From 1adc31767db83daad97974f4fda3bf37250b4077 Mon Sep 17 00:00:00 2001 From: frikky Date: Sun, 18 Jul 2021 23:51:50 +0200 Subject: [PATCH] #428: Fixed scheduling access rights --- backend/go-app/go.mod | 2 +- backend/go-app/main.go | 2 +- backend/go-app/oauth2.go | 18 ++++++++------ backend/go-app/walkoff.go | 34 ++++++++++++++------------ frontend/src/views/Admin.jsx | 4 ++- frontend/src/views/AngularWorkflow.jsx | 3 +++ 6 files changed, 37 insertions(+), 26 deletions(-) diff --git a/backend/go-app/go.mod b/backend/go-app/go.mod index 05370617..410cf847 100644 --- a/backend/go-app/go.mod +++ b/backend/go-app/go.mod @@ -2,7 +2,7 @@ module shuffle go 1.13 -//replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared +replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared //replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi diff --git a/backend/go-app/main.go b/backend/go-app/main.go index 7d3e7cdb..1dab6d7d 100644 --- a/backend/go-app/main.go +++ b/backend/go-app/main.go @@ -3161,7 +3161,7 @@ func buildSwaggerApp(resp http.ResponseWriter, body []byte, user shuffle.User) { //log.Printf("Should generate yaml") swagger, api, pythonfunctions, err := shuffle.GenerateYaml(swagger, newmd5) if err != nil { - log.Printf("Failed building and generating yaml: %s", err) + log.Printf("[WARNING] Failed building and generating yaml (buildapp): %s", err) resp.WriteHeader(500) resp.Write([]byte(`{"success": false, "reason": "Failed building and parsing yaml"}`)) return diff --git a/backend/go-app/oauth2.go b/backend/go-app/oauth2.go index 773661f3..245c209e 100644 --- a/backend/go-app/oauth2.go +++ b/backend/go-app/oauth2.go @@ -810,18 +810,22 @@ func handleDeleteOutlookSub(resp http.ResponseWriter, request *http.Request) { user, err := shuffle.HandleApiAuthentication(resp, request) if err != nil { - log.Printf("Api authentication failed in outlook deploy: %s", err) + log.Printf("[WARNING] Api authentication failed in outlook deploy: %s", err) resp.WriteHeader(401) resp.Write([]byte(`{"success": false}`)) return } // FIXME - have a check for org etc too.. - if user.Id != workflow.Owner && user.Role != "admin" { - log.Printf("Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) - resp.WriteHeader(401) - resp.Write([]byte(`{"success": false}`)) - return + if user.Id != workflow.Owner || len(user.Id) == 0 { + if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + log.Printf("[INFO] User %s is accessing %s as admin (delete outlook sub)", user.Username, workflow.ID) + } else { + log.Printf("[WARNING] Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) + resp.WriteHeader(401) + resp.Write([]byte(`{"success": false}`)) + return + } } // Check what kind of sub it is @@ -879,7 +883,7 @@ func createOutlookSub(resp http.ResponseWriter, request *http.Request) { // FIXME - have a check for org etc too.. if user.Id != workflow.Owner && user.Role != "admin" { - log.Printf("Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) + log.Printf("[WARNING] Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) resp.WriteHeader(401) resp.Write([]byte(`{"success": false}`)) return diff --git a/backend/go-app/walkoff.go b/backend/go-app/walkoff.go index c0f16bbf..964670f5 100644 --- a/backend/go-app/walkoff.go +++ b/backend/go-app/walkoff.go @@ -506,7 +506,7 @@ func createSchedule(ctx context.Context, scheduleId, workflowId, name, startNode //log.Printf("BODY: %s", string(body)) parsedArgument := strings.Replace(string(body), "\"", "\\\"", -1) bodyWrapper := fmt.Sprintf(`{"start": "%s", "execution_source": "schedule", "execution_argument": "%s"}`, startNode, parsedArgument) - log.Printf("WRAPPER BODY: \n%s", bodyWrapper) + log.Printf("[INFO] Body for schedule %s in workflow %s: \n%s", scheduleId, workflowId, bodyWrapper) job := func() { request := &http.Request{ URL: &url.URL{}, @@ -1155,7 +1155,7 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) { if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner) } else { - log.Printf("Wrong user (%s) for workflow %s", user.Username, workflow.ID) + log.Printf("[WARNING] Wrong user (%s) for workflow %s (delete workflow)", user.Username, workflow.ID) resp.WriteHeader(401) resp.Write([]byte(`{"success": false}`)) return @@ -2201,9 +2201,9 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) { return } - if user.Id != workflow.Owner && user.Role != "scheduler" { + if user.Id != workflow.Owner || len(user.Id) == 0 { if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { - log.Printf("[DEBUG] User %s is accessing workflow %s as admin", user.Username, workflow.ID) + log.Printf("[DEBUG] User %s is accessing workflow %s as admin (stop schedule)", user.Username, workflow.ID) } else { log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) resp.WriteHeader(401) @@ -2347,7 +2347,7 @@ func stopScheduleGCP(resp http.ResponseWriter, request *http.Request) { // FIXME - have a check for org etc too.. // FIXME - admin check like this? idk if user.Id != workflow.Owner && user.Role != "scheduler" { - log.Printf("Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) + log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) resp.WriteHeader(401) resp.Write([]byte(`{"success": false}`)) return @@ -2411,7 +2411,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) { user, err := shuffle.HandleApiAuthentication(resp, request) if err != nil { - log.Printf("Api authentication failed in schedule workflow: %s", err) + log.Printf("[WARNING] Api authentication failed in schedule workflow: %s", err) resp.WriteHeader(401) resp.Write([]byte(`{"success": false}`)) return @@ -2445,13 +2445,15 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) { return } - // FIXME - have a check for org etc too.. - // FIXME - admin check like this? idk - if user.Id != workflow.Owner && user.Role != "scheduler" { - log.Printf("Wrong user (%s) for workflow %s", user.Username, workflow.ID) - resp.WriteHeader(401) - resp.Write([]byte(`{"success": false}`)) - return + if user.Id != workflow.Owner || len(user.Id) == 0 { + if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { + log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner) + } else { + log.Printf("[WARNING] Wrong user (%s) for workflow %s (schedule start). Owner: %s", user.Username, workflow.ID, workflow.Owner) + resp.WriteHeader(401) + resp.Write([]byte(`{"success": false}`)) + return + } } if len(workflow.Actions) == 0 { @@ -2496,7 +2498,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) { startNode = workflow.Start } - log.Printf("Startnode: %s", startNode) + //log.Printf("Startnode: %s", startNode) if len(schedule.Id) != 36 { log.Printf("ID length is not 36 for schedule: %s", err) @@ -2597,7 +2599,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) { } } - log.Printf("Schedulearg: %s", parsedBody) + //log.Printf("Schedulearg: %s", parsedBody) err = createSchedule( ctx, @@ -3282,7 +3284,7 @@ func iterateOpenApiGithub(fs billy.Filesystem, dir []os.FileInfo, extra string, //log.Printf("Should generate yaml") swagger, api, _, err := shuffle.GenerateYaml(swagger, parsedOpenApi.ID) if err != nil { - log.Printf("Failed building and generating yaml in loop (2) (%s): %s. Continuing.", filename, err) + log.Printf("[WARNING] Failed building and generating yaml in loop (2) (%s): %s. Continuing.", filename, err) continue } diff --git a/frontend/src/views/Admin.jsx b/frontend/src/views/Admin.jsx index b1244b51..656d4c90 100644 --- a/frontend/src/views/Admin.jsx +++ b/frontend/src/views/Admin.jsx @@ -2048,7 +2048,9 @@ const Admin = (props) => { } } - getFiles() + setTimeout(() => { + getFiles() + }, 2500) } const uploadFile = (e) => { diff --git a/frontend/src/views/AngularWorkflow.jsx b/frontend/src/views/AngularWorkflow.jsx index e12f45b4..a5c6a249 100644 --- a/frontend/src/views/AngularWorkflow.jsx +++ b/frontend/src/views/AngularWorkflow.jsx @@ -6263,6 +6263,9 @@ const AngularWorkflow = (props) => { workflow.triggers[selectedTriggerIndex].parameters[1] = {"name": "tmp", "value": "webhook_"+selectedTrigger.id} workflow.triggers[selectedTriggerIndex].parameters[2] = {"name": "auth_headers", "value": ""} setWorkflow(workflow) + } else { + // Always update + workflow.triggers[selectedTriggerIndex].parameters[0].value = referenceUrl+"webhook_"+selectedTrigger.id } const trigger_header_auth = workflow.triggers[selectedTriggerIndex].parameters.length > 2 ? workflow.triggers[selectedTriggerIndex].parameters[2].value : ""