🔒 Now API calls about led changes & geting stats requires user to be …

…logged in
keelus · Jul 28, 2023 · 0031f07 · 0031f07
1 parent b6952bc
commit 0031f07
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/server/handlers/apiHandler/ledHandler/routes.go b/server/handlers/apiHandler/ledHandler/routes.go
@@ -321,6 +321,11 @@ func SetBrightness(c *gin.Context) {
 }
 
 func SetCooldown(c *gin.Context) {
+	if !internal.IsLogged(c) {
+		c.JSON(http.StatusForbidden, gin.H{"details": "User not logged in."})
+		return
+	}
+
 	amountStr := c.Param("amount")
 	mode := c.Param("mode")
 	amount, err := strconv.Atoi(amountStr)
@@ -350,6 +355,11 @@ func SetCooldown(c *gin.Context) {
 }
 
 func SetLedAmount(c *gin.Context) {
+	if !internal.IsLogged(c) {
+		c.JSON(http.StatusForbidden, gin.H{"details": "User not logged in."})
+		return
+	}
+
 	ledAmountStr := c.Param("amount")
 
 	ledAmount, err := strconv.Atoi(ledAmountStr)

diff --git a/server/handlers/apiHandler/routes.go b/server/handlers/apiHandler/routes.go
@@ -69,14 +69,20 @@ func HandleLogout(c *gin.Context) {
 	logger.Log(c, logger.LOGIN, "User logout.")
 	c.Redirect(http.StatusTemporaryRedirect, "/")
 }
+
 func HandleGetStats(c *gin.Context) {
+	if !internal.IsLogged(c) {
+		c.JSON(http.StatusForbidden, gin.H{"details": "User not logged in."})
+		return
+	}
+
 	var temperature float64
 	var cpuUsage float64
 	var ramUsage float64
 	var diskUsage [2]float64
 	var sysUptime float64
 
-	if CUR_RASP {
+	if CUR_RASP { // TODO: Move functions to a single file dedicated for that only.
 		temperature, _ = getTemp()
 		cpuUsage, _ = getCpuUsage()
 		ramUsage, _ = getRamUsage()