (= 4.2.5.1)
+      activejob (= 4.2.10)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.5.1)
+    actionpack (4.2.10)
-      actionview (= 4.2.5.1)
+      actionview (= 4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.5.1)
+    actionview (4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (4.2.5.1)
+    activejob (4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       globalid (>= 0.3.0)
-    activemodel (4.2.5.1)
+    activemodel (4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       builder (~> 3.1)
-    activerecord (4.2.5.1)
+    activerecord (4.2.10)
-      activemodel (= 4.2.5.1)
+      activemodel (= 4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       arel (~> 6.0)
-    activesupport (4.2.5.1)
+    activesupport (4.2.10)
       i18n (~> 0.7)
-      json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
       thread_safe (~> 0.3, >= 0.3.4)
       tzinfo (~> 1.1)
-    rails (4.2.5.1)
+    rails (4.2.10)
-      actionmailer (= 4.2.5.1)
+      actionmailer (= 4.2.10)
-      actionpack (= 4.2.5.1)
+      actionpack (= 4.2.10)
-      actionview (= 4.2.5.1)
+      actionview (= 4.2.10)
-      activejob (= 4.2.5.1)
+      activejob (= 4.2.10)
-      activemodel (= 4.2.5.1)
+      activemodel (= 4.2.10)
-      activerecord (= 4.2.5.1)
+      activerecord (= 4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.5.1)
+      railties (= 4.2.10)
       sprockets-rails
-    railties (4.2.5.1)
+    railties (4.2.10)
-      actionpack (= 4.2.5.1)
+      actionpack (= 4.2.10)
-      activesupport (= 4.2.5.1)
+      activesupport (= 4.2.10)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activerecord-session_store (0.1.2)
+    activerecord-session_store (1.1.1)
-      actionpack (>= 4.0.0, < 5)
+      actionpack (>= 4.0)
-      activerecord (>= 4.0.0, < 5)
+      activerecord (>= 4.0)
-      railties (>= 4.0.0, < 5)
+      multi_json (~> 1.11, >= 1.11.2)
-    arel (6.0.3)
+      rack (>= 1.5.2, < 3)
-    bcrypt (3.1.10)
+      railties (>= 4.0)
-    better_errors (2.1.1)
+    airbrussh (1.3.0)
+      sshkit (>= 1.6.1, != 1.7.0)
+    arel (6.0.4)
+    base32 (0.3.2)
+    bcrypt (3.1.11)
+    better_errors (2.4.0)
       coderay (>= 1.0.0)
-      erubis (>= 2.6.6)
+      erubi (>= 1.0.0)
       rack (>= 0.9.0)
-    binding_of_caller (0.7.2)
+    binding_of_caller (0.8.0)
       debug_inspector (>= 0.0.1)
-    builder (3.2.2)
+    builder (3.2.3)
-    capistrano (3.4.0)
+    capistrano (3.10.1)
+      airbrussh (>= 1.0.0)
       i18n
       rake (>= 10.0.0)
-      sshkit (~> 1.3)
+      sshkit (>= 1.9.0)
     capistrano-bundler (1.1.4)
       capistrano (~> 3.1)
       sshkit (~> 1.2)
-    capistrano-rails (1.1.6)
+    capistrano-rails (1.1.8)
       capistrano (~> 3.1)
       capistrano-bundler (~> 1.1)
-    capistrano-rbenv (2.0.4)
+    capistrano-rbenv (2.1.3)
       capistrano (~> 3.1)
       sshkit (~> 1.3)
     choice (0.2.0)
-    coderay (1.1.0)
+    coderay (1.1.2)
-    coffee-rails (4.1.1)
+    coffee-rails (4.2.2)
       coffee-script (>= 2.2.0)
-      railties (>= 4.0.0, < 5.1.x)
+      railties (>= 4.0.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
-    coffee-script-source (1.10.0)
+    coffee-script-source (1.12.2)
-    concurrent-ruby (1.0.0)
+    concurrent-ruby (1.0.5)
-    crass (1.0.2)
+    crass (1.0.3)
-    debug_inspector (0.0.2)
+    debug_inspector (0.0.3)
-    domain_name (0.5.25)
+    domain_name (0.5.20170404)
       unf (>= 0.0.5, < 1.0.0)
+    erubi (1.7.1)
     erubis (2.7.0)
-    execjs (2.6.0)
+    execjs (2.7.0)
-    globalid (0.3.6)
+    ffi (1.9.23)
-      activesupport (>= 4.1.0)
+    globalid (0.4.1)
-    gpgme (2.0.11)
+      activesupport (>= 4.2.0)
-      mini_portile (>= 0.5.0)
+    gpgme (2.0.16)
+      mini_portile2 (~> 2.3)
     hirb (0.7.3)
-    http-cookie (1.0.2)
+    http-cookie (1.0.3)
       domain_name (~> 0.5)
-    i18n (0.7.0)
+    i18n (0.9.5)
-    jquery-rails (4.1.0)
+      concurrent-ruby (~> 1.0)
-      rails-dom-testing (~> 1.0)
+    jquery-rails (4.3.1)
+      rails-dom-testing (>= 1, < 3)
       railties (>= 4.2.0)
       thor (>= 0.14, < 2.0)
-    json (1.8.3)
+    jquery-textcomplete-rails (0.1.5)
-    kgio (2.10.0)
+      coffee-rails (>= 3.2.0)
-    loofah (2.0.3)
+      railties (>= 3.2.0)
+      sass-rails (>= 3.2.0)
+    kgio (2.11.2)
+    loofah (2.2.2)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
-    mail (2.6.3)
+    mail (2.7.0)
-      mime-types (>= 1.16, < 3)
+      mini_mime (>= 0.1.1)
-    mime-types (2.99)
+    mime-types (3.1)
-    mini_portile (0.6.2)
+      mime-types-data (~> 3.2015)
-    mini_portile2 (2.0.0)
+    mime-types-data (3.2016.0521)
-    minitest (5.8.4)
+    mini_mime (1.0.0)
-    mysql2 (0.4.2)
+    mini_portile2 (2.3.0)
+    minitest (5.11.3)
+    multi_json (1.13.1)
+    mysql2 (0.4.10)
     net-scp (1.2.1)
       net-ssh (>= 2.6.5)
-    net-ssh (3.0.2)
+    net-ssh (4.2.0)
     netrc (0.11.0)
-    nokogiri (1.6.7.2)
+    nokogiri (1.8.2)
-      mini_portile2 (~> 2.0.0.rc2)
+      mini_portile2 (~> 2.3.0)
-    nokogumbo (1.4.7)
+    nokogumbo (1.5.0)
       nokogiri
-    rack (1.6.4)
+    rack (1.6.9)
     rack-test (0.6.3)
       rack (>= 1.0)
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
-    rails-dom-testing (1.0.7)
+    rails-dom-testing (1.0.9)
-      activesupport (>= 4.2.0.beta, < 5.0)
+      activesupport (>= 4.2.0, < 5.0)
-      nokogiri (~> 1.6.0)
+      nokogiri (~> 1.6)
       rails-deprecated_sanitizer (>= 1.0.1)
-    rails-erd (1.4.5)
+    rails-erd (1.5.2)
       activerecord (>= 3.2)
       activesupport (>= 3.2)
       choice (~> 0.2.0)
       ruby-graphviz (~> 1.2)
-    rails-html-sanitizer (1.0.3)
+    rails-html-sanitizer (1.0.4)
-      loofah (~> 2.0)
+      loofah (~> 2.2, >= 2.2.2)
-    raindrops (0.15.0)
+    raindrops (0.19.0)
-    rake (10.5.0)
+    rake (12.3.0)
-    rb-readline (0.5.3)
+    rb-fsevent (0.10.3)
-    redcarpet (3.2.3)
+    rb-inotify (0.9.10)
-    rest-client (1.8.0)
+      ffi (>= 0.5.0, < 2)
+    rb-readline (0.5.5)
+    redcarpet (3.4.0)
+    rest-client (2.0.2)
       http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 3.0)
+      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.7)
+      netrc (~> 0.8)
-    ruby-graphviz (1.2.2)
+    ruby-graphviz (1.2.3)
-    sanitize (4.0.1)
+    sanitize (4.6.4)
       crass (~> 1.0.2)
       nokogiri (>= 1.4.4)
-      nokogumbo (~> 1.4.1)
+      nokogumbo (~> 1.4)
-    sass (3.4.21)
+    sass (3.5.5)
-    sass-rails (5.0.4)
+      sass-listen (~> 4.0.0)
-      railties (>= 4.0.0, < 5.0)
+    sass-listen (4.0.0)
+      rb-fsevent (~> 0.9, >= 0.9.4)
+      rb-inotify (~> 0.9, >= 0.9.7)
+    sass-rails (5.0.7)
+      railties (>= 4.0.0, < 6)
       sass (~> 3.1)
       sprockets (>= 2.8, < 4.0)
       sprockets-rails (>= 2.0, < 4.0)
       tilt (>= 1.1, < 3)
-    sprockets (3.5.2)
+    sprockets (3.7.1)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.0.0)
+    sprockets-rails (3.2.1)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
-    sqlite3 (1.3.11)
+    sqlite3 (1.3.13)
-    sshkit (1.8.1)
+    sshkit (1.16.0)
       net-scp (>= 1.1.2)
       net-ssh (>= 2.8.0)
-    strip_attributes (1.7.1)
+    strip_attributes (1.8.0)
-      activemodel (>= 3.0, < 5.0)
+      activemodel (>= 3.0, < 6.0)
-    thor (0.19.1)
+    thor (0.20.0)
-    thread_safe (0.3.5)
+    thread_safe (0.3.6)
-    tilt (2.0.2)
+    tilt (2.0.8)
-    tzinfo (1.2.2)
+    totp (1.0.0)
+      base32
+    tzinfo (1.2.5)
       thread_safe (~> 0.1)
-    uglifier (2.7.2)
+    uglifier (4.1.8)
-      execjs (>= 0.3.0)
+      execjs (>= 0.3.0, < 3)
-      json (>= 1.8.0)
     unf (0.1.4)
       unf_ext
-    unf_ext (0.0.7.1)
+    unf_ext (0.0.7.5)
-    unicorn (5.0.1)
+    unicorn (5.4.0)
       kgio (~> 2.6)
-      rack
       raindrops (~> 0.7)
-    webrick (1.3.1)
+    webrick (1.4.2)
 
 PLATFORMS
   ruby
@@ -254,23 +267,24 @@ DEPENDENCIES
   highlight_js-rails!
   hirb
   jquery-rails
-  jquery-textcomplete-rails!
+  jquery-textcomplete-rails
   kaminari!
   mail-gpg!
   mysql2
   rails!
   rails-erd
   rb-readline
-  redcarpet (~> 3.2.3)
+  redcarpet
   rest-client
   sanitize
   sass-rails
   sqlite3
   strip_attributes
+  totp
   tzinfo-data
   uglifier
   unicorn
   webrick
 
 BUNDLED WITH
-   1.11.2
+   1.16.2

app/assets/stylesheets/dark.css.scss

@@ -103,3 +103,12 @@ textarea {
 .notice {
     color:white;
 }
+.info-suggestions {
+    a:not(:hover) {
+        color: gray;
+    }
+
+    a:first-child {
+        border-right: 1px solid white !important;
+    }
+}

app/controllers/application_controller.rb

@@ -1,6 +1,6 @@
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  before_filter :update_ip, :update_seen, :check_banned
+  before_filter :update_ip, :update_seen, :check_banned, :check_2fa
   # TODO: use SSL
 
 
@@ -41,6 +41,14 @@ class ApplicationController < ActionController::Base
     end
   end
 
+  def check_2fa
+    # Over complicated way of asking if the user is logged in as a mod without TOTP enabled while they are not on their login settings screen, logging out, or updating their login settings.
+    if current_user && current_user.mod? && !current_user.totp_enabled? && !(controller_name == "users" && action_name == "edit_login") && !(controller_name == "sessions" && action_name == "destroy") && !(controller_name == "users" && action_name == "update_login")
+      flash[:alert] = "Due to your staff rank, you are required to enable 2FA."
+      redirect_to :controller => "users", :action => "edit_login", :id => current_user.id
+    end
+  end
+
 
   #roles
   def disabled?

app/controllers/blogposts_controller.rb

@@ -69,7 +69,7 @@ class BlogpostsController < ApplicationController
   end
 
   def auth
-    unless mod? && current_user.confirmed?
+    unless mod?
       flash[:alert] = "You are not allowed to edit posts!"
       redirect_to @post ? @post : blogposts_path
     end

app/controllers/forumgroups_controller.rb

@@ -17,7 +17,7 @@ class ForumgroupsController < ApplicationController
   end
 
   def update
-    if admin? && current_user.confirmed?
+    if admin?
       @group = Forumgroup.find(params[:id])
       if @group.update_attributes(group_params)
         flash[:notice] = "Forum group updated"
@@ -41,7 +41,7 @@ class ForumgroupsController < ApplicationController
   end
 
   def create
-    if admin? && current_user.confirmed?
+    if admin?
       @group = Forumgroup.new(group_params)
       if @group.save
         flash[:notice] = "Forum group created."
@@ -57,7 +57,7 @@ class ForumgroupsController < ApplicationController
   end
 
   def destroy
-    if admin? && current_user.confirmed?
+    if admin?
       @group = Forumgroup.find(params[:id])
       if @group.destroy
         flash[:notice] = "forum group deleted."

app/controllers/forums_controller.rb

@@ -34,7 +34,7 @@ class ForumsController < ApplicationController
   end
 
   def update
-    if admin? && current_user.confirmed?
+    if admin?
       if @forum.update_attributes(forum_params)
         flash[:notice] = "Forum updated"
         redirect_to @forum
@@ -48,7 +48,7 @@ class ForumsController < ApplicationController
   end
 
   def create
-    if admin? && current_user.confirmed?
+    if admin?
       @forum = Forum.new(forum_params([:forumgroup_id]))
       if @forum.save
         flash[:notice] = "Forum created."
@@ -64,7 +64,7 @@ class ForumsController < ApplicationController
   end
 
   def destroy
-    if admin? && current_user.confirmed?
+    if admin?
       if @forum.destroy
         flash[:notice] = "Forum deleted."
       else

app/controllers/info_controller.rb

@@ -22,9 +22,9 @@ class InfoController < ApplicationController
   def create
     @info = Info.new(info_params)
     if @info.save
-      redirect_to @info, notice: 'The info page has been created!'
+      redirect_to @info, notice: 'Info has been created.'
     else
-      flash[:alert] = "An error occured while creating the info page."
+      flash[:alert] = "Error creating info"
       render action: "new"
     end
   end
@@ -32,18 +32,18 @@ class InfoController < ApplicationController
   def update
     @info.attributes = info_params()
     if @info.save
-      redirect_to @info, notice: 'The info page has been updated!'
+      redirect_to @info, notice: 'Info has been updated.'
     else
-      flash[:alert] = "An error occured while updating the info page."
+      flash[:alert] = "There was a problem while updating the info"
       render action: "edit"
     end
   end
 
   def destroy
     if @info.destroy
-      flash[:notice] = "The info page has been deleted!"
+      flash[:notice] = "Info deleted!"
     else
-      flash[:alert] = "An error occured while deleting the info page."
+      flash[:alert] = "There was a problem while deleting this info"
     end
     redirect_to info_index_path
   end
@@ -62,8 +62,8 @@ class InfoController < ApplicationController
   end
 
   def auth
-    unless mod? && current_user.confirmed?
+    unless mod?
-      flash[:alert] = "You are not allowed to edit info pages!"
+      flash[:alert] = "You are not allowed to edit info!"
       redirect_to @info ? @info : info_index_path
     end
   end

app/controllers/sessions_controller.rb

@@ -21,6 +21,10 @@ class SessionsController < ApplicationController
           flash[:alert] = "Your account has been disabled!"
         elsif user.banned?
           flash[:alert] = "You are banned!"
+        elsif user.totp_enabled && !TOTP.valid?(user.totp_secret, params[:totp_code].to_i)
+          flash[:alert] = "You're doing it wrong!"
+          render action: 'new'
+          return
         else
           session[:user_id] = user.id
           flash[:notice] = "Logged in!"

app/controllers/statics_controller.rb

@@ -20,7 +20,7 @@ class StaticsController < ApplicationController
     @players = []
     @count = 0
     begin
-      json = JSON.parse(File.read("/etc/minecraft/redstoner/plugins/ModuleLoader/players.json"))
+      json = JSON.parse(File.read("/etc/minecraft/info/players.json"))
     rescue
       flash.now[:alert] = "The server is currently offline."
     else

app/controllers/users_controller.rb

@@ -17,13 +17,9 @@ class UsersController < ApplicationController
 
   def show
     begin
-      @ban_json = JSON.parse(File.read("/etc/minecraft/redstoner/banned-players.json")).detect {|u| u["uuid"].tr("-", "") == @user.uuid}
+      @ban_json = JSON.parse(File.read("/etc/minecraft/info/banned-players.json")).detect {|u| u["uuid"].tr("-", "") == @user.uuid}
     rescue
-      if @user.is?(current_user)
-        flash.now[:alert] = "An error occured while checking if you are banned from the server!"
-      else
       flash.now[:alert] = "An error occured while checking if this user is banned from the server!"
-      end
       @ban_json = nil
     end
   end
@@ -91,6 +87,12 @@ class UsersController < ApplicationController
         @user.uuid = user_profile["id"]
         @user.ign  = user_profile["name"] # correct case
 
+        if User.find_by(uuid: @user.uuid)
+          flash[:alert] = "You already have a Redstoner account associated with this Minecraft account. Please log in instead."
+          redirect_to login_path
+          return
+        end
+
         if validate_token(@user.uuid, @user.email, params[:registration_token])
           destroy_token(params[:email])
           @user.last_ip = request.remote_ip # showing in mail
@@ -135,7 +137,7 @@ class UsersController < ApplicationController
   end
 
   def resend_mail
-    if (@user.is?(current_user) || (mod? && current_user.confirmed?)) && !@user.confirmed?
+    if (@user.is?(current_user) || mod?) && !@user.confirmed?
       RedstonerMailer.register_mail(@user, false).deliver_now
       flash[:notice] = "Check your inbox for the confirmation mail."
     else
@@ -145,7 +147,7 @@ class UsersController < ApplicationController
   end
 
   def update
-    if (mod? && current_user.role >= @user.role && current_user.confirmed?) || (@user.is?(current_user) && confirmed?)
+    if (mod? && current_user.role >= @user.role ) || (@user.is?(current_user) && confirmed?)
       if mod?
         userdata = user_params([:name, :skype, :youtube, :twitter, :about, :role, :badge, :confirmed, :header_scroll, :utc_time, :dark])
       else
@@ -188,7 +190,7 @@ class UsersController < ApplicationController
   end
 
   def ban
-    if mod? && current_user.role >= @user.role && current_user.confirmed?
+    if mod? && current_user.role >= @user.role
       @user.role = Role.get :banned
       flash[:notice] = "'#{@user.name}' has been banned!"
     else
@@ -198,7 +200,7 @@ class UsersController < ApplicationController
   end
 
   def unban
-    if mod? && current_user.role >= @user.role && current_user.confirmed?
+    if mod? && current_user.role >= @user.role
       @user.role = Role.get :normal
       flash[:notice] = "\"#{@user.name}\" has been unbanned!"
     else
@@ -208,7 +210,7 @@ class UsersController < ApplicationController
   end
 
   def destroy
-    if superadmin? && current_user.confirmed?
+    if superadmin?
       if @user.destroy
         flash[:notice] = "User deleted forever."
         redirect_to users_url
@@ -223,28 +225,33 @@ class UsersController < ApplicationController
   end
 
   def edit_notifications
-    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
+    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
       flash[:alert] = "You are not allowed to edit this user's notification settings!"
       redirect_to @user
     end
   end
 
   def edit_login
-    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
+    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
       flash[:alert] = "You are not allowed to edit this user's login details!"
       redirect_to @user
+      return
+    end
+
+    if !@user.totp_enabled
+      @user.update(totp_secret: TOTP.secret)
     end
   end
 
   def edit_website_settings
-    unless @user.is?(current_user) || (admin? && current_user.role > @user.role) || superadmin?
+    unless @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
       flash[:alert] = "You are not allowed to edit this user's website settings!"
       redirect_to @user
     end
   end
 
   def update_login
-    if @user.is?(current_user) || (admin? && current_user.role > @user.role && current_user.confirmed?) || (superadmin? && current_user.confirmed?)
+    if @user.is?(current_user) || admin? && current_user.role > @user.role || superadmin?
       authenticated = !@user.is?(current_user) || @user.authenticate(params[:current_password])
       if params[:user][:password].present?
         @user.password              = params[:user][:password]
@@ -255,6 +262,18 @@ class UsersController < ApplicationController
       @user.email_token = SecureRandom.hex(16) if mail_changed
       @user.confirmed   = !mail_changed
 
+      if params[:user][:totp_enabled] == "1" && !@user.totp_enabled
+        if TOTP.valid?(@user.totp_secret, params[:totp_code].to_i)
+          @user.totp_enabled = true
+        else
+          flash[:alert] = "Wrong TOTP code!"
+          render action: "edit_login"
+          return
+        end
+      elsif params[:user][:totp_enabled] == "0" && @user.totp_enabled
+        @user.totp_enabled = false
+      end
+
       # checking here for password so we can send back changes to the view
       if authenticated
         if @user.save
@@ -362,7 +381,7 @@ class UsersController < ApplicationController
   end
 
   def user_params(add = [])
-    a = [:ign, :email, :password, :password_confirmation, :mail_own_thread_reply, :mail_other_thread_reply, :mail_own_blogpost_comment, :mail_other_blogpost_comment, :mail_mention, :public_key] + add
+    a = [:ign, :email, :password, :password_confirmation, :mail_own_thread_reply, :mail_other_thread_reply, :mail_own_blogpost_comment, :mail_other_blogpost_comment, :mail_mention, :public_key, :totp_code] + add
     params.require(:user).permit(a)
   end
 end

app/mailers/redstoner_mailer.rb

@@ -1,8 +1,8 @@
 class RedstonerMailer < ActionMailer::Base
 
   add_template_helper(ApplicationHelper)
-  default from: "info@redstoner.com"
+  default from: "\"Redstoner\" <noreply@redstoner.com>"
-  default reply_to: "redstonerserver+website@gmail.com"
+  default reply_to: "staff@redstoner.com"
 
   def register_mail(user, uses_mc_pass)
     @user = user

app/views/blogposts/edit.html.erb

@@ -1,20 +1,10 @@
-<% title "Edit News: #{@post.title}" %>
+<% title "Edit Post: #{@post.title}" %>
 
-<%
+<h1>Edit Post: #{@post.title}</h1>
-  def can_edit?
-    mod? && current_user.confirmed?
-  end
-%>
-
-<h1>Edit post</h1>
 <%= form_for @post do |f|%>
-  <%= f.text_field :title, disabled: !can_edit? %>
+  <%= f.text_field :title %>
-  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content, options: {disabled: !can_edit?}} %>
+  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content} %>
-  <p><%= f.submit "Update Post", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Update Post", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete post", @post, method: "delete", data: {confirm: "Delete post & comments forever?"}, class: "btn red right", disabled: !can_edit? %></p>
+<p><%= button_to "Delete Post", @post, method: "delete", data: {confirm: "Delete post & comments forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>
-
-<% if !current_user.confirmed? %>
-  <span class='red-alert'>You must confirm your email before you can edit blog posts.</span>
-<% end %>

app/views/blogposts/index.html.erb

@@ -1,7 +1,7 @@
 <% title "News" %>
 
 <h1>News</h1>
-<%= link_to 'Make new Post', new_blogpost_path, class: "btn blue" if mod? %>
+<%= link_to 'New Post', new_blogpost_path, class: "btn blue" if mod? %>
 <div id="posts">
   <% @posts.each do |p| %>
     <div class="item-group with-avatar" id="post-<%= p.id %>">

app/views/blogposts/new.html.erb

@@ -1,19 +1,9 @@
 <% title "New Blog Post" %>
 
-<%
-  def can_create?
-    admin? && current_user.confirmed?
-  end
-%>
-
 <h1>New Post</h1>
 <%= form_for @post do |f|%>
-  <%= f.text_field :title, placeholder: "Title", disabled: !can_create? %>
+  <%= f.text_field :title, placeholder: "Title" %>
-  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content, options: {disabled: !can_create?}} %>
+  <%= render partial: "md_editor", locals: {name: "blogpost[content]", content: @post.content} %>
-  <p><%= f.submit "Create Post", class: "btn blue left", disabled: !can_create? %></p>
+  <p><%= f.submit "Create Post", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your email before you can create new blog posts.</span>
-  <% end %>
 <% end %>

app/views/comments/_new.html.erb

@@ -1,4 +1,4 @@
-<h3>New comment</h3>
+<h3>New Comment</h3>
 <%= form_for [@post, @comment] do |f| %>
   <%= render partial: "md_editor", locals: {name: "comment[content]", content: @comment.content} %>
   <p><%= f.submit class: "btn blue" %></p>

app/views/comments/edit.html.erb

@@ -1,10 +1,10 @@
 <% title "Edit Comment: #{@comment.blogpost.title}" %>
 
-<h1>Edit comment</h1>
+<h1>Edit Comment</h1>
 
 <%= form_for [@comment.blogpost, @comment] do |f| %>
   <%= render partial: "md_editor", locals: {name: "comment[content]", content: @comment.content} %>
   <p><%= f.submit "Update Comment", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete comment", [@comment.blogpost, @comment] , method: "delete", data: {confirm: "Delete comment forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete Comment", [@comment.blogpost, @comment] , method: "delete", data: {confirm: "Delete comment forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>

app/views/forumgroups/edit.html.erb

@@ -1,11 +1,5 @@
 <% title "Manage Forums" %>
 
-<%
-  def can_edit?
-    admin? && current_user.confirmed?
-  end
-%>
-
 <h1>Manage Forums</h1>
 <div class="item-group">
   <div class="header">
@@ -25,26 +19,22 @@
   <table>
     <tr>
       <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_edit? %></td>
+      <td><%= f.text_field :name, placeholder: "Name" %></td>
     </tr>
     <tr>
       <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_edit? %></td>
+      <td><%= f.number_field :position, placeholder: "Position" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_edit? } %></td>
+      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_edit? } %></td>
+      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
     </tr>
   </table>
-  <p><%= f.submit "Update group", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Update Group", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete group", @group, :method => "delete", data: {confirm: "Delete group?\nForums + Threads will not be accessible!"}, class: "btn red right", disabled: !can_edit? %></p>
+<p><%= button_to "Delete Group", @group, :method => "delete", data: {confirm: "Delete group?\nForums + Threads will not be accessible!"}, class: "btn red right" %></p>
 <div class="clear"></div>
-
-<% if !current_user.confirmed? %>
-  <span class='red-alert'>You must confirm your email before you can edit forum groups.</span>
-<% end %>

app/views/forumgroups/new.html.erb

@@ -1,36 +1,26 @@
 <% title "New Forum: #{@group.name}" %>
 
-<%
+<h1>New Forum Group</h1>
-  def can_create?
-    admin? && current_user.confirmed?
-  end
-%>
-
-<h1>New forum group</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
 <%= form_for @group do |f|%>
   <table>
     <tr>
       <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_create? %></td>
+      <td><%= f.text_field :name, placeholder: "Name" %></td>
     </tr>
     <tr>
       <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_create? %></td>
+      <td><%= f.number_field :position, placeholder: "Position" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_create? } %></td>
+      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_create? } %></td>
+      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
     </tr>
   </table>
-  <p><%= f.submit "Create group", class: "btn blue left", disabled: !can_create? %></p>
+  <p><%= f.submit "Create Group", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your email before you can create new forum groups.</span>
-  <% end %>
 <% end %>

app/views/forums/edit.html.erb

@@ -1,11 +1,5 @@
 <% title "Edit Forum: #{@forum.name}" %>
 
-<%
-  def can_edit?
-    admin? && current_user.confirmed?
-  end
-%>
-
 <%= link_to "(Edit) #{@forum.group.name}", edit_forumgroup_path(@forum.group) %> →  <%= @forum.name %>
 <h1>Edit Forum</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
@@ -13,30 +7,26 @@
   <table>
     <tr>
       <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_edit? %></td>
+      <td><%= f.text_field :name, placeholder: "Name" %></td>
     </tr>
     <tr>
       <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_edit? %></td>
+      <td><%= f.number_field :position, placeholder: "Position" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, { include_blank: "None" }, { disabled: !can_edit? } %></td>
+      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_edit? } %></td>
+      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
     </tr>
     <tr>
       <td><%= f.label :necro_length, "Necropost warning delay (in days)" %></td>
-      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)", disabled: !can_edit? %></td>
+      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)" %></td>
     </tr>
   </table>
-  <p><%= f.submit "Update forum", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Update Forum", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete forum", @forum, method: "delete", data: {confirm: "Delete forum forever?\nThreads won't be accessible!"}, class: "btn red right", disabled: !can_edit? %></p>
+<p><%= button_to "Delete Forum", @forum, method: "delete", data: {confirm: "Delete forum forever?\nThreads won't be accessible!"}, class: "btn red right" %></p>
 <div class="clear"></div>
-
-<% if !current_user.confirmed? %>
-  <span class='red-alert'>You must confirm your email before you can edit forums.</span>
-<% end %>

app/views/forums/index.html.erb

@@ -1,6 +1,6 @@
 <% title "Forums" %>
 
-<%= link_to "All threads", forumthreads_path, class: "btn blue right" %>
+<%= link_to "All Threads", forumthreads_path, class: "btn blue right" %>
 <br>
 <div id="forum_groups">
   <% @groups.each do |group| %>
@@ -56,4 +56,6 @@
 
 <% if admin? %>
   <%= link_to "New group", new_forumgroup_path, class: "btn blue" %>
+<% elsif mod? %>
+  <%= link_to "New group", "#", class: "btn blue", disabled: true %>
 <% end %>

app/views/forums/new.html.erb

@@ -1,11 +1,5 @@
 <% title "New Forum: #{@forum.group.name}" %>
 
-<%
-  def can_create?
-    admin? && current_user.confirmed?
-  end
-%>
-
 <%= link_to @forum.group, forumgroup_path(@forum.group) %> →  New forum
 <h1>New Forum</h1>
 <% role_selection = Role.all_from_to(:normal, :admin).collect{|p|[p.name, p.id]} %>
@@ -13,30 +7,26 @@
   <table>
     <tr>
       <td><%= f.label :name %></td>
-      <td><%= f.text_field :name, placeholder: "Name", disabled: !can_create? %></td>
+      <td><%= f.text_field :name, placeholder: "Name" %></td>
     </tr>
     <tr>
       <td><%= f.label :position %></td>
-      <td><%= f.number_field :position, placeholder: "Position", disabled: !can_create? %></td>
+      <td><%= f.number_field :position, placeholder: "Position" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_read_id, "Min. read role" %></td>
-      <td><%= f.select :role_read_id, role_selection, { include_blank: "None"}, { disabled: !can_create? } %></td>
+      <td><%= f.select :role_read_id, role_selection, include_blank: "None" %></td>
     </tr>
     <tr>
       <td><%= f.label :role_write_id, "Min. write role" %></td>
-      <td><%= f.select :role_write_id, role_selection, { include_blank: false }, { disabled: !can_create? } %></td>
+      <td><%= f.select :role_write_id, role_selection, include_blank: false %></td>
     </tr>
     <tr>
       <td><%= f.label :necro_length, "Necropost warning delay (in days)" %></td>
-      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)", disabled: !can_create? %></td>
+      <td><%= f.number_field :necro_length, placeholder: "Warning Delay (leave blank for no warning)" %></td>
     </tr>
   </table>
   <%= f.hidden_field :forumgroup_id %>
-  <p><%= f.submit "Create forum", class: "btn blue left", disabled: !can_create? %></p>
+  <p><%= f.submit "Create Forum", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your email before you can create new forums.</span>
-  <% end %>
 <% end %>

app/views/forums/show.atom.builder

@@ -0,0 +1,19 @@
+atom_feed do |feed|
+  feed.title @forum.name + "'s Latest Threads"
+  feed.updated Time.now
+
+  @threads.limit(10).each do |thread|
+    unless thread.sticky?
+      feed.entry thread do |entry|
+        entry.updated thread.updated_at
+        entry.author do |a|
+          a.name thread.author.name
+          a.uri user_url(thread.author)
+        end
+        entry.url forumthread_url(thread)
+        entry.title thread.title
+        entry.content render_md(thread.content).html_safe, :type => 'html'
+      end
+    end
+  end
+end

app/views/forums/show.html.erb

@@ -6,7 +6,7 @@
 </h1>
 <% if @forum.can_write?(current_user) %>
   <p>
-    <%= link_to "New thread", new_forumthread_path(forum: @forum), class: "btn blue" %>
+    <%= link_to "New Thread", new_forumthread_path(forum: @forum), class: "btn blue" %>
   </p>
 <% end %>
 

app/views/forumthreads/edit.html.erb

@@ -11,7 +11,7 @@
   end
 %>
 
-<h1>Edit thread</h1>
+<h1>Edit Thread</h1>
 <%= link_to @thread.forum.group, forumgroup_path(@thread.forum.group) %> → <%= link_to @thread.forum, @thread.forum %> → <%= link_to @thread, @thread %> → Edit thread
 <%= form_for @thread do |f|%>
   <table>
@@ -35,7 +35,7 @@
     <%= f.text_field :title, placeholder: "Title" %>
   </div>
   <%= render partial: "md_editor", locals: {name: "forumthread[content]", content: @thread.content} %>
-  <p><%= f.submit "Update thread", class: "btn blue left" %></p>
+  <p><%= f.submit "Update Thread", class: "btn blue left" %></p>
 <% end %>
-<%= button_to "Delete thread", @thread, :method => "delete", data: {confirm: "Delete thread & comments forever?"}, class: "btn red right" %>
+<%= button_to "Delete Thread", @thread, :method => "delete", data: {confirm: "Delete thread & comments forever?"}, class: "btn red right" %>
 <div class="clear"></div>

app/views/forumthreads/index.html.erb

@@ -10,14 +10,14 @@
     if params[:forum]
       text = "forum '#{Forum.find(params[:forum]).name}'"
       if params_list.except(:forum).any?
-        text = "Search results in #{text} (#{@threads.total_count})"
+        text = "Search Results in #{text} (#{@threads.total_count})"
       else
         text = text.capitalize
       end
     elsif params_list.any?
-      text = "Search results (#{@threads.total_count})"
+      text = "Search Results (#{@threads.total_count})"
     else
-      text = "All threads"
+      text = "All Threads"
     end
   %>
   <%= title text %>

app/views/forumthreads/new.html.erb

@@ -8,7 +8,7 @@
 %>
 
 <%= link_to @thread.forum.group, forumgroup_path(@thread.forum.group) %> → <%= link_to @thread.forum, @thread.forum %> → New thread
-<h1>New thread</h1>
+<h1>New Thread</h1>
 <%= form_for @thread do |f|%>
   <table>
     <% if mod? %>
@@ -30,6 +30,6 @@
   </div>
   <%= render partial: "md_editor", locals: {name: "forumthread[content]", content: @thread.content} %>
   <%= f.hidden_field :forum_id %>
-  <p><%= f.submit "Create thread", class: "btn blue left" %></p>
+  <p><%= f.submit "Create Thread", class: "btn blue left" %></p>
   <div class="clear"></div>
 <% end %>

app/views/info/edit.html.erb

@@ -1,20 +1,10 @@
 <% title "Edit Info: #{@info.title}" %>
 
-<%
-  def can_edit?
-    mod? && current_user.confirmed?
-  end
-%>
-
 <h1>Edit Info</h1>
 <%= form_for @info do |f|%>
-  <%= f.text_field :title, disabled: !can_edit? %>
+  <%= f.text_field :title%>
-  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content, options: {disabled: !can_edit?}} %>
+  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content} %>
-  <p><%= f.submit "Update Info", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Update Info", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete Info", @info, method: "delete", data: {confirm: "Are you sure you want to delete this info page?"}, class: "btn red right", disabled: !can_edit? %></p>
+<p><%= button_to "Delete Info", @info, method: "delete", data: {confirm: "Delete Info forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>
-
-<% if !current_user.confirmed? %>
-  <span class='red-alert'>You must confirm your email before you can edit info pages.</span>
-<% end %>

app/views/info/new.html.erb

@@ -1,19 +1,9 @@
 <% title "New Info" %>
 
-<%
-  def can_create?
-    mod? && current_user.confirmed?
-  end
-%>
-
 <h1>New Info</h1>
 <%= form_for @info, url: info_index_path do |f|%>
-  <%= f.text_field :title, placeholder: "Title", disabled: !can_create? %>
+  <%= f.text_field :title, placeholder: "Title" %>
-  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content, options: {disabled: !can_create?}} %>
+  <%= render partial: "md_editor", locals: {name: "info[content]", content: @info.content} %>
-  <p><%= f.submit "Create Info", class: "btn blue left", disabled: !can_create? %></p>
+  <p><%= f.submit "Create Info", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your email before you can create new info pages.</span>
-  <% end %>
 <% end %>

app/views/layouts/_footer.html.erb

@@ -17,8 +17,8 @@
     <%= link_to "https://mstdn.io/@RedstonerServer", title: "Redstoner on Mastodon" do %>
       Mastodon <%= image_tag("mastodon.png") %>
     <% end %> |
-    <%= link_to "http://rdstnr4biap5nao2.onion", title: "Redstoner over Tor" do %>
+    <%= link_to "https://discord.gg/QjfcPEJ", title: "Redstoner's Official Discord" do %>
-      Onion Service <%= image_tag("tor.png") %>
+      Discord <%= image_tag("discord.png") %>
     <% end %>
     <% if current_user %>
       | <%= link_to "/slack/?" + {mail: current_user.try(:email)}.to_param do %>

app/views/redstoner_mailer/email_change_confirm_mail.html.erb

@@ -26,7 +26,7 @@
         <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
       </p>
     </div>
   </div>

app/views/redstoner_mailer/new_post_comment_mail.html.erb

@@ -25,7 +25,7 @@
         <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
       </p>
     </div>
   </div>

app/views/redstoner_mailer/new_post_mention_mail.html.erb

@@ -22,7 +22,7 @@
         <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
       </p>
     </div>
   </div>

app/views/redstoner_mailer/new_thread_mention_mail.html.erb

@@ -24,7 +24,7 @@
         <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
       </p>
     </div>
   </div>

app/views/redstoner_mailer/new_thread_reply_mail.html.erb

@@ -27,7 +27,7 @@
       <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
       <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
       <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-      <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+      <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
     </p>
   </div>
 </div>

app/views/redstoner_mailer/register_mail.html.erb

@@ -38,7 +38,7 @@
         <%= link_to "Website", root_url, style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Twitter", "https://twitter.com/RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
         <%= link_to "Mastodon", "https://mstdn.io/@RedstonerServer", style: "text-decoration: none; color: #4096EE;" %> |
-        <%= link_to "Email", "mailto:redstonerserver+website@gmail.com", style: "text-decoration: none; color: #4096EE;" %>
+        <%= link_to "Email", "mailto:staff@redstoner.com", style: "text-decoration: none; color: #4096EE;" %>
       </p>
     </div>
   </div>

app/views/sessions/new.html.erb

@@ -1,6 +1,6 @@
-<% title "Log in" %>
+<% title "Log In" %>
 
-<h1>Log in</h1>
+<h1>Log In</h1>
 <p>Not a member? <%= link_to "Join us", signup_path %>!</p>
 <%= form_tag login_path do |f| %>
   <table>
@@ -16,6 +16,14 @@
       <td></td>
       <td><%= link_to "Lost your password?", lost_password_users_path %></td>
     </tr>
+    <tr>
+      <td><%= label_tag :totp_code %></td>
+      <td><%= text_field_tag :totp_code, nil, placeholder: "123456", required: false %></td>
+    </tr>
+    <tr>
+      <td></td>
+      <td>Leave this field blank if you do not have 2FA enabled.</td>
+    </tr>
   </table>
   <p><%= submit_tag "Log in", class: "btn blue" %></p>
 <% end %>

app/views/threadreplies/edit.html.erb

@@ -1,4 +1,4 @@
-<% title "Edit Thread Reply: #{@reply.thread.title}" %>
+<% title "Edit Reply: #{@reply.thread.title}" %>
 
 <%
   position = @reply.thread.replies.order(:id).index(@reply)
@@ -6,10 +6,10 @@
 %>
 
 <%= link_to @reply.thread.forum.group, forumgroup_path(@reply.thread.forum.group) %> → <%= link_to @reply.thread.forum, @reply.thread.forum %> → <%= link_to @reply.thread, forumthread_path(@reply.thread, page: page) + "#reply-#{@reply.id}" %> → Edit reply
-<h1>Edit reply</h1>
+<h1>Edit Reply</h1>
 <%= form_for [@reply.thread, @reply] do |f| %>
   <%= render partial: "md_editor", locals: {name: "threadreply[content]", content: @reply.content} %>
   <p><%= f.submit "Reply", class: "btn blue left" %></p>
 <% end %>
-<p><%= button_to "Delete reply", [@reply.thread, @reply], method: "delete", data: {confirm: "Delete reply forever?"}, class: "btn red right" %></p>
+<p><%= button_to "Delete Reply", [@reply.thread, @reply], method: "delete", data: {confirm: "Delete reply forever?"}, class: "btn red right" %></p>
 <div class="clear"></div>

app/views/users/change_password.html.erb

@@ -1,6 +1,6 @@
 <% title "Change Password" %>
 
-<h1>Change password</h1>
+<h1>Change Password</h1>
 
 <%= form_for @user do |f| %>
   <%= f.text_field :current_password %>

app/views/users/edit.html.erb

@@ -2,12 +2,12 @@
 
 <%
   def can_edit?
-    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
+    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role)
   end
 %>
 
 <%= link_to @user.name, @user %> → Edit
-<h1>Edit profile</h1>
+<h1>Edit Profile</h1>
 
 <%= form_for @user do |f| %>
   <table>
@@ -23,7 +23,7 @@
           <td>Role</td>
           <td>
             <% if current_user.role >= @user.role %>
-              <%= f.select :role, Role.all_to(current_user.role), {}, { disabled: !can_edit? } %>
+              <%= f.select :role, Role.all_to(current_user.role) %>
             <% end %>
           </td>
         </tr>
@@ -31,7 +31,7 @@
           <td>Badge</td>
           <td>
             <% if current_user.role >= Role.get(:mod) %>
-              <%= f.select :badge, Badge.all, {}, { disabled: !can_edit? } %>
+              <%= f.select :badge, Badge.all %>
             <% end %>
           </td>
         </tr>
@@ -57,7 +57,7 @@
       <tr>
         <td>Twitter username</td>
         <td>
-          <%= f.text_field :twitter, placeholder: "Twitter username", disabled: !can_edit? %>
+          <%= f.text_field :twitter, placeholder: "Twitter username", disabled: !(@user.is?(current_user) && confirmed? || (mod? && current_user.role >= @user.role)) %>
         </td>
       </tr>
       <tr>
@@ -69,17 +69,15 @@
     </tbody>
   </table>
 
-<p><%= f.submit "Save profile", class: "btn variable-size left", disabled: !can_edit? %></p>
+<p><%= f.submit "Save Profile", class: "btn variable-size left", disabled: (!@user.confirmed? && @user.is?(current_user)) %></p>
 <p>
-  <%= link_to "Edit login details", edit_login_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Login Settings", edit_login_user_path(@user), class: "btn variable-size right" %>
-  <%= link_to "Notification settings", edit_notifications_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Notification Settings", edit_notifications_user_path(@user), class: "btn variable-size right" %>
-  <%= link_to "Website settings", edit_website_settings_user_path(@user), class: "btn variable-size right" %>
+  <%= link_to "Website Settings", edit_website_settings_user_path(@user), class: "btn variable-size right" %>
 </p>
 <div class="clear"></div>
 
-<% if !@user.is?(current_user) && !current_user.confirmed? %>
+<% if !@user.confirmed? %>
-  <span class='red-alert'>You must confirm your own email before you can edit other profiles.</span>
-<% elsif !@user.confirmed? %>
   <% if @user.is?(current_user) %>
       <span class='red-alert'>Please confirm your email address first!</span>
     <% else %>

app/views/users/edit_login.html.erb

@@ -1,7 +1,7 @@
 <% title "Edit Login Credentials: #{@user.name}" %>
 
-<%= link_to @user.name, @user %> → Edit Login credentials
+<%= link_to @user.name, @user %> → Edit Login settings
-<h1>Edit Login credentials</h1>
+<h1>Edit Login Settings</h1>
 
 
 <%= form_for @user, url: update_login_user_path(@user), method: :put do |f| %>
@@ -25,14 +25,51 @@
           <%= f.password_field :password_confirmation %>
         </td>
       </tr>
+    </tbody>
+  </table>
+  <hr>
+  <table>
+    <tbody>
+      <tr>
+        <td>2FA Enabled</td>
+        <td>
+          <%= f.check_box :totp_enabled %>
+        </td>
+      </tr>
+      <tr>
+        <td>TOTP Secret</td>
+        <td>
+          <% if !@user.totp_enabled? %>
+          <%= f.text_field :totp_secret, :readonly => true %>
+          <% else %>
+          <i>2FA is currently enabled. Disable 2FA to generate a new secret.</i>
+          <% end %>
+        </td>
+      </tr>
+    </tbody>
+  </table>
+  <hr>
+  <table>
+    <tbody>
       <tr>
         <td>Current password</td>
         <td>
           <%= password_field_tag :current_password, nil, disabled: !@user.is?(current_user) %>
         </td>
       </tr>
+      <% if !@user.totp_enabled? %>
+      <tr>
+        <td>TOTP Code</td>
+        <td>
+          <%= text_field_tag :totp_code, nil, disabled: !@user.is?(current_user) %>
+        </td>
+      </tr>
+      <tr>
+        <td></td>
+        <td><i>Leave this field blank if you are not enabling 2FA.</i></td>
+      <% end %>
     </tbody>
   </table>
-  <p><%= f.submit "Save changes", class: "btn blue left" %></p>
+  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
   <div class="clear"></div>
 <% end %>

app/views/users/edit_notifications.html.erb

@@ -1,11 +1,5 @@
 <% title "Edit Notification Settings: #{@user.name}" %>
 
-<%
-  def can_edit?
-    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
-  end
-%>
-
 <%= link_to @user.name, @user %> → Edit Notification Settings
 <h1>Edit Notification Settings</h1>
 
@@ -17,13 +11,13 @@
       <tr>
         <td>replies to my thread</td>
         <td>
-          <%= f.check_box :mail_own_thread_reply, disabled: !can_edit? %>
+          <%= f.check_box :mail_own_thread_reply %>
         </td>
       </tr>
       <tr>
         <td>replies to a thread I already replied to</td>
         <td>
-          <%= f.check_box :mail_other_thread_reply, disabled: !can_edit? %>
+          <%= f.check_box :mail_other_thread_reply %>
         </td>
       </tr>
       <tr>
@@ -32,13 +26,13 @@
           <i>(Currently used for staff only)</i>
         </td>
         <td>
-          <%= f.check_box :mail_own_blogpost_comment, disabled: !can_edit? %>
+          <%= f.check_box :mail_own_blogpost_comment %>
         </td>
       </tr>
       <tr>
         <td>comments a blog post I already commented</td>
         <td>
-          <%= f.check_box :mail_other_blogpost_comment, disabled: !can_edit? %>
+          <%= f.check_box :mail_other_blogpost_comment %>
         </td>
       </tr>
       <tr>
@@ -46,20 +40,14 @@
           mentions me in a thread or comment
         </td>
         <td>
-          <%= f.check_box :mail_mention, disabled: !can_edit? %>
+          <%= f.check_box :mail_mention %>
         </td>
       </tr>
     </tbody>
   </table>
   <h3>Public Key</h1>
   <p>All notification emails will be encrypted with this key if you supply it.</p>
-  <%= f.text_area :public_key, placeholder: "-----BEGIN PGP PUBLIC KEY BLOCK-----", disabled: !can_edit? %>
+  <%= f.text_area :public_key, placeholder: "-----BEGIN PGP PUBLIC KEY BLOCK-----" %>
-  <p><%= f.submit "Save changes", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !@user.is?(current_user) && !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your own email before you can edit other user's notification settings.</span>
-  <% elsif !@user.confirmed? && @user.is?(current_user) %>
-    <span class='red-alert'>You need to confirm your email before you can edit your notification settings.</span>
-  <% end %>
 <% end %>

app/views/users/edit_website_settings.html.erb

@@ -1,11 +1,5 @@
 <% title "Edit Website Settings: #{@user.name}" %>
 
-<%
-  def can_edit?
-    (@user.is?(current_user) && confirmed?) || (mod? && current_user.role >= @user.role && current_user.confirmed?)
-  end
-%>
-
 <%= link_to @user.name, @user %> → Edit Website Settings
 <h1>Edit Website Settings</h1>
 
@@ -14,33 +8,25 @@
   <table>
     <tbody>
       <tr>
-        <td>Header moves with scrolling (Experimental - do not report bugs)</td>
+        <td>Header moves with scrolling</td>
         <td>
-          <%= f.check_box :header_scroll, disabled: !can_edit? %>
+          <%= f.check_box :header_scroll %>
         </td>
       </tr>
       <tr>
         <td>Show exact UTC times</td>
         <td>
-          <%= f.check_box :utc_time, disabled: !can_edit? %>
+          <%= f.check_box :utc_time %>
         </td>
       </tr>
       <tr>
-        <td>Dark theme*</td>
+        <td>Dark theme</td>
         <td>
-          <%= f.check_box :dark, disabled: !can_edit? %>
+          <%= f.check_box :dark %>
         </td>
       </tr>
     </tbody>
   </table>
-  <p><%= f.submit "Save changes", class: "btn blue left", disabled: !can_edit? %></p>
+  <p><%= f.submit "Save Changes", class: "btn blue left" %></p>
   <div class="clear"></div>
-
-  <% if !@user.is?(current_user) && !current_user.confirmed? %>
-    <span class='red-alert'>You must confirm your own email before you can edit other user's website settings.</span>
-  <% elsif !@user.confirmed? && @user.is?(current_user) %>
-    <span class='red-alert'>You need to confirm your email before you can edit your website settings.</span>
 <% end %>
-<% end %>
-<br><br><br>
-*Warning: If as a result to enabling this style your eyes get infected with a severe case of eye cancer, we are not reliable for any damage. Please contact your doctor in advance to ensure that in case of infection you will be treated accordingly. Quality theme  brought to you by Redempt™.

app/views/users/lost_password.html.erb

@@ -1,6 +1,6 @@
-<% title "Reset password" %>
+<% title "Reset Password" %>
 
-<h1>Reset password</h1>
+<h1>Reset Password</h1>
 <p>You lost your password? Don't do that!</p>
 <p>Luckily for you, you can reset your password. Please use the command <code>/gettoken &lt;your email address&gt;</code>, then fill in the form below:</p>
 <%= form_tag reset_password_users_path do |f| %>
@@ -22,5 +22,5 @@
       <td><%= password_field_tag :new_password, nil, placeholder: "secret", required: true, pattern: ".{8,}", title: "minimum 8 characters", "x-moz-errormessage" => "minimum 8 characters" %></td>
     </tr>
   </table>
-  <p><%= submit_tag "Reset password", class: "btn blue" %></p>
+  <p><%= submit_tag "Reset Password", class: "btn blue" %></p>
 <% end %>

app/views/users/new.html.erb

@@ -1,6 +1,6 @@
-<% title "Sign up" %>
+<% title "Sign Up" %>
 
-<h1>Sign up</h1>
+<h1>Sign Up</h1>
 
 <%= form_for @user do |f| %>
   <table>
@@ -38,7 +38,7 @@
     You can find more details in our info page about <a href="/info/15">tokens and website registration</a>.
   </p>
 
-  <%= f.submit "Sign up", class: "btn blue" %>
+  <%= f.submit "Sign Up", class: "btn blue" %>
 
   <p>Contact us ingame if you have problems signing up!</p>
 <% end %>

app/views/users/show.html.erb

@@ -16,27 +16,16 @@
 
   <div class="clear"></div>
   <% if @ban_json && (@ban_json["expires"] == "forever" || !(DateTime.parse(@ban_json["expires"]) <= DateTime.now)) %>
-    <% if @user.is?(current_user) %>
-      <span class="user-banned">You are banned on the server for "<%=@ban_json["reason"]%>"<%=" until #{@ban_json["expires"]}" unless @ban_json["expires"] == "forever"%></span>
-    <% else %>
     <span class="user-banned">This user is banned on the server for "<%=@ban_json["reason"]%>"<%=" until #{@ban_json["expires"]}" unless @ban_json["expires"] == "forever"%></span>
   <% end %>
-  <% end %>
   <% if @user.banned? %>
-    <% if @user.is?(current_user) %>
-      <span class="user-banned">You are banned on the website!</span>
-    <% else %>
       <span class="user-banned">This user is banned on the website!</span>
   <% end %>
-  <% end %>
   <br>
   <% if !@user.confirmed? %>
-    <% if @user.is?(current_user) %>
+    <% if @user.is?(current_user) || mod? %>
-      <span class="user-unconfirmed">You haven't confirmed your email "<u><%= @user.email %></u>" yet!</span>
+      <span class="user-unconfirmed">Please confirm your email <u><%= @user.email %></u> !</span>
       <%= button_to "Resend the confirmation mail", resend_mail_user_path, class: "btn dark", form_class: "inline-block", data: {confirm: "Did you check your spam folder?"} %>
-    <% elsif mod? %>
-      <span class="user-unconfirmed">This user hasn't confirmed their email "<u><%= @user.email %></u>" yet!</span>
-      <%= button_to "Resend the confirmation mail", resend_mail_user_path, class: "btn dark", form_class: "inline-block" %>
     <% else %>
       <span class="user-unconfirmed">This user hasn't confirmed their email yet!</span>
     <% end %>

config/deploy.rb

@@ -1,5 +1,5 @@
 # config valid only for current version of Capistrano
-lock '3.4.0'
+lock '3.10.1'
 
 set :repo_url, 'https://github.com/RedstonerServer/redstoner.com'
 
@@ -13,9 +13,9 @@ set :default_environment, {
 
 set :keep_releases, 5
 
-set :deploy_to, -> { "/home/www-data/apps/#{fetch(:application)}" }
+set :deploy_to, -> { "/var/www/#{fetch(:application)}" }
 
-set :rbenv_ruby, '2.0.0-p648'
+set :rbenv_ruby, '2.5.0-dev'
 
 set :bundle_without, %w{development test}.join(' ')
 

config/environments/development.rb

@@ -37,12 +37,12 @@ Redstoner::Application.configure do
   }
 
   config.action_mailer.smtp_settings = {
-    address:        "smtp.gmail.com",
+    address:        ENV["SMTP_ADDRESS"],
-    port:           587,
+    port:           ENV["SMTP_PORT"],
-    domain:         "google.com",
+    domain:         "redstoner.com",
-    authentication: "plain",
+    authentication: ENV["SMTP_AUTH"],
-    user_name:      "redstonerserver@gmail.com",
+    user_name:      ENV["SMTP_USERNAME"],
-    password:       ENV["GMAIL_PASSWORD"],
+    password:       ENV["SMTP_PASSWORD"],
   }
 
 end

config/environments/production.rb

@@ -71,12 +71,12 @@ Redstoner::Application.configure do
   }
 
   config.action_mailer.smtp_settings = {
-    address:        "smtp.gmail.com",
+    address:        ENV["SMTP_ADDRESS"],
-    port:           587,
+    port:           ENV["SMTP_PORT"],
-    domain:         "google.com",
+    domain:         "redstoner.com",
-    authentication: "plain",
+    authentication: ENV["SMTP_AUTH"],
-    user_name:      "redstonerserver@gmail.com",
+    user_name:      ENV["SMTP_USERNAME"],
-    password:       ENV["GMAIL_PASSWORD"],
+    password:       ENV["SMTP_PASSWORD"],
   }
 
 end

config/unicorn.rb

@@ -3,8 +3,8 @@ timeout 15
 preload_app true
 
 
-stderr_path "/home/www-data/apps/redstoner/shared/log/unicorn.stderr.log"
+stderr_path "/var/www/redstoner/shared/log/unicorn.stderr.log"
-stdout_path "/home/www-data/apps/redstoner/shared/log/unicorn.stdout.log"
+stdout_path "/var/www/redstoner/shared/log/unicorn.stdout.log"
 
 before_fork do |server, worker|
   Signal.trap 'TERM' do

db/migrate/20180606223258_add_totp_to_users.rb

@@ -0,0 +1,6 @@
+class AddTotpToUsers < ActiveRecord::Migration
+  def change
+    add_column :users, :totp_secret, :string
+    add_column :users, :totp_enabled, :boolean, default: false
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20171013001146) do
+ActiveRecord::Schema.define(version: 20180606223258) do
 
   create_table "badges", force: :cascade do |t|
     t.string  "name",   limit: 191
@@ -154,6 +154,8 @@ ActiveRecord::Schema.define(version: 20171013001146) do
     t.boolean  "header_scroll",                             default: false
     t.boolean  "dark",                                      default: false
     t.text     "public_key",                  limit: 65535
+    t.string   "totp_secret",                   limit: 255
+    t.boolean  "totp_enabled",                              default: false
   end
 
   add_index "users", ["email"], name: "index_users_on_email", unique: true, using: :btree