From 2c6dff3714b20718e995807d88218c5b9a1f5044 Mon Sep 17 00:00:00 2001 From: helgeerbe Date: Sat, 19 Nov 2022 14:34:59 +0100 Subject: [PATCH] Password protection for vedirect settings API --- .vscode/settings.json | 6 +++++- include/WebApi_vedirect.h | 1 + src/WebApi_vedirect.cpp | 13 +++++++++++-- webapp/src/router/index.ts | 2 +- webapp/src/views/VedirectAdminView.vue | 2 +- webapp_dist/js/app.js.gz | Bin 116774 -> 116771 bytes 6 files changed, 19 insertions(+), 5 deletions(-) diff --git a/.vscode/settings.json b/.vscode/settings.json index ed5966875..012b4c280 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,3 +1,7 @@ { - "C_Cpp.clang_format_style": "WebKit" + "C_Cpp.clang_format_style": "WebKit", + "files.associations": { + "*.tcc": "cpp", + "algorithm": "cpp" + } } \ No newline at end of file diff --git a/include/WebApi_vedirect.h b/include/WebApi_vedirect.h index 8359dbdc3..1dd3a3fa1 100644 --- a/include/WebApi_vedirect.h +++ b/include/WebApi_vedirect.h @@ -3,6 +3,7 @@ #include + class WebApiVedirectClass { public: void init(AsyncWebServer* server); diff --git a/src/WebApi_vedirect.cpp b/src/WebApi_vedirect.cpp index a283f3d9f..4af889b10 100644 --- a/src/WebApi_vedirect.cpp +++ b/src/WebApi_vedirect.cpp @@ -7,6 +7,7 @@ #include "ArduinoJson.h" #include "AsyncJson.h" #include "Configuration.h" +#include "WebApi.h" #include "helper.h" void WebApiVedirectClass::init(AsyncWebServer* server) @@ -28,7 +29,7 @@ void WebApiVedirectClass::onVedirectStatus(AsyncWebServerRequest* request) { AsyncJsonResponse* response = new AsyncJsonResponse(); JsonObject root = response->getRoot(); - CONFIG_T& config = Configuration.get(); + const CONFIG_T& config = Configuration.get(); root[F("vedirect_enabled")] = config.Vedirect_Enabled; root[F("vedirect_pollinterval")] = config.Vedirect_PollInterval; @@ -40,9 +41,13 @@ void WebApiVedirectClass::onVedirectStatus(AsyncWebServerRequest* request) void WebApiVedirectClass::onVedirectAdminGet(AsyncWebServerRequest* request) { + if (!WebApi.checkCredentials(request)) { + return; + } + AsyncJsonResponse* response = new AsyncJsonResponse(); JsonObject root = response->getRoot(); - CONFIG_T& config = Configuration.get(); + const CONFIG_T& config = Configuration.get(); root[F("vedirect_enabled")] = config.Vedirect_Enabled; root[F("vedirect_pollinterval")] = config.Vedirect_PollInterval; @@ -54,6 +59,10 @@ void WebApiVedirectClass::onVedirectAdminGet(AsyncWebServerRequest* request) void WebApiVedirectClass::onVedirectAdminPost(AsyncWebServerRequest* request) { + if (!WebApi.checkCredentials(request)) { + return; + } + AsyncJsonResponse* response = new AsyncJsonResponse(); JsonObject retMsg = response->getRoot(); retMsg[F("type")] = F("warning"); diff --git a/webapp/src/router/index.ts b/webapp/src/router/index.ts index 5c01d0ed1..e519a4df6 100644 --- a/webapp/src/router/index.ts +++ b/webapp/src/router/index.ts @@ -111,7 +111,7 @@ const router = createRouter({ router.beforeEach((to, from, next) => { // redirect to login page if not logged in and trying to access a restricted page - const publicPages = ['/', '/login', '/about', '/info/network', '/info/system', '/info/ntp', '/info/mqtt', ]; + const publicPages = ['/', '/login', '/about', '/info/network', '/info/system', '/info/ntp', '/info/mqtt', '/info/vedirect', ]; const authRequired = !publicPages.includes(to.path); const loggedIn = localStorage.getItem('user'); diff --git a/webapp/src/views/VedirectAdminView.vue b/webapp/src/views/VedirectAdminView.vue index 3a313b69b..cc66bf7d1 100644 --- a/webapp/src/views/VedirectAdminView.vue +++ b/webapp/src/views/VedirectAdminView.vue @@ -74,7 +74,7 @@ export default defineComponent({ methods: { getVedirectConfig() { this.dataLoading = true; - fetch("api/vedirect/config", { headers: authHeader() }) + fetch("/api/vedirect/config", { headers: authHeader() }) .then((response) => handleResponse(response, this.$emitter)) .then((data) => { this.vedirectConfigList = data; diff --git a/webapp_dist/js/app.js.gz b/webapp_dist/js/app.js.gz index 2b894a5774eca5c6aafa04d8024bcad03f4d27ad..d9ca72bfba2fe87407d69a91bff4338613b992df 100644 GIT binary patch delta 2081 zcmV++2;TRmkO!lX2Y|Ez9>9Mwpk6r5T}0Je1$ljFy~Jd99A9sBHVGByD(L@?k@lQs zQmf)Ox4rbea|#qxS-ib*QyOn?(v$^%^O|Dtw`8C%0&s4)!%C zO%%+7rYM+SHE|7=YX$R+VtAMcmRbO$i`C~Kg{KMCv@E+w&8&Y>#h1!>dsb5g=Wvp# zVlxVaixq+JY-@oq{`#stA5ql{9`bu~aqy(ME;HU~qEw-E+{q1&Prf53amKzwVnsL2 zSVlY1RJ7HMUXQh#(Oar!q6OP8%4?ug7PpzVdmXjo62q%C5<{A7U`b?yb8<_|E*3-) z_JOd^IQ!TW*vEfKQ%sF>+T4&^xzpS>w{nuaR(7m3!}7*fVV>oU6%*N(Tg^4Os@qLj z`fkEqISQIPM1jEYwnT%_ax*G~$_aFwuS3Uc2|A?wI2HNbv^3Rgc=2b#i!3zo?&3BJFW%xvcMmCH%_`x{nEt~P&3mTu(n;Zz=kqyLcNWEHUR z1c(D?rqqtAt<$z7U<~r;`?acY(Ke0olPQ^5UZU~Hg(Lb38byyMf#Q6bqa>QpfaDg| zY>WiBssv#i`To1LK&yZxv_P_z{CCs?y<9o=FPhsYNQOIr!U4r|^PT*>e>N@6m%^2vN^?l_?``mI>F7#?!VU^0sq zMe%%P?qllYiDFSx8>9$j;an-?PBVZDo1#LMnesE~;^(}kT+MMV{)FTCeOUEra?0K!c&0wEl0rZZV(XiupdK1LNk+)BczbW>x965BFYos z1X+I~|GyxDRSqqw2!y5Ay!4!IVOp(bCK+b-zi%IsWJKH4eh>z zV-^a7b!4h4lg9RDlX>72zRaE3l9%VH+4SR^iDxTCU;t5Yn0)^3F83fO$e*q?wucVO zIu}Y((QG2~?QhY<9X@aWp3LI-C)L^C_o07lRVKMU9gsK!R4n1n%b~zhz)!TzzP@(s zLvIY+cQm6hw&GAD)vRv}xCs3uVp7j|Mdpk0(kJB|xeQB%pl2&W&~MEx{c+n%KX67$ zYjW+e7hoUc640+riGeD5)vn4Q;mQ!V$nZOLwLKT!2i;gh&psSDj(uhIKSO2bTt0t< ze=ZK;2BYCq946u&UY4y$YJ8@Tud1vA0?iO+d0=R{c~;Y zLA~Xn$}y8X>$k>C*ntc)f*2xTW_-?>K~~Jf1R9>;`FyR3Rb-$Sa*X5-4!3w67z=rC zP%_pgpk^|Ib&fK_$C%78J4YZ#GxPIQ{RYPYn)Mt#!z(-549hP3xT3w65@QV>M6c4_?zf z<26wNc`$YYK=J3W!K?5mZ*sMlXyTKjDQwYZzj%W;C&@8_Y1Dt`jaW6PB&v?S1kvPQ ze(7|?$}d}q$~VyqQ`$f<)Zl-uJ~w%*(1JS!YT<6i+dr?!+Q%T0wsTJOKYl4#z#@8HN*-_ zZ5H5+R40EtemthqxQ~Ap%@~Z&finzGh{<5Eq3Qm<>O*sXN&**-3&fM<^#Hnh^ypC$ zWEtKgkseT*-`M3i3?W(=SyP^r&C7rDpkt8J)v$i9MtpdRWB!ddPjsNO2X>m%zW=DOqXdaJWZXgF6v|91?u z=QNW_6~DRdo$sAfprFda?Twq#aC?)cEcTn%6l1?71SMj2rO!#0mHuCT7sZ?kjQtEf$joyWtE3pEpHdB+u z47_QgTplz(_IyM&FL=oB$;H8w=DNgqr-@R9)^R5{I6nD~oWvRX z4ha?AG-C4N3xv_7+inmGcQ;slO*{5VluOt(^oDhM}*j7r9d5sdW6e8^&jr{269JYbuG!+{!2Osk!5P%ILOY;bM5m zErZD{S`@|emAQ|ZlP8KrEp3n@l!bGpkUPx)E^LYlRc6Z1q>G>PnsPPAx%d;3+H^7= zqohLLr7N~`<3Wps>kvPelQ#-pEDFkbpp52dIqZKZ^+KUq#so(*tB(oxxOK$W-KuTg z{|#!JHrv1dRoblN;EXG6;`~2U+9Xbe6{XEf5CSf^-1<(CTc5!9=e+2PTvIVkvW7HW zMO077fLARiRTNRJjH;Y92bnza!kPxj+zU?u;W=me4r&iOCZzi6t6oCOmv0?K0ySv5dOJ1gd2>8PjQ%tlL%52dxy7nm`Tbo-nn_nZY z@Hc))d}xa4wAZE1rYE<^9PrGJF$+>FHHG%CFx2l&O>!jBmyH=u(2%$hhm>zdt8+1Bh3p zbzm&yy+O%Xn}3?g4Awcy3?E}M!|WV^9L>znQ}r7h2WZuE^bD`;Xp-xVKc9c}F}}np zyNi(@c=>{p*gv}bHnmV{dXQtQ@_a&QH55ILZWplAS)C!BGp)z~;5DstUemh5!;RHE zp+9&{_l(y>3FN`p2>`{P!v?RypS;P{UZROlj;63hoBiSq-kc=I2&Pg0oi}3DppvLM z`VvHwfBB`;5i7rJB`V)UFHC=F1Hn*(xBA@VtwICt6sU!}8E^l*B5NOmNZQUlm9$Hp zv9yaD+0>I5lD7QPk+cjG_J*y)jJwhv_S%vj>|h=?j^_~M?cNIQgorjY&H!t>5`RFX zHbXLQX!%5&OKj13``=~l!^=`cv(azf@I~{!d!IiBiSo(;R_IV~G$Mar@c2-k`O_tC z*l0sW`z^Vh5_?752_mU?3*NXtoZF61@}^N$B zfIH6eOoH*%1dkvh{?RvnnV=nmTzX8BlX3ZJc+R7JeY1v8(+uwJPS!27S`d$JHTMr|I)$bD OKmQ9X7k&H3g9iXYs3{Ks