Added new modules to help prevent Cross Site Request Forgery
[sdnc/oam.git] / admportal / server / router / routes / admin.js
1 var express = require('express');
2 var router = express.Router();
3 var exec = require('child_process').exec;
4 var util = require('util');
5 var fs = require('fs');
6 var dbRoutes = require('./dbRoutes');
7 var csp = require('./csp');
8 var cookieParser = require('cookie-parser');
9 var bodyParser = require('body-parser');
10 var sax = require('sax'),strict=true,parser = sax.parser(strict);
11 var async = require('async');
12 var csrf = require('csurf');
13
14 var csrfProtection = csrf({cookie: true});
15 router.use(cookieParser());
16
17
18 // GET
19 router.get('/getParameters', csp.checkAuth, dbRoutes.checkDB, function(req,res) {
20     dbRoutes.getParameters(req,res, {code:'', msg:''}, req.session.loggedInAdmin);
21 });
22 router.get('/deleteParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res) {
23
24         var privilegeObj = req.session.loggedInAdmin;
25         var tasks = [];
26         tasks.push(function(callback) { dbRoutes.deleteParameter(req,res,callback); });
27         async.series(tasks, function(err,result){
28                 var msgArray = new Array();
29                 if(err){
30                         msgArray.push(err);
31                         dbRoutes.getParameters(req,res,{code:'failure', msg:msgArray},privilegeObj);
32                         return;
33                 }
34                 else {
35                         msgArray.push('Row successfully deleted from PARAMETERS table.');
36                         dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
37                         return;
38                 }
39         });
40 });
41
42
43 // POST
44 router.post('/addParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res){
45
46     var privilegeObj = req.session.loggedInAdmin;
47     var tasks = [];
48     tasks.push( function(callback) { dbRoutes.addParameter(req,res,callback); } );
49     async.series(tasks, function(err,result){
50         var msgArray = new Array();
51         if(err){
52             msgArray.push(err);
53             dbRoutes.getParameters(req,res,{code:'failure', msg:msgArray},privilegeObj);
54             return;
55         }
56         else {
57             msgArray.push('Successfully updated PARAMETERS.');
58             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
59             return;
60         }
61     });
62 });
63
64 // gamma - updateAicSite
65 router.post('/updateParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res){
66
67     var privilegeObj = req.session.loggedInAdmin;
68     var tasks = [];
69     tasks.push( function(callback) { dbRoutes.updateParameter(req,res,callback); } );
70     async.series(tasks, function(err,result){
71         var msgArray = new Array();
72         if(err){
73             msgArray.push(err);
74             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
75             return;
76         }
77         else {
78             msgArray.push('Successfully updated PARAMETERS.');
79             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
80             return;
81         }
82     });
83 });
84
85
86 module.exports = router;