svn commit: samba r20559 - in branches/SAMBA_4_0: services
webapps/swat/source/class/swat/module
webapps/swat/source/class/swat/module/ldbbrowse
webapps/swat/source/class/swat/module/statistics
derrell at samba.org
derrell at samba.org
Fri Jan 5 19:29:46 GMT 2007
Author: derrell
Date: 2007-01-05 19:29:45 +0000 (Fri, 05 Jan 2007)
New Revision: 20559
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=20559
Log:
Web Application Framework
- Disallow, for now, any ScriptTransport access. A serious security issue has
been described, and since we don't currently need it for anything, disable
it completely.
- Continued clean-up towards implementing the common authentication code
Modified:
branches/SAMBA_4_0/services/json_auth.esp
branches/SAMBA_4_0/services/request.esp
branches/SAMBA_4_0/webapps/swat/source/class/swat/module/AbstractModuleFsm.js
branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Fsm.js
branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Gui.js
branches/SAMBA_4_0/webapps/swat/source/class/swat/module/statistics/Fsm.js
Changeset:
Modified: branches/SAMBA_4_0/services/json_auth.esp
===================================================================
--- branches/SAMBA_4_0/services/json_auth.esp 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/services/json_auth.esp 2007-01-05 19:29:45 UTC (rev 20559)
@@ -1,7 +1,13 @@
<%
/* Return true to allow access; false otherwise */
-function json_authenticate(serviceComponents, method)
+function json_authenticate(serviceComponents, method, scriptTransportId)
{
+ // Don't allow any access via ScriptTransport, for now.
+ if (scriptTransportId != jsonrpc.Constant.ScriptTransport.NotInUse)
+ {
+ return false;
+ }
+
return true;
}
Modified: branches/SAMBA_4_0/services/request.esp
===================================================================
--- branches/SAMBA_4_0/services/request.esp 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/services/request.esp 2007-01-05 19:29:45 UTC (rev 20559)
@@ -292,6 +292,8 @@
}
else if (request["REQUEST_METHOD"] == "GET" &&
form["_ScriptTransport_id"] != undefined &&
+ form["_ScriptTransport_id"] !=
+ jsonrpc.Constant.ScriptTransport.NotInUse &&
form["_ScriptTransport_data"] != undefined)
{
/* We have what looks like a valid ScriptTransport request */
@@ -455,8 +457,17 @@
return;
}
-/* Ensure the logged-in user is allowed to issue the requested method */
-if (! json_authenticate(serviceComponents, jsonInput.method))
+/*
+ * Ensure the logged-in user is allowed to issue the requested method. We
+ * provide the scriptTransportId as one of the determining factors because
+ * accepting requests via ScriptTransport is dangerous. Only methods which
+ * one might allow when unauthenticated should be allowed via ScriptTransport
+ * as it is easy for a rogue site to trick a user into bypassing
+ * authentication.
+ */
+if (! json_authenticate(serviceComponents,
+ jsonInput.method,
+ scriptTransportId))
{
error.setError(jsonrpc.Constant.ErrorCode.PermissionDenied,
"Permission denied");
Modified: branches/SAMBA_4_0/webapps/swat/source/class/swat/module/AbstractModuleFsm.js
===================================================================
--- branches/SAMBA_4_0/webapps/swat/source/class/swat/module/AbstractModuleFsm.js 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/webapps/swat/source/class/swat/module/AbstractModuleFsm.js 2007-01-05 19:29:45 UTC (rev 20559)
@@ -151,10 +151,10 @@
function(fsm, event)
{
// Get the request object
- var request = _this.getCurrentRpcRequest();
+ var rpcRequest = _this.getCurrentRpcRequest();
// Issue an abort for the pending request
- request.abort();
+ rpcRequest.request.abort();
}
});
state.addTransition(trans);
@@ -174,14 +174,14 @@
function(fsm, event)
{
// Get the request object
- var request = _this.getCurrentRpcRequest();
+ var rpcRequest = _this.getCurrentRpcRequest();
// Generate the result for a completed request
- request.setUserData("result",
- {
- type : "complete",
- data : event.getData()
- });
+ rpcRequest.setUserData("result",
+ {
+ type : "complete",
+ data : event.getData()
+ });
}
});
state.addTransition(trans);
@@ -201,14 +201,14 @@
function(fsm, event)
{
// Get the request object
- var request = _this.getCurrentRpcRequest();
+ var rpcRequest = _this.getCurrentRpcRequest();
// Generate the result for a completed request
- request.setUserData("result",
- {
- type : "failed",
- data : event.getData()
- });
+ rpcRequest.setUserData("result",
+ {
+ type : "failed",
+ data : event.getData()
+ });
}
});
state.addTransition(trans);
@@ -221,68 +221,64 @@
* @param fsm {qx.util.fsm.FiniteStateMachine}
* The finite state machine issuing this remote procedure call.
*
- * @param service {String}
+ * @param service {string}
* The name of the remote service which provides the specified method.
*
- * @param method {String}
+ * @param method {string}
* The name of the method within the specified service.
*
* @param params {Array}
* The parameters to be passed to the specified method.
*
- * @return {qx.io.remote.Request}
+ * @return {Object}
* The request object for the just-issued RPC request.
*/
qx.Proto.callRpc = function(fsm, service, method, params)
{
// Create an object to hold a copy of the parameters. (We need a
// qx.core.Object() to be able to store this in the finite state machine.)
- var o = new qx.core.Object();
+ var rpcRequest = new qx.core.Object();
- // copy the parameters; we'll prefix our copy with additional params
- o.allParams = params.slice(0);
+ // Save the service name
+ rpcRequest.service = service;
- // prepend the method
- o.allParams.unshift(method);
+ // Copy the parameters; we'll prefix our copy with additional params
+ rpcRequest.params = params.slice(0);
- // prepend the flag indicating to coalesce failure events
- o.allParams.unshift(true);
+ // Prepend the method
+ rpcRequest.params.unshift(method);
- // prepend the service name
- o.allParams.unshift(service);
+ // Prepend the flag indicating to coalesce failure events
+ rpcRequest.params.unshift(true);
- // Save the complete parameter list in case authentication fails and we need
- // to reissue the request.
- fsm.addObject("swat.module.rpc_params", o);
-
// Retrieve the RPC object */
var rpc = fsm.getObject("swat.module.rpc");
// Set the service name
- rpc.setServiceName(o.allParams[0]);
+ rpc.setServiceName(rpcRequest.service);
// Issue the request, skipping the already-specified service name
- var request =
+ rpcRequest.request =
qx.io.remote.Rpc.prototype.callAsyncListeners.apply(rpc,
- o.allParams.slice(1));
+ rpcRequest.params);
- // Make the request object available to the AwaitRpcResult state
- this.pushRpcRequest(request);
+ // Make the rpc request object available to the AwaitRpcResult state
+ this.pushRpcRequest(rpcRequest);
// Give 'em what they came for
- return request;
+ return rpcRequest;
};
/**
* Push an RPC request onto the request stack.
*
- * @param request {qx.io.remote.Request}
- * The just-issued request
+ * @param request {Object}
+ * The just-issued rpc request object
*/
-qx.Proto.pushRpcRequest = function(request)
+qx.Proto.pushRpcRequest = function(rpcRequest)
{
- this._requests.push(request);
+ this._requests.push(rpcRequest);
};
@@ -290,8 +286,8 @@
* Retrieve the most recent RPC request from the request stack and pop the
* stack.
*
- * @return {qx.io.remote.Request}
- * The request from the top of the request stack
+ * @return {Object}
+ * The rpc request object from the top of the request stack
*/
qx.Proto.popRpcRequest = function()
{
@@ -300,16 +296,16 @@
throw new Error("Attempt to pop an RPC request when list is empty.");
}
- var request = this._requests.pop();
- return request;
+ var rpcRequest = this._requests.pop();
+ return rpcRequest;
};
/**
* Retrieve the most recent RPC request.
*
- * @return {qx.io.remote.Request}
- * The request at the top of the request stack
+ * @return {Object}
+ * The rpc request object at the top of the request stack
*/
qx.Proto.getCurrentRpcRequest = function()
{
Modified: branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Fsm.js
===================================================================
--- branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Fsm.js 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Fsm.js 2007-01-05 19:29:45 UTC (rev 20559)
@@ -43,15 +43,15 @@
if (fsm.getPreviousState() == "State_AwaitRpcResult")
{
// Yup. Display the result. We need to get the request object
- var request = _this.popRpcRequest();
+ var rpcRequest = _this.popRpcRequest();
// Display the result
var gui = swat.module.ldbbrowse.Gui.getInstance();
- gui.displayData(module, request);
+ gui.displayData(module, rpcRequest);
// Dispose of the request
- request.dispose();
- request = null;
+ rpcRequest.request.dispose();
+ rpcRequest.request = null;
}
},
Modified: branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Gui.js
===================================================================
--- branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Gui.js 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/webapps/swat/source/class/swat/module/ldbbrowse/Gui.js 2007-01-05 19:29:45 UTC (rev 20559)
@@ -114,12 +114,12 @@
* The result returned by SAMBA to our request. We display the data
* provided by this result.
*/
-qx.Proto.displayData = function(module, request)
+qx.Proto.displayData = function(module, rpcRequest)
{
var gui = module.gui;
var fsm = module.fsm;
- var result = request.getUserData("result")
- var requestType = request.getUserData("requestType");
+ var result = rpcRequest.getUserData("result")
+ var requestType = rpcRequest.getUserData("requestType");
// Did the request fail?
if (result.type == "failed")
@@ -133,19 +133,19 @@
switch(requestType)
{
case "find":
- this._displayFindResults(module, request);
+ this._displayFindResults(module, rpcRequest);
break;
case "tree_open":
- this._displayTreeOpenResults(module, request);
+ this._displayTreeOpenResults(module, rpcRequest);
break;
case "tree_selection_changed":
- this._displayTreeSelectionChangedResults(module, request);
+ this._displayTreeSelectionChangedResults(module, rpcRequest);
break;
case "database_name_changed":
- this._clearAllFields(module, request);
+ this._clearAllFields(module, rpcRequest);
break;
default:
@@ -409,7 +409,7 @@
};
-qx.Proto._displayFindResults = function(module, request)
+qx.Proto._displayFindResults = function(module, rpcRequest)
{
var rowData = [];
var fsm = module.fsm;
@@ -418,7 +418,7 @@
var maxLen = 0;
// Obtain the result object
- result = request.getUserData("result").data;
+ result = rpcRequest.getUserData("result").data;
if (result && result["length"])
{
@@ -497,18 +497,18 @@
};
-qx.Proto._displayTreeOpenResults = function(module, request)
+qx.Proto._displayTreeOpenResults = function(module, rpcRequest)
{
var t;
var trs;
var child;
// Obtain the result object
- var result = request.getUserData("result").data;
+ var result = rpcRequest.getUserData("result").data;
// We also need some of the original parameters passed to the request
- var parent = request.getUserData("parent");
- var attributes = request.getUserData("attributes");
+ var parent = rpcRequest.getUserData("parent");
+ var attributes = rpcRequest.getUserData("attributes");
// Any children?
if (! result || result["length"] == 0)
@@ -548,12 +548,12 @@
};
-qx.Proto._displayTreeSelectionChangedResults = function(module, request)
+qx.Proto._displayTreeSelectionChangedResults = function(module, rpcRequest)
{
var fsm = module.fsm;
// Obtain the result object
- var result = request.getUserData("result").data;
+ var result = rpcRequest.getUserData("result").data;
// If we received an empty list, ...
if (result == null)
@@ -612,10 +612,10 @@
};
-qx.Proto._clearAllFields = function(module, request)
+qx.Proto._clearAllFields = function(module, rpcRequest)
{
// Obtain the result object
- var result = request.getUserData("result").data;
+ var result = rpcRequest.getUserData("result").data;
// Retrieve the database handle
module.dbHandle = result;
Modified: branches/SAMBA_4_0/webapps/swat/source/class/swat/module/statistics/Fsm.js
===================================================================
--- branches/SAMBA_4_0/webapps/swat/source/class/swat/module/statistics/Fsm.js 2007-01-05 17:42:54 UTC (rev 20558)
+++ branches/SAMBA_4_0/webapps/swat/source/class/swat/module/statistics/Fsm.js 2007-01-05 19:29:45 UTC (rev 20559)
@@ -67,15 +67,15 @@
if (fsm.getPreviousState() == "State_AwaitRpcResult")
{
// Yup. Display the result. We need to get the request object
- var request = _this.popRpcRequest();
+ var rpcRequest = _this.popRpcRequest();
// Display the result
var gui = swat.module.statistics.Gui.getInstance();
- gui.displayData(module, request.getUserData("result"));
+ gui.displayData(module, rpcRequest.getUserData("result"));
// Dispose of the request
- request.dispose();
- request = null;
+ rpcRequest.request.dispose();
+ rpcRequest.request = null;
// Restart the timer.
swat.module.statistics.Fsm._startTimer(fsm);
More information about the samba-cvs
mailing list