fixing security issues found in onap admportal
[sdnc/oam.git] / admportal / server / router / routes / admin.js
1 var express = require('express');
2 var router = express.Router();
3 var exec = require('child_process').exec;
4 var util = require('util');
5 var fs = require('fs');
6 var dbRoutes = require('./dbRoutes');
7 var csp = require('./csp');
8 var cookieParser = require('cookie-parser');
9 var bodyParser = require('body-parser');
10 var sax = require('sax'),strict=true,parser = sax.parser(strict);
11 var async = require('async');
12 var csrf = require('csurf');
13
14 var csrfProtection = csrf({cookie: true});
15 router.use(cookieParser());
16
17
18 // GET
19 router.get('/getParameters', csp.checkAuth, dbRoutes.checkDB, function(req,res) {
20     dbRoutes.getParameters(req,res, {code:'', msg:''}, req.session.loggedInAdmin);
21 });
22
23 /*
24 router.get('/deleteParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res) {
25
26         var privilegeObj = req.session.loggedInAdmin;
27         var tasks = [];
28         tasks.push(function(callback) { dbRoutes.deleteParameter(req,res,callback); });
29         async.series(tasks, function(err,result){
30                 var msgArray = new Array();
31                 if(err){
32                         msgArray.push(err);
33                         dbRoutes.getParameters(req,res,{code:'failure', msg:msgArray},privilegeObj);
34                         return;
35                 }
36                 else {
37                         msgArray.push('Row successfully deleted from PARAMETERS table.');
38                         dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
39                         return;
40                 }
41         });
42 });
43 */
44
45
46 // POST
47 router.post('/addParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res){
48
49     var privilegeObj = req.session.loggedInAdmin;
50     var tasks = [];
51     tasks.push( function(callback) { dbRoutes.addParameter(req,res,callback); } );
52     async.series(tasks, function(err,result){
53         var msgArray = new Array();
54         if(err){
55             msgArray.push(err);
56             dbRoutes.getParameters(req,res,{code:'failure', msg:msgArray},privilegeObj);
57             return;
58         }
59         else {
60             msgArray.push('Successfully updated PARAMETERS.');
61             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
62             return;
63         }
64     });
65 });
66
67 // gamma - updateAicSite
68 router.post('/updateParameter', csp.checkAuth, dbRoutes.checkDB, csrfProtection, function(req,res){
69
70     var privilegeObj = req.session.loggedInAdmin;
71     var tasks = [];
72     tasks.push( function(callback) { dbRoutes.updateParameter(req,res,callback); } );
73     async.series(tasks, function(err,result){
74         var msgArray = new Array();
75         if(err){
76             msgArray.push(err);
77             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
78             return;
79         }
80         else {
81             msgArray.push('Successfully updated PARAMETERS.');
82             dbRoutes.getParameters(req,res,{code:'success', msg:msgArray},privilegeObj);
83             return;
84         }
85     });
86 });
87
88
89 module.exports = router;