diff options
| -rwxr-xr-x | cgi-bin/provisioning.cgi | 84 | ||||
| -rw-r--r-- | provisioning-controller.lua | 2 | ||||
| -rw-r--r-- | provisioning-model.lua | 20 |
3 files changed, 66 insertions, 40 deletions
diff --git a/cgi-bin/provisioning.cgi b/cgi-bin/provisioning.cgi index bf7a6a2..ee12e22 100755 --- a/cgi-bin/provisioning.cgi +++ b/cgi-bin/provisioning.cgi @@ -106,15 +106,6 @@ if ( request_method == "GET" ) then local func = haserl.loadfile(data.value.values.value.device.template) func(data.value.values.value) else - if data.errtxt then - APP.logevent("data.errtxt") - elseif not data.value.values then - APP.logevent("not data.value.values") - elseif not data.value.values.value.device then - APP.logevent("not data.value.values.value.device") - elseif not data.value.values.value.device.template then - APP.logevent("not data.value.values.value.device.template") - end http_code(404) end end @@ -130,36 +121,59 @@ if ( request_method == "GET" ) then ENV.PATH_INFO = pathinfo elseif ( request_method == "PUT" ) then local data = io.stdin:read("*all") + local success = true - log:write("Checking PROV Table for results\n") - -- Load the ACF mvc - local PATH = package.path - package.path = "/usr/share/acf/www/cgi-bin/?.lua;" .. package.path - require("mvc") - package.path = PATH - -- We'll use the cli controller, but change the view resolver to report HTTP code - local pathinfo = ENV.PATH_INFO - FRAMEWORK=mvc:new() - FRAMEWORK:read_config("acf") - APP=FRAMEWORK:new("acf_cli") - APP.view_resolver = function(self) - return function (data) - if data.errtxt then - http_code(400) - else - http_code(200) + -- Protect against writing to arbitrary paths + if string.match(path_info, "%.%.") then + http_code(403) + log:close() + os.exit() + end + + -- Don't bother for .log files + if not string.match(path_info, "%.log$") then + log:write("Checking PROV Table for results\n") + -- Load the ACF mvc + local PATH = package.path + package.path = "/usr/share/acf/www/cgi-bin/?.lua;" .. package.path + require("mvc") + package.path = PATH + -- We'll use the cli controller, but change the view resolver to report HTTP code + local pathinfo = ENV.PATH_INFO + FRAMEWORK=mvc:new() + FRAMEWORK:read_config("acf") + APP=FRAMEWORK:new("acf_cli") + APP.view_resolver = function(self) + return function (output) + if output.errtxt then + success = false + http_code(400) + else + data = output.value + end end end - end - -- Set up the action and parameters - ENV.PATH_INFO = "/provisioning/provisioning/putfile" - APP.clientdata = {file=path_info, root=root, data=data, ip=ip_address, agent=user_agent} - -- Dispatch the command - APP:dispatch() - APP:destroy() - FRAMEWORK:destroy() + -- Set up the action and parameters + ENV.PATH_INFO = "/provisioning/provisioning/putfile" + APP.clientdata = {mac=mac, data=data} + -- Dispatch the command + APP:dispatch() + APP:destroy() + FRAMEWORK:destroy() - ENV.PATH_INFO = pathinfo + ENV.PATH_INFO = pathinfo + end + if success then + local path = root..path_info + log:write("Writing to "..path.."\n") + posix.mkdir(posix.dirname(path)) + local f = io.open(path, "w+") + f:write(data) + f:close() + http_code(200) + else + http_code(400) + end end log:close() %> diff --git a/provisioning-controller.lua b/provisioning-controller.lua index eaf5b8d..f4386d9 100644 --- a/provisioning-controller.lua +++ b/provisioning-controller.lua @@ -150,5 +150,5 @@ getfile = function( self ) end putfile = function( self ) - return self.model.put_file(self.clientdata.file, self.clientdata.root, self.clientdata.data, self.clientdata.ip, self.clientdata.agent) + return self.model.put_file(self.clientdata.mac, self.clientdata.data) end diff --git a/provisioning-model.lua b/provisioning-model.lua index 4ada401..16bfd15 100644 --- a/provisioning-model.lua +++ b/provisioning-model.lua @@ -20,7 +20,8 @@ local updatedevicescriptfile = "/etc/provisioning/update_device.lua" local updatedeviceparamsscriptfile = "/etc/provisioning/update_device_params.lua" local deletedevicescriptfile = "/etc/provisioning/delete_device.lua" local determineclassscriptfile = "/etc/provisioning/determine_class.lua" -local scriptfiles = {updatedevicescriptfile, updatedeviceparamsscriptfile, deletedevicescriptfile, determineclassscriptfile} +local processputscriptfile = "/etc/provisioning/process_put.lua" +local scriptfiles = {updatedevicescriptfile, updatedeviceparamsscriptfile, deletedevicescriptfile, determineclassscriptfile, processputscriptfile} local env local con @@ -275,7 +276,7 @@ local function callscript(script, ...) result = f(functions, ...) end, ...) if not res and err then - assert(res, "Update Successful\nException in post update script\n"..err) + assert(res, "Exception in "..script.." script\n"..err) end end setfenv (0, _G) @@ -1912,6 +1913,17 @@ function get_file(mac, ip, agent) return result end -function put_file(file, root, data, ip, agent) - return cfe({errtxt="Not implemented"}) +function put_file(mac, data) + local retval = cfe({ label="PUT Data" }) + local res, err = pcall(function() + local connected = databaseconnect() + retval.value, retval.errtxt = callscript(processputscriptfile, mac, data) + -- If the script doesn't exist, allow the write + retval.value = retval.value or data + if connected then databasedisconnect() end + end) + if not res and err then + retval.errtxt = err + end + return retval end |