diff --git a/app/classes/minecraft/serverjars.py b/app/classes/minecraft/serverjars.py index 282a55a9..9a1a2505 100644 --- a/app/classes/minecraft/serverjars.py +++ b/app/classes/minecraft/serverjars.py @@ -25,13 +25,19 @@ except ModuleNotFoundError as e: class ServerJars: + def __init__(self): + self.base_url = "https://serverjars.com" + def _get_api_result(self, call_url: str): - base_url = "https://serverjars.com" - full_url = "{base}{call_url}".format(base=base_url, call_url=call_url) + full_url = "{base}{call_url}".format(base=self.base_url, call_url=call_url) - r = requests.get(full_url, timeout=2) + try: + r = requests.get(full_url, timeout=2) - if r.status_code not in [200, 201]: + if r.status_code not in [200, 201]: + return {} + except Exception as e: + logger.error("Unable to connect to serverjar.com api due to error: {}".format(e)) return {} try: @@ -66,18 +72,21 @@ class ServerJars: data = self._read_cache() return data.get('servers') - @staticmethod - def _check_api_alive(): + def _check_api_alive(self): logger.info("Checking serverjars.com API status") - check_url = "https://serverjars.com/api/fetchTypes" - r = requests.get(check_url, timeout=2) + check_url = "{base}/api/fetchTypes".format(base=self.base_url) + try: + r = requests.get(check_url, timeout=2) - if r.status_code in [200, 201]: - logger.info("Serverjars.com API is alive") - return True + if r.status_code in [200, 201]: + logger.info("Serverjars.com API is alive") + return True + except Exception as e: + logger.error("Unable to connect to serverjar.com api due to error: {}".format(e)) + return {} - logger.error("unable to contact Serverjars.com api") + logger.error("unable to contact serverjars.com api") return False def refresh_cache(self): @@ -141,12 +150,11 @@ class ServerJars: response = self._get_api_result(url) return response - @staticmethod - def download_jar(server, version, path): - base_url = "https://serverjars.com/api/fetchJar/{server}/{version}".format(server=server, version=version) + def download_jar(self, server, version, path): + fetch_url = "{base}/api/fetchJar/{server}/{version}".format(base=self.base_url, server=server, version=version) # open a file stream - with requests.get(base_url, timeout=2, stream=True) as r: + with requests.get(fetch_url, timeout=2, stream=True) as r: try: with open(path, 'wb') as output: shutil.copyfileobj(r.raw, output) diff --git a/app/classes/shared/models.py b/app/classes/shared/models.py index 4b3bcb14..e7719051 100644 --- a/app/classes/shared/models.py +++ b/app/classes/shared/models.py @@ -33,29 +33,49 @@ class Users(BaseModel): user_id = AutoField() created = DateTimeField(default=datetime.datetime.now) last_login = DateTimeField(default=datetime.datetime.now) + last_update = DateTimeField(default=datetime.datetime.now) last_ip = CharField(default="") - username = CharField(default="") + username = CharField(default="", unique=True, index=True) password = CharField(default="") enabled = BooleanField(default=True) - api_token = CharField(default="") - allowed_servers = CharField(default="[]") + superuser = BooleanField(default=False) + api_token = CharField(default="", unique=True, index=True) # we may need to revisit this class Meta: table_name = "users" +class Roles(BaseModel): + role_id = AutoField() + created = DateTimeField(default=datetime.datetime.now) + last_update = DateTimeField(default=datetime.datetime.now) + role_name = CharField(default="", unique=True, index=True) + + class Meta: + table_name = "roles" + + +class User_Roles(BaseModel): + user_id = ForeignKeyField(Users, backref='user_role') + role_id = ForeignKeyField(Roles, backref='user_role') + + class Meta: + table_name = 'user_roles' + primary_key = CompositeKey('user_id', 'role_id') + + class Audit_Log(BaseModel): audit_id = AutoField() created = DateTimeField(default=datetime.datetime.now) user_name = CharField(default="") - user_id = IntegerField(default=0) + user_id = IntegerField(default=0, index=True) source_ip = CharField(default='127.0.0.1') - server_id = IntegerField(default=None) + server_id = IntegerField(default=None, index=True) # When auditing global events, use server ID 0 log_msg = TextField(default='') class Host_Stats(BaseModel): - time = DateTimeField(default=datetime.datetime.now) + time = DateTimeField(default=datetime.datetime.now, index=True) boot_time = CharField(default="") cpu_usage = FloatField(default=0) cpu_cores = IntegerField(default=0) @@ -73,8 +93,8 @@ class Host_Stats(BaseModel): class Servers(BaseModel): server_id = AutoField() created = DateTimeField(default=datetime.datetime.now) - server_uuid = CharField(default="") - server_name = CharField(default="Server") + server_uuid = CharField(default="", index=True) + server_name = CharField(default="Server", index=True) path = CharField(default="") executable = CharField(default="") log_path = CharField(default="") @@ -90,10 +110,28 @@ class Servers(BaseModel): table_name = "servers" +class User_Servers(BaseModel): + user_id = ForeignKeyField(Users, backref='user_server') + server_id = ForeignKeyField(Servers, backref='user_server') + + class Meta: + table_name = 'user_servers' + primary_key = CompositeKey('user_id', 'server_id') + + +class Role_Servers(BaseModel): + role_id = ForeignKeyField(Roles, backref='role_server') + server_id = ForeignKeyField(Servers, backref='role_server') + + class Meta: + table_name = 'role_servers' + primary_key = CompositeKey('role_id', 'server_id') + + class Server_Stats(BaseModel): stats_id = AutoField() created = DateTimeField(default=datetime.datetime.now) - server_id = ForeignKeyField(Servers, backref='server') + server_id = ForeignKeyField(Servers, backref='server', index=True) started = CharField(default="") running = BooleanField(default=False) cpu = FloatField(default=0) @@ -117,8 +155,8 @@ class Server_Stats(BaseModel): class Commands(BaseModel): command_id = AutoField() created = DateTimeField(default=datetime.datetime.now) - server_id = ForeignKeyField(Servers, backref='server') - user = ForeignKeyField(Users, backref='user') + server_id = ForeignKeyField(Servers, backref='server', index=True) + user = ForeignKeyField(Users, backref='user', index=True) source_ip = CharField(default='127.0.0.1') command = CharField(default='') executed = BooleanField(default=False) @@ -129,7 +167,7 @@ class Commands(BaseModel): class Webhooks(BaseModel): id = AutoField() - name = CharField(max_length=64, unique=True) + name = CharField(max_length=64, unique=True, index=True) method = CharField(default="POST") url = CharField(unique=True) event = CharField(default="") @@ -143,7 +181,7 @@ class Backups(BaseModel): directories = CharField() storage_location = CharField() max_backups = IntegerField() - server_id = IntegerField() + server_id = IntegerField(index=True) class Meta: table_name = 'backups' @@ -157,9 +195,13 @@ class db_builder: database.create_tables([ Backups, Users, + Roles, + User_Roles, Host_Stats, Webhooks, Servers, + User_Servers, + Role_Servers, Server_Stats, Commands, Audit_Log @@ -173,16 +215,18 @@ class db_builder: username = default_data.get("username", 'admin') password = default_data.get("password", 'crafty') - api_token = helper.random_string_generator(32) - - Users.insert({ - Users.username: username.lower(), - Users.password: helper.encode_pass(password), - Users.api_token: api_token, - Users.enabled: True - }).execute() + #api_token = helper.random_string_generator(32) + # + #Users.insert({ + # Users.username: username.lower(), + # Users.password: helper.encode_pass(password), + # Users.api_token: api_token, + # Users.enabled: True, + # Users.superuser: True + #}).execute() + db_shortcuts.add_user(username, password=password, superuser=True) - console.info("API token is {}".format(api_token)) + #console.info("API token is {}".format(api_token)) @staticmethod def is_fresh_install(): @@ -196,7 +240,8 @@ class db_builder: class db_shortcuts: - def return_rows(self, query): + @staticmethod + def return_rows(query): rows = [] try: @@ -209,7 +254,8 @@ class db_shortcuts: return rows - def get_server_data_by_id(self, server_id): + @staticmethod + def get_server_data_by_id(server_id): try: query = Servers.get_by_id(server_id) except DoesNotExist: @@ -217,25 +263,29 @@ class db_shortcuts: return model_to_dict(query) - def get_all_defined_servers(self): + @staticmethod + def get_all_defined_servers(): query = Servers.select() - return self.return_rows(query) + return db_helper.return_rows(query) - def get_all_servers_stats(self): - servers = self.get_all_defined_servers() + @staticmethod + def get_all_servers_stats(): + servers = db_helper.get_all_defined_servers() server_data = [] for s in servers: latest = Server_Stats.select().where(Server_Stats.server_id == s.get('server_id')).order_by(Server_Stats.created.desc()).limit(1) - server_data.append({'server_data': s, "stats": self.return_rows(latest)}) + server_data.append({'server_data': s, "stats": db_helper.return_rows(latest)}) return server_data - def get_server_stats_by_id(self, server_id): + @staticmethod + def get_server_stats_by_id(server_id): stats = Server_Stats.select().where(Server_Stats.server_id == server_id).order_by(Server_Stats.created.desc()).limit(1) - return self.return_rows(stats) + return db_helper.return_rows(stats) - def server_id_exists(self, server_id): - if not self.get_server_data_by_id(server_id): + @staticmethod + def server_id_exists(server_id): + if not db_helper.get_server_data_by_id(server_id): return False return True @@ -244,24 +294,210 @@ class db_shortcuts: query = Host_Stats.select().order_by(Host_Stats.id.desc()).get() return model_to_dict(query) - def get_all_users(self): + @staticmethod + def new_api_token(): + while True: + token = helper.random_string_generator(32) + test = list(Users.select(Users.user_id).where(Users.api_token == token)) + if len(test) == 0: + return token + + @staticmethod + def get_all_users(): query = Users.select() return query - def get_unactioned_commands(self): - query = Commands.select().where(Commands.executed == 0) - return self.return_rows(query) + @staticmethod + def get_all_roles(): + query = Roles.select() + return query - def get_server_friendly_name(self, server_id): - server_data = self.get_server_data_by_id(server_id) + @staticmethod + def get_userid_by_name(username): + try: + return (Users.get(Users.username == username)).user_id + except DoesNotExist: + return None + + @staticmethod + def get_user(user_id): + user = model_to_dict(Users.get(Users.user_id == user_id)) + + if user: + roles_query = User_Roles.select().join(Roles, JOIN.INNER).where(User_Roles.user_id == user_id) + # TODO: this query needs to be narrower + roles = set() + for r in roles_query: + roles.add(r.role_id.role_id) + servers_query = User_Servers.select().join(Servers, JOIN.INNER).where(User_Servers.user_id == user_id) + # TODO: this query needs to be narrower + servers = set() + for s in servers_query: + servers.add(s.server_id.server_id) + user['roles'] = roles + user['servers'] = servers + logger.debug("user: ({}) {}".format(user_id, user)) + return user + else: + logger.debug("user: ({}) {}".format(user_id, {})) + return {} + + @staticmethod + def update_user(user_id, user_data={}): + base_data = db_helper.get_user(user_id) + up_data = {} + added_roles = set() + removed_roles = set() + added_servers = set() + removed_servers = set() + for key in user_data: + if key == "user_id": + continue + elif key == "roles": + added_roles = user_data['roles'].difference(base_data['roles']) + removed_roles = base_data['roles'].difference(user_data['roles']) + elif key == "servers": + added_servers = user_data['servers'].difference(base_data['servers']) + removed_servers = base_data['servers'].difference(user_data['servers']) + elif key == "regen_api": + if user_data['regen_api']: + up_data['api_token'] = db_shortcuts.new_api_token() + elif key == "password": + if user_data['password'] is not None and user_data['password'] != "": + up_data['password'] = helper.encode_pass(user_data['password']) + elif base_data[key] != user_data[key]: + up_data[key] = user_data[key] + up_data['last_update'] = helper.get_time_as_string() + logger.debug("user: {} +role:{} -role:{} +server:{} -server{}".format(user_data, added_roles, removed_roles, added_servers, removed_servers)) + with database.atomic(): + for role in added_roles: + User_Roles.get_or_create(user_id=user_id, role_id=role) + # TODO: This is horribly inefficient and we should be using bulk queries but im going for functionality at this point + User_Roles.delete().where(User_Roles.user_id == user_id).where(User_Roles.role_id.in_(removed_roles)).execute() + + for server in added_servers: + User_Servers.get_or_create(user_id=user_id, server_id=server) + # TODO: This is horribly inefficient and we should be using bulk queries but im going for functionality at this point + User_Servers.delete().where(User_Servers.user_id == user_id).where(User_Servers.server_id.in_(removed_servers)).execute() + if up_data: + Users.update(up_data).where(Users.user_id == user_id).execute() + + @staticmethod + def add_user(username, password=None, api_token=None, enabled=True, superuser=False): + if password is not None: + pw_enc = helper.encode_pass(password) + else: + pw_enc = None + if api_token is None: + api_token = db_shortcuts.new_api_token() + else: + if type(api_token) is not str and len(api_token) != 32: + raise ValueError("API token must be a 32 character string") + user_id = Users.insert({ + Users.username: username.lower(), + Users.password: pw_enc, + Users.api_token: api_token, + Users.enabled: enabled, + Users.superuser: superuser, + Users.created: helper.get_time_as_string() + }).execute() + return user_id + + @staticmethod + def remove_user(user_id): + user = Users.get(Users.user_id == user_id) + return user.delete_instance() + + @staticmethod + def user_id_exists(user_id): + if not db_shortcuts.get_user(user_id): + return False + return True + + @staticmethod + def get_roleid_by_name(role_name): + try: + return (Roles.get(Roles.role_name == role_name)).role_id + except DoesNotExist: + return None + + @staticmethod + def get_role(role_id): + role = model_to_dict(Roles.get(Roles.role_id == role_id)) + + if role: + servers_query = Role_Servers.select().join(Servers, JOIN.INNER).where(Role_Servers.role_id == role_id) + # TODO: this query needs to be narrower + servers = set() + for s in servers_query: + servers.add(s.server_id.server_id) + role['servers'] = servers + logger.debug("role: ({}) {}".format(role_id, role)) + return role + else: + logger.debug("role: ({}) {}".format(role_id, {})) + return {} + + @staticmethod + def update_role(role_id, role_data={}): + base_data = db_helper.get_role(role_id) + up_data = {} + added_servers = set() + removed_servers = set() + for key in role_data: + if key == "role_id": + continue + elif key == "servers": + added_servers = role_data['servers'].difference(base_data['servers']) + removed_servers = base_data['servers'].difference(role_data['servers']) + elif base_data[key] != role_data[key]: + up_data[key] = role_data[key] + up_data['last_update'] = helper.get_time_as_string() + logger.debug("role: {} +server:{} -server{}".format(role_data, added_servers, removed_servers)) + with database.atomic(): + for server in added_servers: + Role_Servers.get_or_create(role_id=role_id, server_id=server) + # TODO: This is horribly inefficient and we should be using bulk queries but im going for functionality at this point + Role_Servers.delete().where(Role_Servers.role_id == role_id).where(Role_Servers.server_id.in_(removed_servers)).execute() + if up_data: + Roles.update(up_data).where(Roles.role_id == role_id).execute() + + @staticmethod + def add_role(role_name): + role_id = Roles.insert({ + Roles.role_name: role_name.lower(), + Roles.created: helper.get_time_as_string() + }).execute() + return role_id + + @staticmethod + def remove_role(role_id): + role = Roles.get(Roles.role_id == role_id) + return role.delete_instance() + + @staticmethod + def role_id_exists(role_id): + if not db_shortcuts.get_role(role_id): + return False + return True + + @staticmethod + def get_unactioned_commands(): + query = Commands.select().where(Commands.executed == 0) + return db_helper.return_rows(query) + + @staticmethod + def get_server_friendly_name(server_id): + server_data = db_helper.get_server_data_by_id(server_id) friendly_name = "{}-{}".format(server_data.get('server_id', 0), server_data.get('server_name', None)) return friendly_name - def send_command(self, user_id, server_id, remote_ip, command): + @staticmethod + def send_command(user_id, server_id, remote_ip, command): - server_name = self.get_server_friendly_name(server_id) + server_name = db_helper.get_server_friendly_name(server_id) - self.add_to_audit_log(user_id, "Issued Command {} for Server: {}".format(command, server_name), + db_helper.add_to_audit_log(user_id, "Issued Command {} for Server: {}".format(command, server_name), server_id, remote_ip) Commands.insert({ @@ -271,11 +507,13 @@ class db_shortcuts: Commands.command: command }).execute() - def get_actity_log(self): + @staticmethod + def get_actity_log(): q = Audit_Log.select() - return self.return_db_rows(q) + return db_helper.return_db_rows(q) - def return_db_rows(self, model): + @staticmethod + def return_db_rows(model): data = [model_to_dict(row) for row in model] return data diff --git a/app/classes/web/panel_handler.py b/app/classes/web/panel_handler.py index 795fc129..4433f8b8 100644 --- a/app/classes/web/panel_handler.py +++ b/app/classes/web/panel_handler.py @@ -125,9 +125,150 @@ class PanelHandler(BaseHandler): elif page == 'panel_config': page_data['users'] = db_helper.get_all_users() - # print(page_data['users']) + page_data['roles'] = db_helper.get_all_roles() + exec_user = db_helper.get_user(user_data['user_id']) + for user in page_data['users']: + if user.user_id != exec_user['user_id']: + user.api_token = "********" template = "panel/panel_config.html" + elif page == "add_user": + page_data['new_user'] = True + page_data['user'] = {} + page_data['user']['username'] = "" + page_data['user']['user_id'] = -1 + page_data['user']['enabled'] = True + page_data['user']['superuser'] = False + page_data['user']['api_token'] = "N/A" + page_data['user']['created'] = "N/A" + page_data['user']['last_login'] = "N/A" + page_data['user']['last_ip'] = "N/A" + page_data['role']['last_update'] = "N/A" + page_data['user']['roles'] = set() + page_data['user']['servers'] = set() + + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + + page_data['roles_all'] = db_helper.get_all_roles() + page_data['servers_all'] = controller.list_defined_servers() + template = "panel/panel_edit_user.html" + + elif page == "edit_user": + page_data['new_user'] = False + user_id = self.get_argument('id', None) + page_data['user'] = db_helper.get_user(user_id) + page_data['roles_all'] = db_helper.get_all_roles() + page_data['servers_all'] = controller.list_defined_servers() + + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif user_id is None: + self.redirect("/panel/error?error=Invalid User ID") + return False + + if exec_user['user_id'] != page_data['user']['user_id']: + page_data['user']['api_token'] = "********" + template = "panel/panel_edit_user.html" + + elif page == "remove_user": + user_id = bleach.clean(self.get_argument('id', None)) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif user_id is None: + self.redirect("/panel/error?error=Invalid User ID") + return False + else: + # does this user id exist? + target_user = db_helper.get_user(user_id) + if not target_user: + self.redirect("/panel/error?error=Invalid User ID") + return False + elif target_user['superuser']: + self.redirect("/panel/error?error=Cannot remove a superuser") + return False + + db_helper.remove_user(user_id) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Removed user {} (UID:{})".format(target_user['username'], user_id), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") + + elif page == "add_role": + page_data['new_role'] = True + page_data['role'] = {} + page_data['role']['role_name'] = "" + page_data['role']['role_id'] = -1 + page_data['role']['created'] = "N/A" + page_data['role']['last_update'] = "N/A" + page_data['role']['servers'] = set() + + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + + page_data['servers_all'] = controller.list_defined_servers() + template = "panel/panel_edit_role.html" + + elif page == "edit_role": + page_data['new_role'] = False + role_id = self.get_argument('id', None) + page_data['role'] = db_helper.get_role(role_id) + page_data['servers_all'] = controller.list_defined_servers() + + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif role_id is None: + self.redirect("/panel/error?error=Invalid Role ID") + return False + + template = "panel/panel_edit_role.html" + + elif page == "remove_role": + role_id = bleach.clean(self.get_argument('id', None)) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif role_id is None: + self.redirect("/panel/error?error=Invalid Role ID") + return False + else: + # does this user id exist? + target_role = db_helper.get_user(role_id) + if not target_role: + self.redirect("/panel/error?error=Invalid Role ID") + return False + + db_helper.remove_role(role_id) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Removed role {} (RID:{})".format(target_role['role_name'], role_id), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") + elif page == "activity_logs": page_data['audit_logs'] = db_helper.get_actity_log() @@ -158,7 +299,13 @@ class PanelHandler(BaseHandler): crash_detection = int(float(self.get_argument('crash_detection', '0'))) subpage = self.get_argument('subpage', None) - if server_id is None: + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user.superuser: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif server_id is None: self.redirect("/panel/error?error=Invalid Server ID") return False else: @@ -185,11 +332,218 @@ class PanelHandler(BaseHandler): controller.refresh_server_settings(server_id) - user_data = json.loads(self.get_secure_cookie("user_data")) - db_helper.add_to_audit_log(user_data['user_id'], "Edited server {} named {}".format(server_id, server_name), server_id, self.get_remote_ip()) self.redirect("/panel/server_detail?id={}&subpage=config".format(server_id)) + + elif page == "edit_user": + user_id = bleach.clean(self.get_argument('id', None)) + username = bleach.clean(self.get_argument('username', None)) + password0 = bleach.clean(self.get_argument('password0', None)) + password1 = bleach.clean(self.get_argument('password1', None)) + enabled = int(float(bleach.clean(self.get_argument('enabled'), '0'))) + regen_api = int(float(bleach.clean(self.get_argument('regen_api', '0')))) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif username is None or username == "": + self.redirect("/panel/error?error=Invalid username") + return False + elif user_id is None: + self.redirect("/panel/error?error=Invalid User ID") + return False + else: + # does this user id exist? + if not db_helper.user_id_exists(user_id): + self.redirect("/panel/error?error=Invalid User ID") + return False + + if password0 != password1: + self.redirect("/panel/error?error=Passwords must match") + return False + + roles = set() + for role in db_helper.get_all_roles(): + argument = int(float( + bleach.clean( + self.get_argument('role_{}_membership'.format(role.role_id), '0') + ) + )) + if argument: + roles.add(role.role_id) + + servers = set() + for server in controller.list_defined_servers(): + argument = int(float( + bleach.clean( + self.get_argument('server_{}_access'.format(server['server_id']), '0') + ) + )) + if argument: + servers.add(server['server_id']) + + user_data = { + "username": username, + "password": password0, + "enabled": enabled, + "regen_api": regen_api, + "roles": roles, + "servers": servers + } + db_helper.update_user(user_id, user_data=user_data) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Edited user {} (UID:{}) with roles {} and servers {}".format(username, user_id, roles, servers), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") + + + elif page == "add_user": + username = bleach.clean(self.get_argument('username', None)) + password0 = bleach.clean(self.get_argument('password0', None)) + password1 = bleach.clean(self.get_argument('password1', None)) + enabled = int(float(bleach.clean(self.get_argument('enabled'), '0'))) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif username is None or username == "": + self.redirect("/panel/error?error=Invalid username") + return False + else: + # does this user id exist? + if db_helper.get_userid_by_name(username) is not None: + self.redirect("/panel/error?error=User exists") + return False + + if password0 != password1: + self.redirect("/panel/error?error=Passwords must match") + return False + + roles = set() + for role in db_helper.get_all_roles(): + argument = int(float( + bleach.clean( + self.get_argument('role_{}_membership'.format(role.role_id), '0') + ) + )) + if argument: + roles.add(role['role_id']) + + servers = set() + for server in controller.list_defined_servers(): + argument = int(float( + bleach.clean( + self.get_argument('server_{}_access'.format(server['server_id']), '0') + ) + )) + if argument: + servers.add(server['server_id']) + + user_id = db_helper.add_user(username, password=password0, enabled=enabled) + db_helper.update_user(user_id, {"roles":roles, "servers": servers}) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Added user {} (UID:{})".format(username, user_id), + server_id=0, + source_ip=self.get_remote_ip()) + db_helper.add_to_audit_log(exec_user['user_id'], + "Edited user {} (UID:{}) with roles {} and servers {}".format(username, user_id, roles, servers), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") + + elif page == "edit_role": + role_id = bleach.clean(self.get_argument('id', None)) + role_name = bleach.clean(self.get_argument('role_name', None)) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif role_name is None or role_name == "": + self.redirect("/panel/error?error=Invalid username") + return False + elif role_id is None: + self.redirect("/panel/error?error=Invalid Role ID") + return False + else: + # does this user id exist? + if not db_helper.role_id_exists(role_id): + self.redirect("/panel/error?error=Invalid Role ID") + return False + + servers = set() + for server in controller.list_defined_servers(): + argument = int(float( + bleach.clean( + self.get_argument('server_{}_access'.format(server['server_id']), '0') + ) + )) + if argument: + servers.add(server['server_id']) + + role_data = { + "role_name": role_name, + "servers": servers + } + db_helper.update_role(role_id, role_data=role_data) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Edited role {} (RID:{}) with servers {}".format(role_name, role_id, servers), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") + + + elif page == "add_role": + role_name = bleach.clean(self.get_argument('role_name', None)) + + user_data = json.loads(self.get_secure_cookie("user_data")) + exec_user = db_helper.get_user(user_data['user_id']) + if not exec_user['superuser']: + self.redirect("/panel/error?error=Unauthorized access: not superuser") + return False + elif role_name is None or role_name == "": + self.redirect("/panel/error?error=Invalid role name") + return False + else: + # does this user id exist? + if db_helper.get_roleid_by_name(role_name) is not None: + self.redirect("/panel/error?error=Role exists") + return False + + servers = set() + for server in controller.list_defined_servers(): + argument = int(float( + bleach.clean( + self.get_argument('server_{}_access'.format(server['server_id']), '0') + ) + )) + if argument: + servers.add(server['server_id']) + + role_id = db_helper.add_role(role_name) + db_helper.update_role(role_id, {"servers": servers}) + + db_helper.add_to_audit_log(exec_user['user_id'], + "Added role {} (RID:{})".format(role_name, role_id), + server_id=0, + source_ip=self.get_remote_ip()) + db_helper.add_to_audit_log(exec_user['user_id'], + "Edited role {} (RID:{}) with servers {}".format(role_name, role_id, servers), + server_id=0, + source_ip=self.get_remote_ip()) + self.redirect("/panel/panel_config") \ No newline at end of file diff --git a/app/classes/web/public_handler.py b/app/classes/web/public_handler.py index 34356510..7f968677 100644 --- a/app/classes/web/public_handler.py +++ b/app/classes/web/public_handler.py @@ -106,7 +106,7 @@ class PublicHandler(BaseHandler): cookie_data = { "username": user_data.username, "user_id": user_data.user_id, - "account_type": user_data.allowed_servers, + "account_type": user_data.superuser, } self.set_secure_cookie('user_data', json.dumps(cookie_data)) diff --git a/app/frontend/templates/panel/panel_config.html b/app/frontend/templates/panel/panel_config.html index b91859de..37153ed2 100644 --- a/app/frontend/templates/panel/panel_config.html +++ b/app/frontend/templates/panel/panel_config.html @@ -66,18 +66,54 @@ {{ user.api_token }} - {{ user.allowed_servers}} - + {{ [] }} + {% end %} + +
+
+
+
+

Roles

+
+ Can't see everything on mobile?
Try scrolling the table sideways. +
+
  Add New Role
+
+
+
+ + + + + + + + + + {% for role in data['roles'] %} + + + + + + {% end %} + +
RoleAllowed ServersEdit
{{ role.role_name }}{{ [] }}
+
+
+
+
+
diff --git a/app/frontend/templates/panel/panel_edit_role.html b/app/frontend/templates/panel/panel_edit_role.html new file mode 100644 index 00000000..241f98cb --- /dev/null +++ b/app/frontend/templates/panel/panel_edit_role.html @@ -0,0 +1,159 @@ +{% extends ../base.html %} + +{% block meta %} + +{% end %} + +{% block title %}Crafty Controller - Edit Role{% end %} + +{% block content %} + +
+ + +
+
+
+ {% if data['new_role'] %} +

+ New Role +
+ RID: N/A +

+ {% else %} +

+ Edit Role - {{ data['role']['role_name'] }} +
+ RID: {{ data['role']['role_id'] }} +

+ {% end %} +
+
+ +
+ + +
+ +
+
+
+ + +
+
+ {% if data['new_role'] %} +
+ {% else %} + + {% end %} + {% raw xsrf_form_html() %} + + + +
+ + +
+ +
+ +
+ + + + + + + + + {% for server in data['servers_all'] %} + + + + + {% end %} + + +
Server NameAccess?
{{ server['server_name'] }} + {% if server['server_id'] in data['role']['servers'] %} + + {% else %} + + {% end %} +
+
+
+ + + +
+
+ +
+
+
+

Role Config Area

+

Here is where you can change the configuration of your role

+
+

+ Created: {{ str(data['role']['created']) }} +
+ Last updated: {{ str(data['role']['last_update']) }} +
+

+
+
+
+
+ {% if data['new_role'] %} + Delete Role
+ You cannot delete something that does not yet exist + {% else %} + Delete Role + {% end %} + +
+
+
+ +
+
+
+
+ + + +
+ + +{% end %} + +{% block js %} + + +{% end %} \ No newline at end of file diff --git a/app/frontend/templates/panel/panel_edit_user.html b/app/frontend/templates/panel/panel_edit_user.html new file mode 100644 index 00000000..a23cbed6 --- /dev/null +++ b/app/frontend/templates/panel/panel_edit_user.html @@ -0,0 +1,235 @@ +{% extends ../base.html %} + +{% block meta %} + +{% end %} + +{% block title %}Crafty Controller - Edit User{% end %} + +{% block content %} + +
+ + +
+
+
+ {% if data['new_user'] %} +

+ New User +
+ UID: N/A +

+ {% else %} +

+ Edit User - {{ data['user']['user_id'] }} +
+ UID: {{ data['user']['user_id'] }} +

+ {% end %} +
+
+ +
+ + +
+ +
+
+
+ + +
+
+ {% if data['new_user'] %} +
+ {% else %} + + {% end %} + {% raw xsrf_form_html() %} + + + +
+ + +
+ +
+ + +
+ +
+ + +
+ +
+ +
+ + + + + + + + + {% for role in data['roles_all'] %} + + + + + {% end %} + + +
Role NameMember?
{{ role.role_name }} + {% if role.role_id in data['user']['roles'] %} + + {% else %} + + {% end %} + +
+
+
+ +
+ +
+ + + + + + + + + {% for server in data['servers_all'] %} + + + + + {% end %} + + +
Server NameAccess?
{{ server['server_name'] }} + {% if server['server_id'] in data['user']['servers'] %} + + {% else %} + + {% end %} +
+
+
+ +
+ + + + + + +
+ + + +
+
+ +
+
+
+

User Config Area

+

Here is where you can change the configuration of your user

+
+

+ Created: {{ str(data['user']['created']) }} +
+ Last login: {{ str(data['user']['last_login']) }} +
+ Last update: {{ str(data['user']['last_update']) }} +
+ Last IP: {{ data['user']['last_ip'] }} +
+ API Key: {{ data['user']['api_token'] }} +
+

+
+
+
+
+ {% if data['new_user'] %} + Delete User
+ You cannot delete something that does not yet exist + {% elif data['user']['superuser'] %} + Delete User
+ You cannot delete a superuser + {% else %} + Delete User + {% end %} + +
+
+
+ +
+
+
+
+ + + +
+ + +{% end %} + +{% block js %} + + +{% end %} \ No newline at end of file diff --git a/app/frontend/templates/public/404.html b/app/frontend/templates/public/404.html old mode 100755 new mode 100644 diff --git a/app/frontend/templates/public/error.html b/app/frontend/templates/public/error.html old mode 100755 new mode 100644 diff --git a/app/frontend/templates/public/login.html b/app/frontend/templates/public/login.html old mode 100755 new mode 100644 diff --git a/app/frontend/templates/setup/setup1.html b/app/frontend/templates/setup/setup1.html old mode 100755 new mode 100644