mirror of
https://gitlab.com/crafty-controller/crafty-4.git
synced 2024-08-30 18:23:09 +00:00
Remove remaining get/delete calls in panelhandler
This commit is contained in:
amcmanu3
parent
6a4a9f77d9
commit
2f69464e7a
@ -1498,182 +1498,3 @@ class PanelHandler(BaseHandler):
|
||||
utc_offset=(time.timezone * -1 / 60 / 60),
|
||||
translate=self.translator.translate,
|
||||
)
|
||||
|
||||
@tornado.web.authenticated
|
||||
def post(self, page):
|
||||
api_key, _token_data, exec_user = self.current_user
|
||||
superuser = exec_user["superuser"]
|
||||
if api_key is not None:
|
||||
superuser = superuser and api_key.superuser
|
||||
|
||||
if superuser:
|
||||
# defined_servers = self.controller.servers.list_defined_servers()
|
||||
exec_user_role = {"Super User"}
|
||||
exec_user_crafty_permissions = (
|
||||
self.controller.crafty_perms.list_defined_crafty_permissions()
|
||||
)
|
||||
else:
|
||||
exec_user_crafty_permissions = (
|
||||
self.controller.crafty_perms.get_crafty_permissions_list(
|
||||
exec_user["user_id"]
|
||||
)
|
||||
)
|
||||
# defined_servers =
|
||||
# self.controller.servers.get_authorized_servers(exec_user["user_id"])
|
||||
exec_user_role = set()
|
||||
for r in exec_user["roles"]:
|
||||
role = self.controller.roles.get_role(r)
|
||||
exec_user_role.add(role["role_name"])
|
||||
|
||||
if page == "edit_user_apikeys":
|
||||
user_id = self.get_argument("id", None)
|
||||
name = self.get_argument("name", None)
|
||||
superuser = self.get_argument("superuser", None) == "1"
|
||||
|
||||
if name is None or name == "":
|
||||
self.redirect("/panel/error?error=Invalid API key name")
|
||||
return
|
||||
if user_id is None:
|
||||
self.redirect("/panel/error?error=Invalid User ID")
|
||||
return
|
||||
# does this user id exist?
|
||||
if not self.controller.users.user_id_exists(user_id):
|
||||
self.redirect("/panel/error?error=Invalid User ID")
|
||||
return
|
||||
|
||||
if str(user_id) != str(exec_user["user_id"]) and not exec_user["superuser"]:
|
||||
self.redirect(
|
||||
"/panel/error?error=You do not have access to change"
|
||||
+ "this user's api key."
|
||||
)
|
||||
return
|
||||
|
||||
crafty_permissions_mask = self.get_perms()
|
||||
server_permissions_mask = self.get_perms_server()
|
||||
|
||||
self.controller.users.add_user_api_key(
|
||||
name,
|
||||
user_id,
|
||||
superuser,
|
||||
server_permissions_mask,
|
||||
crafty_permissions_mask,
|
||||
)
|
||||
|
||||
self.controller.management.add_to_audit_log(
|
||||
exec_user["user_id"],
|
||||
f"Added API key {name} with crafty permissions "
|
||||
f"{crafty_permissions_mask}"
|
||||
f" and {server_permissions_mask} for user with UID: {user_id}",
|
||||
server_id=0,
|
||||
source_ip=self.get_remote_ip(),
|
||||
)
|
||||
self.redirect(f"/panel/edit_user_apikeys?id={user_id}")
|
||||
|
||||
elif page == "get_token":
|
||||
key_id = self.get_argument("id", None)
|
||||
|
||||
if key_id is None:
|
||||
self.redirect("/panel/error?error=Invalid Key ID")
|
||||
return
|
||||
key = self.controller.users.get_user_api_key(key_id)
|
||||
# does this user id exist?
|
||||
if key is None:
|
||||
self.redirect("/panel/error?error=Invalid Key ID")
|
||||
return
|
||||
|
||||
if (
|
||||
str(key.user_id) != str(exec_user["user_id"])
|
||||
and not exec_user["superuser"]
|
||||
):
|
||||
self.redirect(
|
||||
"/panel/error?error=You are not authorized to access this key."
|
||||
)
|
||||
return
|
||||
|
||||
self.controller.management.add_to_audit_log(
|
||||
exec_user["user_id"],
|
||||
f"Generated a new API token for the key {key.name} "
|
||||
f"from user with UID: {key.user_id}",
|
||||
server_id=0,
|
||||
source_ip=self.get_remote_ip(),
|
||||
)
|
||||
|
||||
self.write(
|
||||
self.controller.authentication.generate(
|
||||
key.user_id_id, {"token_id": key.token_id}
|
||||
)
|
||||
)
|
||||
self.finish()
|
||||
|
||||
else:
|
||||
self.set_status(404)
|
||||
page_data = {
|
||||
"lang": self.helper.get_setting("language"),
|
||||
"lang_page": Helpers.get_lang_page(self.helper.get_setting("language")),
|
||||
}
|
||||
self.render(
|
||||
"public/404.html", translate=self.translator.translate, data=page_data
|
||||
)
|
||||
|
||||
@tornado.web.authenticated
|
||||
def delete(self, page):
|
||||
api_key, _token_data, exec_user = self.current_user
|
||||
superuser = exec_user["superuser"]
|
||||
if api_key is not None:
|
||||
superuser = superuser and api_key.superuser
|
||||
|
||||
page_data = {
|
||||
# todo: make this actually pull and compare version data
|
||||
"update_available": False,
|
||||
"version_data": self.helper.get_version_string(),
|
||||
"user_data": exec_user,
|
||||
"hosts_data": self.controller.management.get_latest_hosts_stats(),
|
||||
"show_contribute": self.helper.get_setting("show_contribute_link", True),
|
||||
"lang": self.controller.users.get_user_lang_by_id(exec_user["user_id"]),
|
||||
"lang_page": Helpers.get_lang_page(
|
||||
self.controller.users.get_user_lang_by_id(exec_user["user_id"])
|
||||
),
|
||||
}
|
||||
|
||||
if page == "remove_apikey":
|
||||
key_id = bleach.clean(self.get_argument("id", None))
|
||||
|
||||
if not superuser:
|
||||
self.redirect("/panel/error?error=Unauthorized access: not superuser")
|
||||
return
|
||||
if key_id is None or self.controller.users.get_user_api_key(key_id) is None:
|
||||
self.redirect("/panel/error?error=Invalid Key ID")
|
||||
return
|
||||
# does this user id exist?
|
||||
target_key = self.controller.users.get_user_api_key(key_id)
|
||||
if not target_key:
|
||||
self.redirect("/panel/error?error=Invalid Key ID")
|
||||
return
|
||||
|
||||
key_obj = self.controller.users.get_user_api_key(key_id)
|
||||
|
||||
if key_obj.user_id != exec_user["user_id"] and not exec_user["superuser"]:
|
||||
self.redirect(
|
||||
"/panel/error?error=You do not have access to change"
|
||||
+ "this user's api key."
|
||||
)
|
||||
return
|
||||
|
||||
self.controller.users.delete_user_api_key(key_id)
|
||||
|
||||
self.controller.management.add_to_audit_log(
|
||||
exec_user["user_id"],
|
||||
f"Removed API key {target_key} "
|
||||
f"(ID: {key_id}) from user {exec_user['user_id']}",
|
||||
server_id=0,
|
||||
source_ip=self.get_remote_ip(),
|
||||
)
|
||||
self.finish()
|
||||
self.redirect(f"/panel/edit_user_apikeys?id={key_obj.user_id}")
|
||||
else:
|
||||
self.set_status(404)
|
||||
self.render(
|
||||
"public/404.html",
|
||||
data=page_data,
|
||||
translate=self.translator.translate,
|
||||
)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user