nik/FreedomBox
1
0
Fork 0
mirror of https://github.com/freedombox/FreedomBox.git synced 2026-05-20 10:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added some FIXMEs. Ugh.

Browse Source
This commit is contained in:
Nick Daly 2012-06-28 00:31:39 -05:00
parent 388d6a4d51
commit d71f7d9f48
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ugly_hacks/santiago/protocols/https/controller.py
View File

@ -6,6 +6,7 @@ FIXME: sanitize or properly escape user input (XSS, attacks on the client).
FIXME: make sure we never try to execute user input (injection, attacks on the FIXME: make sure we never try to execute user input (injection, attacks on the
server). server).
FIXME: all the Blammos. They're terrible, unacceptable failures. FIXME: all the Blammos. They're terrible, unacceptable failures.
FIXME correct direct key access everywhere.
""" """
@ -213,7 +214,9 @@ class Monitor(santiago.SantiagoMonitor):
class RestMonitor(santiago.RestController): class RestMonitor(santiago.RestController):
# FIXME filter input and escape output properly. # FIXME filter input and escape output properly.
# FIXME This input shows evidence of vulnerability: <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>
# FIXME build tests for this. # FIXME build tests for this.
# FIXME change page headers based on encoding.
# TODO http://tools.cherrypy.org/wiki/ParameterDemonstration # TODO http://tools.cherrypy.org/wiki/ParameterDemonstration
# TODO http://docs.cherrypy.org/dev/concepts/dispatching.html # TODO http://docs.cherrypy.org/dev/concepts/dispatching.html
@ -277,11 +280,14 @@ class HostedService(RestMonitor):
# Have to remove instead of delete for locations as $service is a list # Have to remove instead of delete for locations as $service is a list
@cherrypy.tools.ip_filter() @cherrypy.tools.ip_filter()
# FIXME correct direct key access
def DELETE(self, client, service, location): def DELETE(self, client, service, location):
if location in self.santiago.hosting[client][service]: if location in self.santiago.hosting[client][service]:
self.santiago.hosting[client][service].remove(location) self.santiago.hosting[client][service].remove(location)
class HostedClient(RestMonitor): class HostedClient(RestMonitor):
# FIXME correct direct key access
@cherrypy.tools.ip_filter() @cherrypy.tools.ip_filter()
def GET(self, client, **kwargs): def GET(self, client, **kwargs):
return self.respond("hostedClient.tmpl", return self.respond("hostedClient.tmpl",
@ -333,6 +339,7 @@ class Hosting(RestMonitor):
class ConsumedService(RestMonitor): class ConsumedService(RestMonitor):
@cherrypy.tools.ip_filter() @cherrypy.tools.ip_filter()
def GET(self, host, service, **kwargs): def GET(self, host, service, **kwargs):
# FIXME don't crash with a 500 error, don't directly access the key!!
return self.respond("consumedService.tmpl", return self.respond("consumedService.tmpl",
{ "service": service, { "service": service,
"host": host, "host": host,