Enforced access controls on some administrative actions.

 - ensure use of HTTP POST method : HTTP GET should only be used for
information retrieval and not to perform server side effect operations
(see HTTP standard https://tools.ietf.org/html/rfc7231#section-4.2.1)
 - a transaction token is now required for these administrative form
submissions to ensure the request can not be included in an external
site and performed silently/by mistake by the user browser

1 files changed, 21 insertions, 1 deletions

diff --git a/htroot/Steering.java b/htroot/Steering.java
index fc9dbdfee..e83cb5460 100644
--- a/htroot/Steering.java
+++ b/htroot/Steering.java
@@ -33,6 +33,7 @@ import net.yacy.cora.protocol.Domains;
 import net.yacy.cora.protocol.HeaderFramework;

 import net.yacy.cora.protocol.RequestHeader;

 import net.yacy.cora.util.ConcurrentLog;

+import net.yacy.data.TransactionManager;

 import net.yacy.kelondro.util.FileUtils;

 import net.yacy.peers.operation.yacyRelease;

 import net.yacy.search.Switchboard;

@@ -42,7 +43,22 @@ import net.yacy.server.serverSwitch;
 public class Steering {

 

     public static serverObjects respond(final RequestHeader header, final serverObjects post, final serverSwitch ss) {

-        if (post == null || ss == null) { return new serverObjects(); }

+		if (post == null || post.isEmpty() || ss == null) {

+			final serverObjects prop = new serverObjects();

+			

+	        /* For authenticated user only : acquire a transaction token to pass then to the Steering.html post action */

+			if(ss != null && ((Switchboard) ss).verifyAuthentication(header)) {

+				/* YaCyDefaultServlet will detect it and then also fill the custom HTTP response header used by the JavaScript shutdown and restart actions 

+				 * or any external API requesting tool */

+				prop.put(TransactionManager.TRANSACTION_TOKEN_PARAM, TransactionManager.getTransactionToken(header));

+				/* Also add to the Steering.html page info block for eventual display of this page without parameter */

+				prop.put("info_" + TransactionManager.TRANSACTION_TOKEN_PARAM, TransactionManager.getTransactionToken(header));

+			} else {

+	        	prop.authenticationRequired();

+			}

+	        

+			return prop;

+		}

 

         final Switchboard sb = (Switchboard) ss;

         final serverObjects prop = new serverObjects();

@@ -58,6 +74,7 @@ public class Steering {
         }

 

         if (post.containsKey("shutdown")) {

+        	TransactionManager.checkPostTransaction(header, post);

             ConcurrentLog.info("STEERING", "shutdown request from " + requestIP);

             sb.terminate(10, "shutdown request from Steering; ip = " + requestIP);

             prop.put("info", "3");

@@ -66,6 +83,7 @@ public class Steering {
         }

 

         if (post.containsKey("restart")) {

+        	TransactionManager.checkPostTransaction(header, post);

             ConcurrentLog.info("STEERING", "restart request from " + requestIP);

             yacyRelease.restart();

             prop.put("info", "4");

@@ -74,6 +92,7 @@ public class Steering {
         }

 

         if (post.containsKey("update")) {

+        	TransactionManager.checkPostTransaction(header, post);

             ConcurrentLog.info("STEERING", "update request from " + requestIP);

             final boolean devenvironment = new File(sb.getAppPath(), ".git").exists();

             final String releaseFileName = post.get("releaseinstall", "");

@@ -96,6 +115,7 @@ public class Steering {
 

             return prop;

         }

+        

         return prop;

     }