marker/shuffle-cracked
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

#428: Fixed scheduling access rights

Browse Source
This commit is contained in:
frikky
2021-07-18 23:51:50 +02:00
parent d0976bbe50
commit 1adc31767d
6 changed files with 37 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/go-app/go.mod
+1 -1
View File
@@ -2,7 +2,7 @@ module shuffle
go 1.13 go 1.13
//replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared replace github.com/frikky/shuffle-shared => ../../../../git/shuffle-shared
//replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi //replace github.com/frikky/kin-openapi => ../../../../git/kin-openapi
backend/go-app/main.go
+1 -1
View File
@@ -3161,7 +3161,7 @@ func buildSwaggerApp(resp http.ResponseWriter, body []byte, user shuffle.User) {
//log.Printf("Should generate yaml") //log.Printf("Should generate yaml")
swagger, api, pythonfunctions, err := shuffle.GenerateYaml(swagger, newmd5) swagger, api, pythonfunctions, err := shuffle.GenerateYaml(swagger, newmd5)
if err != nil { if err != nil {
log.Printf("Failed building and generating yaml: %s", err) log.Printf("[WARNING] Failed building and generating yaml (buildapp): %s", err)
resp.WriteHeader(500) resp.WriteHeader(500)
resp.Write([]byte(`{"success": false, "reason": "Failed building and parsing yaml"}`)) resp.Write([]byte(`{"success": false, "reason": "Failed building and parsing yaml"}`))
return return
backend/go-app/oauth2.go
+11 -7
View File
@@ -810,18 +810,22 @@ func handleDeleteOutlookSub(resp http.ResponseWriter, request *http.Request) {
user, err := shuffle.HandleApiAuthentication(resp, request) user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil { if err != nil {
log.Printf("Api authentication failed in outlook deploy: %s", err) log.Printf("[WARNING] Api authentication failed in outlook deploy: %s", err)
resp.WriteHeader(401) resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
} }
// FIXME - have a check for org etc too.. // FIXME - have a check for org etc too..
if user.Id != workflow.Owner && user.Role != "admin" { if user.Id != workflow.Owner || len(user.Id) == 0 {
log.Printf("Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
resp.WriteHeader(401) log.Printf("[INFO] User %s is accessing %s as admin (delete outlook sub)", user.Username, workflow.ID)
resp.Write([]byte(`{"success": false}`)) } else {
return log.Printf("[WARNING] Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID)
resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`))
return
}
} }
// Check what kind of sub it is // Check what kind of sub it is
@@ -879,7 +883,7 @@ func createOutlookSub(resp http.ResponseWriter, request *http.Request) {
// FIXME - have a check for org etc too.. // FIXME - have a check for org etc too..
if user.Id != workflow.Owner && user.Role != "admin" { if user.Id != workflow.Owner && user.Role != "admin" {
log.Printf("Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID) log.Printf("[WARNING] Wrong user (%s) for workflow %s when deploying outlook", user.Username, workflow.ID)
resp.WriteHeader(401) resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
backend/go-app/walkoff.go
+18 -16
View File
@@ -506,7 +506,7 @@ func createSchedule(ctx context.Context, scheduleId, workflowId, name, startNode
//log.Printf("BODY: %s", string(body)) //log.Printf("BODY: %s", string(body))
parsedArgument := strings.Replace(string(body), "\"", "\\\"", -1) parsedArgument := strings.Replace(string(body), "\"", "\\\"", -1)
bodyWrapper := fmt.Sprintf(`{"start": "%s", "execution_source": "schedule", "execution_argument": "%s"}`, startNode, parsedArgument) bodyWrapper := fmt.Sprintf(`{"start": "%s", "execution_source": "schedule", "execution_argument": "%s"}`, startNode, parsedArgument)
log.Printf("WRAPPER BODY: \n%s", bodyWrapper) log.Printf("[INFO] Body for schedule %s in workflow %s: \n%s", scheduleId, workflowId, bodyWrapper)
job := func() { job := func() {
request := &http.Request{ request := &http.Request{
URL: &url.URL{}, URL: &url.URL{},
@@ -1155,7 +1155,7 @@ func deleteWorkflow(resp http.ResponseWriter, request *http.Request) {
if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner) log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner)
} else { } else {
log.Printf("Wrong user (%s) for workflow %s", user.Username, workflow.ID) log.Printf("[WARNING] Wrong user (%s) for workflow %s (delete workflow)", user.Username, workflow.ID)
resp.WriteHeader(401) resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
@@ -2201,9 +2201,9 @@ func stopSchedule(resp http.ResponseWriter, request *http.Request) {
return return
} }
if user.Id != workflow.Owner && user.Role != "scheduler" { if user.Id != workflow.Owner || len(user.Id) == 0 {
if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" { if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
log.Printf("[DEBUG] User %s is accessing workflow %s as admin", user.Username, workflow.ID) log.Printf("[DEBUG] User %s is accessing workflow %s as admin (stop schedule)", user.Username, workflow.ID)
} else { } else {
log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID)
resp.WriteHeader(401) resp.WriteHeader(401)
@@ -2347,7 +2347,7 @@ func stopScheduleGCP(resp http.ResponseWriter, request *http.Request) {
// FIXME - have a check for org etc too.. // FIXME - have a check for org etc too..
// FIXME - admin check like this? idk // FIXME - admin check like this? idk
if user.Id != workflow.Owner && user.Role != "scheduler" { if user.Id != workflow.Owner && user.Role != "scheduler" {
log.Printf("Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID) log.Printf("[WARNING] Wrong user (%s) for workflow %s (stop schedule)", user.Username, workflow.ID)
resp.WriteHeader(401) resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
@@ -2411,7 +2411,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
user, err := shuffle.HandleApiAuthentication(resp, request) user, err := shuffle.HandleApiAuthentication(resp, request)
if err != nil { if err != nil {
log.Printf("Api authentication failed in schedule workflow: %s", err) log.Printf("[WARNING] Api authentication failed in schedule workflow: %s", err)
resp.WriteHeader(401) resp.WriteHeader(401)
resp.Write([]byte(`{"success": false}`)) resp.Write([]byte(`{"success": false}`))
return return
@@ -2445,13 +2445,15 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
return return
} }
// FIXME - have a check for org etc too.. if user.Id != workflow.Owner || len(user.Id) == 0 {
// FIXME - admin check like this? idk if workflow.OrgId == user.ActiveOrg.Id && user.Role == "admin" {
if user.Id != workflow.Owner && user.Role != "scheduler" { log.Printf("[INFO] User %s is deleting workflow %s as admin. Owner: %s", user.Username, workflow.ID, workflow.Owner)
log.Printf("Wrong user (%s) for workflow %s", user.Username, workflow.ID) } else {
resp.WriteHeader(401) log.Printf("[WARNING] Wrong user (%s) for workflow %s (schedule start). Owner: %s", user.Username, workflow.ID, workflow.Owner)
resp.Write([]byte(`{"success": false}`)) resp.WriteHeader(401)
return resp.Write([]byte(`{"success": false}`))
return
}
} }
if len(workflow.Actions) == 0 { if len(workflow.Actions) == 0 {
@@ -2496,7 +2498,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
startNode = workflow.Start startNode = workflow.Start
} }
log.Printf("Startnode: %s", startNode) //log.Printf("Startnode: %s", startNode)
if len(schedule.Id) != 36 { if len(schedule.Id) != 36 {
log.Printf("ID length is not 36 for schedule: %s", err) log.Printf("ID length is not 36 for schedule: %s", err)
@@ -2597,7 +2599,7 @@ func scheduleWorkflow(resp http.ResponseWriter, request *http.Request) {
} }
} }
log.Printf("Schedulearg: %s", parsedBody) //log.Printf("Schedulearg: %s", parsedBody)
err = createSchedule( err = createSchedule(
ctx, ctx,
@@ -3282,7 +3284,7 @@ func iterateOpenApiGithub(fs billy.Filesystem, dir []os.FileInfo, extra string,
//log.Printf("Should generate yaml") //log.Printf("Should generate yaml")
swagger, api, _, err := shuffle.GenerateYaml(swagger, parsedOpenApi.ID) swagger, api, _, err := shuffle.GenerateYaml(swagger, parsedOpenApi.ID)
if err != nil { if err != nil {
log.Printf("Failed building and generating yaml in loop (2) (%s): %s. Continuing.", filename, err) log.Printf("[WARNING] Failed building and generating yaml in loop (2) (%s): %s. Continuing.", filename, err)
continue continue
} }
frontend/src/views/Admin.jsx
+3 -1
View File
@@ -2048,7 +2048,9 @@ const Admin = (props) => {
} }
} }
getFiles() setTimeout(() => {
getFiles()
}, 2500)
} }
const uploadFile = (e) => { const uploadFile = (e) => {
frontend/src/views/AngularWorkflow.jsx
+3
View File
@@ -6263,6 +6263,9 @@ const AngularWorkflow = (props) => {
workflow.triggers[selectedTriggerIndex].parameters[1] = {"name": "tmp", "value": "webhook_"+selectedTrigger.id} workflow.triggers[selectedTriggerIndex].parameters[1] = {"name": "tmp", "value": "webhook_"+selectedTrigger.id}
workflow.triggers[selectedTriggerIndex].parameters[2] = {"name": "auth_headers", "value": ""} workflow.triggers[selectedTriggerIndex].parameters[2] = {"name": "auth_headers", "value": ""}
setWorkflow(workflow) setWorkflow(workflow)
} else {
// Always update
workflow.triggers[selectedTriggerIndex].parameters[0].value = referenceUrl+"webhook_"+selectedTrigger.id
} }
const trigger_header_auth = workflow.triggers[selectedTriggerIndex].parameters.length > 2 ? workflow.triggers[selectedTriggerIndex].parameters[2].value : "" const trigger_header_auth = workflow.triggers[selectedTriggerIndex].parameters.length > 2 ? workflow.triggers[selectedTriggerIndex].parameters[2].value : ""