diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/server/rz_server.py | 29 |
1 files changed, 27 insertions, 2 deletions
diff --git a/src/server/rz_server.py b/src/server/rz_server.py index fa00f667..3bfcf44e 100644 --- a/src/server/rz_server.py +++ b/src/server/rz_server.py @@ -20,6 +20,7 @@ import rz_api_rest import rz_feedback from rz_kernel import RZ_Kernel from rz_mesh import init_ws_interface +from rz_req_handling import make_response__http__empty import rz_user from rz_user_db import User_DB @@ -177,7 +178,7 @@ def init_rest_interface(cfg, flask_webapp): def login_decorator(f): """ - [!] security boundary: asserd logged-in user before executing REST api call + security boundary: assert logged-in user before executing REST api call """ @wraps(f) def wrapped_function(*args, **kw): @@ -187,6 +188,23 @@ def init_rest_interface(cfg, flask_webapp): return wrapped_function + + def localhost_access_decorator__ipv4(f): + """ + security boundary: assert request originated from localhost + """ + + @wraps(f) + def wrapped_function(*args, **kw): + + if '127.0.0.1' != request.remote_addr: + log.warning('unauthorized attempt to access localhost restricted path: %s' % (request.path)) + return make_response__http__empty(stauts=403) + + return f(*args, **kw) + + return wrapped_function + rest_entry_set = [ rest_entry('/feedback', rz_feedback.rest__send_user_feedback__email), rest_entry('/graph/clone', rz_api.rz_clone), @@ -200,9 +218,12 @@ def init_rest_interface(cfg, flask_webapp): rest_entry('/login', rz_user.rest__login, {'methods': ['GET', 'POST']}), rest_entry('/logout', rz_user.rest__logout, {'methods': ['GET', 'POST']}), rest_entry('/match/node-set', rz_api.match_node_set_by_attr_filter_map), - rest_entry('/monitor/server-info', rz_api.monitor__server_info), rest_entry('/signup', rz_user.rest__user_signup, {'methods': ['GET', 'POST']}), + # server administration + rest_entry('/monitor/server-info', rz_api.monitor__server_info, {'methods': ['GET']}), + + # redirects redirect_entry('/', '/index', {'methods': ['GET']}), redirect_entry('/index.html', '/index', {'methods': ['GET']}), ] @@ -217,6 +238,10 @@ def init_rest_interface(cfg, flask_webapp): # currently require login on all but /login paths f = login_decorator(f) + # apply local host access restriction + if rest_path.startswith('/monitor'): + f = localhost_access_decorator__ipv4(f) + # [!] order seems important - apply route decorator last route_dec = flask_webapp.route(rest_path, **flask_args) f = route_dec(f) |