Commit 55082303 authored by Robert Czechowski's avatar Robert Czechowski

Make dbstatus page optionally require a configured secret string

parent f0deebc5
......@@ -36,6 +36,7 @@ pub struct Config {
pub allow_sex_na: Option<bool>,
pub allow_sex_diverse: Option<bool>,
pub allow_sex_other: Option<bool>,
pub dbstatus_secret: Option<String>,
pub template_params: Option<::std::collections::BTreeMap<String, String>>,
}
......
......@@ -152,7 +152,13 @@ pub fn show_login<T: MedalConnection>(conn: &T, session_token: Option<String>, l
("login".to_owned(), data)
}
pub fn status<T: MedalConnection>(conn: &T, _: ()) -> String { conn.get_debug_information() }
pub fn status<T: MedalConnection>(conn: &T, config_secret: Option<String>, given_secret: Option<String>) -> MedalResult<String> {
if config_secret == given_secret {
Ok(conn.get_debug_information())
} else {
Err(MedalError::AccessDenied)
}
}
pub fn debug<T: MedalConnection>(conn: &T, session_token: Option<String>)
-> (String, json_val::Map<String, json_val::Value>) {
......
......@@ -334,7 +334,11 @@ fn greet_personal<C>(req: &mut Request) -> IronResult<Response>
fn dbstatus<C>(req: &mut Request) -> IronResult<Response>
where C: MedalConnection + std::marker::Send + 'static {
let status = with_conn![core::status, C, req, ()];
let config = req.get::<Read<SharedConfiguration>>().unwrap();
let query_string = req.url.query().map(|s| s.to_string());
let status = with_conn![core::status, C, req, config.dbstatus_secret.clone(), query_string].aug(req)?;
let mut resp = Response::new();
resp.set_mut(status).set_mut(status::Ok);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment