Changeset - 270279ad054e
[Not reviewed]
version_5
0 1 0
Dennis Fink - 10 years ago 2015-08-30 15:18:13
dennis.fink@c3l.lu
Rewrite user checking
1 file changed with 20 insertions and 3 deletions:
0 comments (0 inline, 0 general)
ennstatus/api/views.py
Show inline comments
 
import ipaddress
 

	
 
from datetime import datetime
 

	
 
from flask import (Blueprint, request, current_app, jsonify, render_template,
 
                   abort)
 

	
 
import strict_rfc3339
 
import pygeoip
 

	
 
from ennstatus.status.functions import (single_server, all_servers,
 
                                        all_servers_by_type)
 
from .model import Server
 
from .auth import httpauth
 

	
 
api_page = Blueprint('api', __name__)
 
gi4 = pygeoip.GeoIP('/usr/share/GeoIP/GeoIP.dat', pygeoip.MEMORY_CACHE)
 
gi6 = pygeoip.GeoIP('/usr/share/GeoIP/GeoIPv6.dat', pygeoip.MEMORY_CACHE)
 

	
 

	
 
@api_page.route('/update', methods=('POST',))
 
@httpauth.login_required
 
def update():
 

	
 
    current_app.logger.info('Handling update')
 

	
 
    try:
 
        servers = current_app.config['ENNSTATUS_SERVERS']
 
    except KeyError as e:
 
        current_app.logger.error(str(e))
 
        return abort(500)
 

	
 
    username = httpauth.username()
 

	
 
    try:
 
        if request.remote_addr not in servers[httpauth.username()]['IPS']:
 
            current_app.logger.warn('Unallowed IP %s tried to update data!'
 
                                    % request.remote_addr)
 
        if request.remote_addr not in servers[username]['IPS']:
 
            current_app.logger.warn(
 
                'Unallowed IP {} tried to update data!'.format(
 
                    request.remote_addr
 
                )
 
            )
 
            return 'IP not allowed!\n', 403, {'Content-Type': 'text/plain'}
 
    except KeyError as e:
 
        current_app.logger.error(str(e))
 
        return abort(500)
 

	
 
    data = request.get_json()
 

	
 
    if data is None:
 
        current_app.logger.info('No JSON data supplied!')
 
        return 'No JSON data supplied!\n', 400, {'Content-Type': 'text/plain'}
 

	
 
    try:
 
        if username != data['name'].lower():
 
            current_app.logger.warn(
 
                'Unallowed user {} tried to update {}!'.format(
 
                    username, data['name']
 
                )
 
            )
 
            return ('You are not allowed to update this server\n',
 
                    403, {'Content-Type': 'text/plain'})
 
    except KeyError:
 
        return abort(409)
 

	
 
    if 'ip' in data:
 
        ip = data['ip']
 
    elif 'ip6' in data:
 
        ip = data['ip6']
 
    else:
 
        ip = request.remote_addr
 

	
 
    try:
 
        ip = ipaddress.ip_address(ip)
 
    except ipaddress.AddressValueError:
 
        return 'IP not allowed!\n', 403, {'Content-Type': 'text/plain'}
 

	
 
    if ip.version == 4:
 
        data['country'] = gi4.country_name_by_addr(str(ip))
 
    elif ip.version == 6:
 
        data['country'] = gi6.country_name_by_addr(str(ip))
 
    else:
 
        data['country'] = None
 

	
 
    data['last_updated'] = strict_rfc3339.timestamp_to_rfc3339_utcoffset(
 
        datetime.utcnow().timestamp()
 
    )
 

	
 
    try:
 
        server = Server.from_dict(data)
 
    except Exception as e:
 
        current_app.logger.warning(' '.join([str(e), str(data)]))
 
        return str(e), 409, {'Content-Type': 'text/plain'}
 

	
 
    if server.type in ('exit', 'relay'):
 
        server.update_weights()
 

	
 
    try:
 
        server.save()
 
    except Exception as e:
 
        current_app.logger.error(str(e))
 
        return str(e), 500, {'Content-Type': 'text/plain'}
 

	
 
    current_app.logger.info('Return result')
 
    return (server.json(), 201,
 
            {'Location': '/api/export/json/single?server_name=%s'
 
             % server.name})
 

	
 

	
 
@api_page.route('/export', defaults={'server_type': 'all',
 
                                     'export_format': 'json'})
 
@api_page.route('/export/<any("json", "xml"):export_format>',
 
                defaults={'server_type': 'all'})
0 comments (0 inline, 0 general)