Changeset - 270279ad054e
[Not reviewed]
version_5
0 1 0
Dennis Fink - 10 years ago 2015-08-30 15:18:13
dennis.fink@c3l.lu
Rewrite user checking
1 file changed with 20 insertions and 3 deletions:
0 comments (0 inline, 0 general)
ennstatus/api/views.py
Show inline comments
 
@@ -27,27 +27,44 @@ def update():
 
    try:
 
        servers = current_app.config['ENNSTATUS_SERVERS']
 
    except KeyError as e:
 
        current_app.logger.error(str(e))
 
        return abort(500)
 

	
 
    username = httpauth.username()
 

	
 
    try:
 
        if request.remote_addr not in servers[httpauth.username()]['IPS']:
 
            current_app.logger.warn('Unallowed IP %s tried to update data!'
 
                                    % request.remote_addr)
 
        if request.remote_addr not in servers[username]['IPS']:
 
            current_app.logger.warn(
 
                'Unallowed IP {} tried to update data!'.format(
 
                    request.remote_addr
 
                )
 
            )
 
            return 'IP not allowed!\n', 403, {'Content-Type': 'text/plain'}
 
    except KeyError as e:
 
        current_app.logger.error(str(e))
 
        return abort(500)
 

	
 
    data = request.get_json()
 

	
 
    if data is None:
 
        current_app.logger.info('No JSON data supplied!')
 
        return 'No JSON data supplied!\n', 400, {'Content-Type': 'text/plain'}
 

	
 
    try:
 
        if username != data['name'].lower():
 
            current_app.logger.warn(
 
                'Unallowed user {} tried to update {}!'.format(
 
                    username, data['name']
 
                )
 
            )
 
            return ('You are not allowed to update this server\n',
 
                    403, {'Content-Type': 'text/plain'})
 
    except KeyError:
 
        return abort(409)
 

	
 
    if 'ip' in data:
 
        ip = data['ip']
 
    elif 'ip6' in data:
 
        ip = data['ip6']
 
    else:
 
        ip = request.remote_addr
0 comments (0 inline, 0 general)