X-Git-Url: https://gerrit.onap.org/r/gitweb?a=blobdiff_plain;f=admportal%2Fserver%2Frouter%2Froutes%2Fuser.js;h=df5f8607856a286d3fb2ea7d3461d36a0cba5158;hb=3d54c9ad35ef5e7a4b13948e718a4ad2830cbb04;hp=40d3437c8d2d68e4249638692d06c6a6e96829be;hpb=e1829deb67e1e028ad02c383db86ff654bfcbe06;p=sdnc%2Foam.git

diff --git a/admportal/server/router/routes/user.js b/admportal/server/router/routes/user.js
index 40d3437c..df5f8607 100644
--- a/admportal/server/router/routes/user.js
+++ b/admportal/server/router/routes/user.js
@@ -5,8 +5,13 @@ var util = require('util');
 var fs = require('fs');
 var dbRoutes = require('./dbRoutes');
 var csp = require('./csp');
+var cookieParser = require('cookie-parser');
+var csrf = require('csurf');
 var bodyParser = require('body-parser');
-var sax = require('sax'),strict=true,parser = sax.parser(strict);
+//var sax = require('sax'),strict=true,parser = sax.parser(strict);
+
+var csrfProtection = csrf({cookie: true});
+router.use(cookieParser());
 
 // SVC_LOGIC table columns
 var _module=''; // cannot use module its a reserved word
@@ -17,16 +22,21 @@ var xmlfile='';
 
 
 //router.use(bodyParser());
-router.use(bodyParser.urlencoded({
-  extended: true
-}));
+router.use(bodyParser.urlencoded({ extended: true }));
 
 
 // GET
 router.get('/listUsers', csp.checkAuth, function(req,res) {
 	dbRoutes.listUsers(req,res, {user:req.session.loggedInAdmin,code:'', msg:''} );
 });
-router.get('/deleteUser', csp.checkAuth, function(req,res) {
+// POST
+router.post('/updateUser', csp.checkAuth, csrfProtection, function(req,res,next){
+	dbRoutes.updateUser(req,res,{code:'',msg:''});
+});
+router.post('/addUser', csp.checkAuth, csrfProtection, function(req,res) {
+	dbRoutes.addUser(req,res, {code:'', msg:''} );
+});
+router.get('/deleteUser', csp.checkAuth, csrfProtection, function(req,res) {
 	dbRoutes.deleteUser(req,res, {code:'', msg:''} );
 });
 
@@ -93,13 +103,6 @@ parser.onend = function () {
 */
 
 
-// POST
-router.post('/updateUser', csp.checkAuth, function(req,res,next){
-	dbRoutes.updateUser(req,res,{code:'',msg:''});
-});
-router.post('/addUser', csp.checkAuth, function(req,res) {
-	dbRoutes.addUser(req,res, {code:'', msg:''} );
-});
 
 //router.post('/upload', csp.checkAuth, function(req, res, next){