IT4Change/gradido
3
0
Fork 0
mirror of https://github.com/IT4Change/gradido.git synced 2025-12-13 07:45:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

request handler allow only specific clients

Browse Source
This commit is contained in:
Dario Rekowski on RockPI 2020-04-27 11:35:44 +00:00
parent ed963059a6
commit f7f9d0ddb8
2 changed files with 32 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
config/routes.php
View File

@ -22,6 +22,8 @@ use Cake\Routing\RouteBuilder;
use Cake\Routing\Router;
use Cake\Routing\Route\DashedRoute;
use Cake\Core\Configure;
/**
* The default class to use for all routes
*
@ -58,7 +60,18 @@ Router::scope('/', function (RouteBuilder $routes) {
$whitelist = ['JsonRequestHandler', 'ElopageWebhook'];
foreach($whitelist as $entry) {
if($request->getParam('controller') === $entry) {
if($entry == 'ElopageWebhook') {
return true;
}
if($request->clientIp() == '127.0.0.1' || $request->clientIp() == 'localhost') {
return true;
}
$allowedCaller = Configure::read('API.allowedCaller');
$callerIp = $request->clientIp();
foreach($allowedCaller as $allowed) {
$ip = gethostbyname($allowed);
if($ip === $callerIp) return true;
}
}
}
});

19
src/Controller/JsonRequestHandlerController.php
View File

@ -57,6 +57,7 @@ class JsonRequestHandlerController extends AppController {
case 'moveTransaction': return $this->moveTransaction($jsonData->pubkeys, $jsonData->memo, $jsonData->session_id);
case 'checkUser': return $this->checkUser($jsonData->email, $jsonData->last_name);
case 'getUsers' : return $this->getUsers($jsonData->page, $jsonData->limit);
case 'getUserBalance': return $this->getUserBalance($jsonData->email, $jsonData->last_name);
}
return $this->returnJson(['state' => 'error', 'msg' => 'unknown method for post', 'details' => $method]);
}
@ -163,6 +164,24 @@ class JsonRequestHandlerController extends AppController {
return $this->returnJson(['state' => 'not identical', 'user' => $user->toArray()]);
}
private function getUserBalance($email, $last_name) {
$stateUserTable = TableRegistry::getTableLocator()->get('StateUsers');
$stateUsers = $stateUserTable->find('all')->where(['OR' => ['email' => $email, 'last_name' => $last_name]])->contain(['StateBalances']);
$gdds = [];
foreach($stateUsers as $stateUser) {
foreach($stateUser->StateBalances as $stateBalance) {
if(!isset($gdds[$stateBalance->email])) {
$gdds[$stateBalance->email];
}
if(!isset($gdds[$stateBalance->email][$stateBalance->last_name])) {
$gdds[$stateBalance->email][$stateBalance->last_name] = 0;
}
$gdds[$stateBalance->email][$stateBalance->last_name] += $stateBalance->amount;
}
}
return $this->returnJson(['state' => 'success', 'gdds' => $gdds, 'stateUsers' => $stateUsers]);
}
private function getUsers($page, $count) {
$userTable = TableRegistry::getTableLocator()->get('Users');