tronnet/ProxmoxAAS-API
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix auth early escape

Browse Source 
Signed-off-by: Arthur Lu <learthurgo@gmail.com>
This commit is contained in:
Arthur Lu 2023-05-16 15:46:39 +00:00
parent 4039cdf92d
commit f415b8f962
2 changed files with 64 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
main.js
View File

@ -25,7 +25,8 @@ app.get("/api/echo", (req, res) => {
}); });
app.get("/api/auth", async (req, res) => { app.get("/api/auth", async (req, res) => {
await checkAuth(req.cookies); let auth = await checkAuth(req.cookies);
if (!auth) { return; }
res.status(200).send({ auth: true }); res.status(200).send({ auth: true });
}); });
@ -71,28 +72,32 @@ app.delete("/api/ticket", async (req, res) => {
app.get("/api/user/resources", async (req, res) => { app.get("/api/user/resources", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
let resources = await getAllocatedResources(req, req.cookies.username); let resources = await getAllocatedResources(req, req.cookies.username);
res.status(200).send(resources); res.status(200).send(resources);
}); });
app.get("/api/user/instances", async (req, res) => { app.get("/api/user/instances", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
let config = getUserConfig(req.cookies.username); let config = getUserConfig(req.cookies.username);
res.status(200).send(config.instances) res.status(200).send(config.instances)
}); });
app.get("/api/user/nodes", async (req, res) => { app.get("/api/user/nodes", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
let config = getUserConfig(req.cookies.username); let config = getUserConfig(req.cookies.username);
res.status(200).send(config.nodes) res.status(200).send(config.nodes)
}) })
app.post("/api/instance/disk/detach", async (req, res) => { app.post("/api/instance/disk/detach", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
if (req.body.disk.includes("unused")) { if (req.body.disk.includes("unused")) {
res.status(500).send({ error: `Requested disk ${req.body.disk} cannot be unused. Use /disk/delete to permanently delete unused disks.` }); res.status(500).send({ error: `Requested disk ${req.body.disk} cannot be unused. Use /disk/delete to permanently delete unused disks.` });
res.end(); res.end();
@ -106,7 +111,8 @@ app.post("/api/instance/disk/detach", async (req, res) => {
app.post("/api/instance/disk/attach", async (req, res) => { app.post("/api/instance/disk/attach", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
let action = {}; let action = {};
action[req.body.disk] = req.body.data; action[req.body.disk] = req.body.data;
action = JSON.stringify(action); action = JSON.stringify(action);
@ -117,7 +123,8 @@ app.post("/api/instance/disk/attach", async (req, res) => {
app.post("/api/instance/disk/resize", async (req, res) => { app.post("/api/instance/disk/resize", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// check disk existence // check disk existence
let diskConfig = await getDiskInfo(req.body.node, req.body.type, req.body.vmid, req.body.disk); // get target disk let diskConfig = await getDiskInfo(req.body.node, req.body.type, req.body.vmid, req.body.disk); // get target disk
if (!diskConfig) { // exit if disk does not exist if (!diskConfig) { // exit if disk does not exist
@ -143,7 +150,8 @@ app.post("/api/instance/disk/resize", async (req, res) => {
app.post("/api/instance/disk/move", async (req, res) => { app.post("/api/instance/disk/move", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// check disk existence // check disk existence
let diskConfig = await getDiskInfo(req.body.node, req.body.type, req.body.vmid, req.body.disk); // get target disk let diskConfig = await getDiskInfo(req.body.node, req.body.type, req.body.vmid, req.body.disk); // get target disk
if (!diskConfig) { // exit if disk does not exist if (!diskConfig) { // exit if disk does not exist
@ -183,7 +191,8 @@ app.post("/api/instance/disk/move", async (req, res) => {
app.post("/api/instance/disk/delete", async (req, res) => { app.post("/api/instance/disk/delete", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// only ide or unused are allowed to be deleted // only ide or unused are allowed to be deleted
if (!req.body.disk.includes("unused") && !req.body.disk.includes("ide")) { // must be ide or unused if (!req.body.disk.includes("unused") && !req.body.disk.includes("ide")) { // must be ide or unused
res.status(500).send({ error: `Requested disk ${req.body.disk} must be unused or ide. Use /disk/detach to detach disks in use.` }); res.status(500).send({ error: `Requested disk ${req.body.disk} must be unused or ide. Use /disk/detach to detach disks in use.` });
@ -199,7 +208,8 @@ app.post("/api/instance/disk/delete", async (req, res) => {
app.post("/api/instance/disk/create", async (req, res) => { app.post("/api/instance/disk/create", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// setup request // setup request
let request = {}; let request = {};
if (!req.body.disk.includes("ide")) { if (!req.body.disk.includes("ide")) {
@ -230,7 +240,8 @@ app.post("/api/instance/disk/create", async (req, res) => {
app.post("/api/instance/resources", async (req, res) => { app.post("/api/instance/resources", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// get current config // get current config
let currentConfig = await requestPVE(`/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}/config`, "GET", null, null, pveAPIToken); let currentConfig = await requestPVE(`/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}/config`, "GET", null, null, pveAPIToken);
let request = { let request = {
@ -252,7 +263,8 @@ app.post("/api/instance/resources", async (req, res) => {
app.post("/api/instance", async (req, res) => { app.post("/api/instance", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// setup request // setup request
let request = { let request = {
cores: Number(req.body.cores), cores: Number(req.body.cores),
@ -309,7 +321,8 @@ app.post("/api/instance", async (req, res) => {
app.delete("/api/instance", async (req, res) => { app.delete("/api/instance", async (req, res) => {
// check auth // check auth
await checkAuth(req.cookies, res); let auth = await checkAuth(req.cookies, res);
if (!auth) { return; }
// commit action // commit action
let result = await requestPVE(`/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}`, "DELETE", req.cookies, null, pveAPIToken); let result = await requestPVE(`/nodes/${req.body.node}/${req.body.type}/${req.body.vmid}`, "DELETE", req.cookies, null, pveAPIToken);
await handleResponse(req.body.node, result, res); await handleResponse(req.body.node, result, res);

2
pve.js
View File

@ -14,8 +14,8 @@ export async function checkAuth (cookies, res, vmpath = null) {
if (!auth) { if (!auth) {
res.status(401).send({auth: auth}); res.status(401).send({auth: auth});
res.end(); res.end();
return;
} }
return auth;
} }
export async function requestPVE (path, method, cookies, body = null, token = null) { export async function requestPVE (path, method, cookies, body = null, token = null) {