diff --git a/CyberCP/secMiddleware.py b/CyberCP/secMiddleware.py new file mode 100644 index 000000000..27de0fe89 --- /dev/null +++ b/CyberCP/secMiddleware.py @@ -0,0 +1,14 @@ +from django.conf import settings +from django.shortcuts import HttpResponse + +class secMiddleware: + + def __init__(self, get_response): + self.get_response = get_response + + def __call__(self, request): + if request.method == 'POST': + if request.body.find(';') > -1 or request.body.find('&&') > -1 or request.body.find('|') > -1 or request.body.find('...') > -1: + return HttpResponse('Bad input.') + response = self.get_response(request) + return response \ No newline at end of file diff --git a/CyberCP/settings.py b/CyberCP/settings.py index 88ef6d3fd..d0d1f47c9 100644 --- a/CyberCP/settings.py +++ b/CyberCP/settings.py @@ -70,6 +70,7 @@ MIDDLEWARE = [ 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.clickjacking.XFrameOptionsMiddleware', + 'CyberCP.secMiddleware.secMiddleware' ] ROOT_URLCONF = 'CyberCP.urls' diff --git a/backup/views.py b/backup/views.py index a6ff23531..0872c947a 100644 --- a/backup/views.py +++ b/backup/views.py @@ -26,11 +26,8 @@ from plogical.mailUtilities import mailUtilities def loadBackupHome(request): try: val = request.session['userID'] - admin = Administrator.objects.get(pk=val) - viewStatus = 1 - if admin.type == 3: viewStatus = 0 @@ -79,8 +76,8 @@ def restoreSite(request): def backupSite(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: - admin = Administrator.objects.get(pk=request.session['userID']) if admin.type == 1: websites = Websites.objects.all() @@ -118,15 +115,21 @@ def backupSite(request): def getCurrentBackups(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': data = json.loads(request.body) backupDomain = data['websiteToBeBacked'] - website = Websites.objects.get(domain=backupDomain) + if admin.type != 1: + if website.admin != admin: + dic = {'fetchStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + backups = website.backups_set.all() @@ -166,7 +169,6 @@ def getCurrentBackups(request): final_json = json.dumps(final_dic) return HttpResponse(final_json) - def submitBackupCreation(request): try: if request.method == 'POST': @@ -308,8 +310,6 @@ def cancelBackupCreation(request): final_json = json.dumps({'abortStatus': 1, 'error_message': "None", "status": 0}) return HttpResponse(final_json) - - except BaseException,msg: final_dic = {'abortStatus': 0, 'error_message': str(msg)} final_json = json.dumps(final_dic) @@ -324,14 +324,20 @@ def cancelBackupCreation(request): def deleteBackup(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': - data = json.loads(request.body) backupID = data['backupID'] - backup = Backups.objects.get(id=backupID) + + if admin.type != 1: + if backup.website.admin != admin: + dic = {'deleteStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + domainName = backup.website.domain path = "/home/"+domainName+"/backup/"+backup.fileName+".tar.gz" @@ -461,9 +467,17 @@ def backupDestinations(request): def submitDestinationCreation(request): try: + val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': + if admin.type != 1: + dic = {'destStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + + destinations = backupUtil.backupUtilities.destinationsPath data = json.loads(request.body) @@ -524,9 +538,15 @@ def submitDestinationCreation(request): def getCurrentBackupDestinations(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': + if admin.type != 1: + dic = {'fetchStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + records = dest.objects.all() json_data = "[" @@ -566,7 +586,6 @@ def getConnectionStatus(request): try: if request.method == 'POST': - data = json.loads(request.body) ipAddress = data['IPAddress'] @@ -593,9 +612,16 @@ def getConnectionStatus(request): def deleteDestination(request): try: + val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': + if admin.type != 1: + dic = {'delStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + data = json.loads(request.body) ipAddress = data['IPAddress'] @@ -680,9 +706,15 @@ def scheduleBackup(request): def getCurrentBackupSchedules(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': + if admin.type != 1: + dic = {'fetchStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + records = backupSchedules.objects.all() json_data = "[" @@ -718,12 +750,18 @@ def getCurrentBackupSchedules(request): def submitBackupSchedule(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': data = json.loads(request.body) backupDest = data['backupDest'] backupFreq = data['backupFreq'] + if admin.type != 1: + dic = {'scheduleStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + path = "/etc/crontab" ## check if already exists @@ -922,12 +960,20 @@ def submitBackupSchedule(request): def scheduleDelete(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': + + if admin.type != 1: + dic = {'delStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + data = json.loads(request.body) backupDest = data['destLoc'] backupFreq = data['frequency'] + path = "/etc/crontab" @@ -1067,8 +1113,15 @@ def remoteBackups(request): def submitRemoteBackups(request): try: + userID = request.session['userID'] + admin = Administrator.objects.get(pk=userID) if request.method == 'POST': + if admin.type != 1: + dic = {'status': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + data = json.loads(request.body) ipAddress = data['ipAddress'] password = data['password'] @@ -1191,10 +1244,16 @@ def submitRemoteBackups(request): def starRemoteTransfer(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == 'POST': data = json.loads(request.body) + if admin.type != 1: + dic = {'remoteTransferStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + ipAddress = data['ipAddress'] password = data['password'] accountsToTransfer = data['accountsToTransfer'] @@ -1256,7 +1315,16 @@ def starRemoteTransfer(request): def getRemoteTransferStatus(request): try: + val = request.session['userID'] + admin = Administrator.objects.get(pk=val) + if request.method == "POST": + + if admin.type != 1: + dic = {'remoteTransferStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + data = json.loads(request.body) ipAddress = data['ipAddress'] password = data['password'] @@ -1300,8 +1368,15 @@ def getRemoteTransferStatus(request): def remoteBackupRestore(request): try: val = request.session['userID'] + admin = Administrator.objects.get(pk=val) try: if request.method == "POST": + + if admin.type != 1: + dic = {'remoteRestoreStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) + data = json.loads(request.body) backupDir = data['backupDir'] @@ -1337,8 +1412,16 @@ def remoteBackupRestore(request): def localRestoreStatus(request): try: + val = request.session['userID'] + admin = Administrator.objects.get(pk=val) if request.method == "POST": + if admin.type != 1: + data_ret = {'remoteTransferStatus': 0, 'error_message': "No such log found", "status": "None", + "complete": 0} + json_data = json.dumps(data_ret) + return HttpResponse(json_data) + data = json.loads(request.body) backupDir = data['backupDir'] @@ -1383,6 +1466,13 @@ def localRestoreStatus(request): def cancelRemoteBackup(request): try: + val = request.session['userID'] + admin = Administrator.objects.get(pk=val) + + if admin.type != 1: + dic = {'cancelStatus': 0, 'error_message': "Only administrator can view this page."} + json_data = json.dumps(dic) + return HttpResponse(json_data) if request.method == "POST": diff --git a/baseTemplate/templates/baseTemplate/index.html b/baseTemplate/templates/baseTemplate/index.html index 9bcb6b2db..a7fbeedbd 100755 --- a/baseTemplate/templates/baseTemplate/index.html +++ b/baseTemplate/templates/baseTemplate/index.html @@ -302,7 +302,7 @@