|
1288
|
1 #!/usr/bin/env python3 |
|
|
2 |
|
|
3 import tempfile |
|
|
4 import os |
|
|
5 import os.path |
|
|
6 import json |
|
|
7 from twisted.internet import defer |
|
|
8 from twisted.web import static |
|
|
9 from sat.core.i18n import _ |
|
|
10 from sat.core.log import getLogger |
|
|
11 from libervia.server.constants import Const as C |
|
|
12 from libervia.server.utils import ProgressHandler |
|
|
13 |
|
|
14 |
|
|
15 log = getLogger(__name__) |
|
|
16 """access to restricted bridge""" |
|
|
17 |
|
|
18 name = "bridge" |
|
|
19 on_data_post = "continue" |
|
|
20 |
|
|
21 |
|
|
22 def parse_url(self, request): |
|
|
23 self.getPathArgs(request, ["method_name"], min_args=1) |
|
|
24 |
|
|
25 |
|
|
26 async def render(self, request): |
|
|
27 if request.method != b'POST': |
|
|
28 log.warning(f"Bad method used with _bridge endpoint: {request.method.decode()}") |
|
|
29 return self.pageError(request, C.HTTP_BAD_REQUEST) |
|
|
30 data = self.getRData(request) |
|
|
31 profile = self.getProfile(request) |
|
|
32 if profile is None: |
|
|
33 log.warning("_bridge endpoint accessed without authorisation") |
|
|
34 return self.pageError(request, C.HTTP_UNAUTHORIZED) |
|
|
35 self.checkCSRF(request) |
|
|
36 method_name = data["method_name"] |
|
|
37 method_data = json.load(request.content) |
|
|
38 try: |
|
|
39 bridge_method = getattr(self.host.restricted_bridge, method_name) |
|
|
40 except AttributeError: |
|
|
41 log.warning(_( |
|
|
42 "{profile!r} is trying to access a bridge method not implemented in " |
|
|
43 "RestrictedBridge: {method_name}").format( |
|
|
44 profile=profile, method_name=method_name)) |
|
|
45 return self.pageError(request, C.HTTP_BAD_REQUEST) |
|
|
46 |
|
|
47 try: |
|
|
48 args, kwargs = method_data['args'], method_data['kwargs'] |
|
|
49 except KeyError: |
|
|
50 log.warning(_( |
|
|
51 "{profile!r} has sent a badly formatted method call: {method_data}" |
|
|
52 ).format(profile=profile, method_data=method_data)) |
|
|
53 return self.pageError(request, C.HTTP_BAD_REQUEST) |
|
|
54 |
|
|
55 if "profile" in kwargs: |
|
|
56 log.warning(_( |
|
|
57 '"profile" key should not be in method kwargs, hack attempt? ' |
|
|
58 "profile={profile}, method_data={method_data}" |
|
|
59 ).format(profile=profile, method_data=method_data)) |
|
|
60 return self.pageError(request, C.HTTP_BAD_REQUEST) |
|
|
61 |
|
|
62 ret = await bridge_method(*args, **kwargs, profile=profile) |
|
|
63 return json.dumps(ret) |
