예제 #1
0
    def check_login(fn, self, *a, **kw):
        session_key = cherrypy.session.get('sessionKey', None)
        is_api = util.is_api()

        if not session_key:
            logger.info(
                'require_login - no splunkd sessionKey variable set; cherrypy_session=%s request_path=%s'
                % (cherrypy.session.id, cherrypy.request.path_info))
            logger.debug('require_login - cookie request header: %s' %
                         unicode(cherrypy.request.cookie))
            logger.debug('require_login - cookie response header: %s' %
                         unicode(cherrypy.response.cookie))
            if is_api or util.is_xhr():
                logger.info(
                    'require_login - is api/XHR request, raising 401 status')
                raise cherrypy.HTTPError(401)
            else:
                logger.info('require_login - redirecting to login')
                self.redirect_to_url('/account/login',
                                     _qs=[('return_to',
                                           util.current_url_path())])

        try:
            return fn(self, *a, **kw)
        except splunk.AuthenticationFailed:
            logger.info('sessionKey rejected by splunkd')
            cherrypy.session.delete()
            if is_api or util.is_xhr():
                raise cherrypy.HTTPError(401)
            else:
                self.redirect_to_url('/account/login',
                                     _qs=[('return_to',
                                           util.current_url_path())])
예제 #2
0
    def index(self, **kwargs):

        try:

            cherrypy.response.headers['content-type'] = mrsparkle.MIME_HTML
            self._targs = {
                'messages': {
                    'error': [],
                    'warn': [],
                    'info': []
                },
                'events': [],
                'stanzas': [],
                'stanza': '',
                'data': '',
                'settings': ''
            }

            sessionKey = kwargs['sessionKey'] = cherrypy.session['sessionKey']

            if not splunk.auth.ping(sessionKey=sessionKey):
                return self.redirect_to_url('/account/login',
                                            _qs=[('return_to',
                                                  util.current_url_path())])

            namespace = kwargs.get('namespace', None)
            username = cherrypy.session['user']['name']

            self._sessionKey = sessionKey
            self._mynamespace = namespace
            self._owner = username

            self.previewPage(**kwargs)
        except Exception, e:
            return self.outputError('Exception: %s.' % e)
예제 #3
0
    def check_login(fn, self, *a, **kw):
        session_key = cherrypy.session.get('sessionKey', None)
        is_api = util.is_api()

        if not session_key:
            logger.info('require_login - no splunkd sessionKey variable set; cherrypy_session=%s request_path=%s' % (cherrypy.session.id, cherrypy.request.path_info))
            logger.debug('require_login - cookie request header: %s' % unicode(cherrypy.request.cookie))
            logger.debug('require_login - cookie response header: %s' % unicode(cherrypy.response.cookie))
            if is_api or util.is_xhr():
                logger.info('require_login - is api/XHR request, raising 401 status')
                raise cherrypy.HTTPError(401)
            else:
                logger.info('require_login - redirecting to login')
                self.redirect_to_url('/account/login', _qs=[ ('return_to', util.current_url_path()) ] )
            
        try:
            return fn(self, *a, **kw)
        except splunk.AuthenticationFailed:
            logger.info('sessionKey rejected by splunkd')
            cherrypy.session.delete()
            if is_api or util.is_xhr():
                raise cherrypy.HTTPError(401)
            else:
                self.redirect_to_url('/account/login', _qs=[ ('return_to', util.current_url_path()) ] )
예제 #4
0
    def handle_exceptions(fn, self, *a, **kw):
        from controllers.admin import AdminController

        try:
            return fn(self, *a, **kw)
            
        except splunk.AuthenticationFailed:
            # redirect to the login page if auth fails
            cherrypy.session['sessionKey'] = None
            self.redirect_to_url('/account/login', _qs=[ ('return_to', util.current_url_path()) ] )
            
        except splunk.AuthorizationFailed, e:
            if isinstance(self, AdminController):
                return self.render_admin_template('admin/error.html', {'namespace' : 'search', 'excp_msg': e, 'excp_details' : 'None'})   
            else:
                raise
예제 #5
0
    def handle_exceptions(fn, self, *a, **kw):
        from controllers.admin import AdminController

        try:
            return fn(self, *a, **kw)

        except splunk.AuthenticationFailed:
            # redirect to the login page if auth fails
            cherrypy.session['sessionKey'] = None
            self.redirect_to_url('/account/login',
                                 _qs=[('return_to', util.current_url_path())])

        except splunk.AuthorizationFailed, e:
            if isinstance(self, AdminController):
                return self.render_admin_template('admin/error.html', {
                    'namespace': 'search',
                    'excp_msg': e,
                    'excp_details': 'None'
                })
            else:
                raise
예제 #6
0
    def check(fn, self, *a, **kw):
        is_api = util.is_api()
        request = cherrypy.request
        if not handle_api and is_api:
            raise RequestRefused(404)
        if handle_api is ONLY_API and not is_api:
            raise RequestRefused(404)
        _methods = methods
        if _methods:
            if isinstance(_methods, basestring):
                _methods = [_methods]
            if request.method not in _methods:
                raise RequestRefused(405)

        # verify that version info is good; do it here so that any URI access
        # will trigger the check
        startup.initVersionInfo()

        # add a convenience property to all request objects to get at the
        # current relative URI
        request.relative_uri = request.path_info + (
            ('?' + request.query_string) if request.query_string else '')
        if cherrypy.config.get('root_endpoint') not in ['/', None, '']:
            request.relative_uri = cherrypy.config.get(
                'root_endpoint') + request.relative_uri

        # CSRF protection
        # Disable in tests by setting cherrypy.config.update({'environment': 'test_suite'})
        if verify_session and request.method == 'POST' and not cherrypy.config.get(
                'environment') == 'test_suite':
            is_xhr = util.is_xhr()
            form_key = request.headers.get(
                'X-Splunk-Form-Key') if is_xhr else request.params.get(
                    'splunk_form_key')
            # verify that the incoming form key matches server's version
            if not util.isValidFormKey(form_key):
                if is_xhr:
                    logger.warn(
                        'CSRF: validation failed because client XHR did not include proper header'
                    )
                else:
                    logger.warn(
                        'CSRF: validation failed because HTTP POST did not include expected parameter'
                    )
                if must_login:
                    if is_xhr:
                        raise cherrypy.HTTPError(
                            401,
                            _('Splunk cannot authenticate the request. CSRF validation failed.'
                              ))
                    else:
                        return self.redirect_to_url(
                            '/account/login',
                            _qs=[('return_to', util.current_url_path())])
                logger.warn(
                    'CSRF: skipping 401 redirect response because endpoint did not request protection'
                )

        # basic input cleansing
        if trim_spaces:
            for key, value in kw.iteritems():
                if isinstance(value, basestring):
                    kw[key] = value.strip()
                    if kw[key] != value:
                        logger.debug(
                            'Leading/trailing whitespaces were trimmed in "%s" argument'
                            % key)

        return fn(self, *a, **kw)
예제 #7
0
    def check(fn, self, *a, **kw):
        is_api = util.is_api()
        request = cherrypy.request
        if not handle_api and is_api:
            raise RequestRefused(404)
        if handle_api is ONLY_API and not is_api:
            raise RequestRefused(404)
        _methods = methods
        if _methods:
            if isinstance(_methods, basestring):
                _methods = [ _methods ]
            if request.method not in _methods:
                raise RequestRefused(405)
        
        # verify that version info is good; do it here so that any URI access
        # will trigger the check
        startup.initVersionInfo()

        # add a convenience property to all request objects to get at the
        # current relative URI
        request.relative_uri = request.path_info + (('?' + request.query_string) if request.query_string else '')
        if cherrypy.config.get('root_endpoint') not in ['/', None, '']:
            request.relative_uri = cherrypy.config.get('root_endpoint') + request.relative_uri

        # CSRF protection
        # Disable in tests by setting cherrypy.config.update({'environment': 'test_suite'})
        if verify_session and request.method == 'POST' and not cherrypy.config.get('environment') == 'test_suite':
            is_xhr = util.is_xhr()
            form_key = request.headers.get('X-Splunk-Form-Key') if is_xhr else request.params.get('splunk_form_key')
            # verify that the incoming form key matches server's version
            if not util.isValidFormKey(form_key):
                if is_xhr:
                    logger.warn('CSRF: validation failed because client XHR did not include proper header')
                else:
                    logger.warn('CSRF: validation failed because HTTP POST did not include expected parameter')
                if must_login:
                    if is_xhr:
                        raise cherrypy.HTTPError(401, _('Splunk cannot authenticate the request. CSRF validation failed.'))
                    else:
                        return self.redirect_to_url('/account/login', _qs=[ ('return_to', util.current_url_path()) ] )
                logger.warn('CSRF: skipping 401 redirect response because endpoint did not request protection')

        # basic input cleansing
        if trim_spaces:
            for key, value in kw.iteritems():
                if isinstance(value, basestring):
                    kw[key] = value.strip()
                    if kw[key] != value:
                        logger.debug('Leading/trailing whitespaces were trimmed in "%s" argument' % key)
                
        return fn(self, *a, **kw)