fixing security issues found in onap admportal
[sdnc/oam.git] / admportal / server / router / routes / sla.js
1 var express = require('express');
2 var router = express.Router();
3
4 var spawn = require('child_process').spawn;
5
6 //var util = require('util');
7 var fs = require('fs');
8 var dbRoutes = require('./dbRoutes');
9 var csp = require('./csp');
10 var multer = require('multer');
11 var cookieParser = require('cookie-parser');
12 var csrf = require('csurf');
13 var bodyParser = require('body-parser');
14 //var sax = require('sax'),strict=true,parser = sax.parser(strict);
15 var async = require('async');
16
17
18 // SVC_LOGIC table columns
19 var _module=''; // cannot use module its a reserved word
20 var version='';
21 var rpc='';
22 var mode='';
23 var xmlfile='';
24
25
26 // used for file upload button, retain original file name
27 //router.use(bodyParser());
28 var csrfProtection = csrf({cookie: true});
29 router.use(bodyParser.urlencoded({ extended: true }));
30 //var upload = multer({ dest: process.cwd() + '/uploads/', rename: function(fieldname,filename){ return filename; } });
31
32 // multer 1.1
33 var storage = multer.diskStorage({
34   destination: function (req, file, cb) {
35     cb(null, process.cwd() + '/uploads/')
36   },
37   filename: function (req, file, cb) {
38     cb(null, file.originalname )
39   }
40 });
41
42 var upload = multer({
43     storage: storage
44 });
45
46
47 /*
48 router.use(multer({
49         dest: process.cwd() + '/uploads/',
50         rename: function(fieldname,filename){
51                 return filename;
52         }
53 }));
54 */
55
56
57 //router.use(express.json());
58 //router.use(express.urlencoded());
59 //router.use(multer({ dest: './uploads/' }));
60
61
62 // GET
63 router.get('/listSLA', csp.checkAuth, csrfProtection, function(req,res) {
64         dbRoutes.listSLA(req,res,{code:'', msg:''} );
65 });
66
67 router.get('/activate', csp.checkAuth, csrfProtection, function(req,res){
68
69         var _module = req.sanitize(req.query.module);
70         var rpc = req.sanitize(req.query.rpc);
71         var version = req.sanitize(req.query.version);
72         var mode = req.sanitize(req.query.mode);
73
74         var tasks = [];
75   tasks.push( function(callback) { dbRoutes.global_deactivate(req,res,_module,rpc,mode,callback); } );
76   tasks.push( function(callback) { dbRoutes.activate(req,res,_module,rpc,version,mode,callback); } );
77         async.series(tasks,  function(err,result){
78
79                 if (  err ) {
80                         dbRoutes.listSLA(req,res,{code:'failure', msg:err });
81                 }
82                 else {
83                         dbRoutes.listSLA(req,res,{ code:'success', msg:'Successfully activated directed graph.'});
84                 }
85         });
86 });
87
88 router.get('/deactivate', csp.checkAuth, csrfProtection, function(req,res){
89
90         var _module = req.sanitize(req.query.module);
91         var rpc = req.sanitize(req.query.rpc);
92         var version = req.sanitize(req.query.version);
93         var mode = req.sanitize(req.query.mode);
94
95         var tasks = [];
96   tasks.push( function(callback) { dbRoutes.deactivate(req,res,_module,rpc,version,mode,callback); } );
97   async.series(tasks,  function(err,result){
98
99                 if (  err ) {
100                         dbRoutes.listSLA(req,res,{code:'failure', msg:err });
101                 }
102                 else {
103                         dbRoutes.listSLA(req,res,{code:'success', msg:'Successfully deactivated directed graph.'});
104                 }
105         });
106 });
107
108 router.get('/deleteDG', csp.checkAuth, csrfProtection, function(req,res){
109
110         var _module = req.sanitize(req.query.module);
111         var rpc = req.sanitize(req.query.rpc);
112         var version = req.sanitize(req.query.version);
113         var mode = req.sanitize(req.query.mode);
114
115         var tasks = [];
116   tasks.push( function(callback) { dbRoutes.deleteDG(req,res,_module,rpc,version,mode,callback); } );
117   async.series(tasks,  function(err,result){
118
119                 if (  err ) {
120                         dbRoutes.listSLA(req,res,{code:'failure', msg:'There was an deleting the directed graph. '+ err });
121                 }
122                 else {
123                         dbRoutes.listSLA(req,res,{code:'success', msg:'Successfully deleted directed graph.'});
124                 }
125         });
126 });
127
128 // POST
129 router.post('/upload', csp.checkAuth, upload.single('filename'), csrfProtection, function(req, res, next){
130
131         var _lstdout = "";
132         var _lstderr = "";
133         console.log('file:'+ JSON.stringify(req.file));
134
135         if(req.file.originalname)
136         {
137                 if (req.file.originalname.size == 0)
138                 {
139                         dbRoutes.listSLA(req,res, {code:'danger', msg:'There was an error uploading the file, please try again.'});
140                 }
141                 fs.exists(req.file.path, function(exists)
142                 {
143                         if(exists)
144                         {
145                                 // parse xml
146                                 try 
147                                 {
148                                         var currentDB = dbRoutes.getCurrentDB();
149                                         var file_buf = fs.readFileSync(req.file.path, "utf8");
150
151                                         // call svclogic shell script from here
152                                         var commandToExec = process.cwd() + "/shell/svclogic.sh";
153
154                                         console.log('filepath: ' + req.file.path);
155           console.log('prop: ' + process.env.SDNC_CONFIG_DIR + "/svclogic.properties." + currentDB);
156                                         console.log("commandToExec:" + commandToExec);
157
158                                         child = spawn(commandToExec, ['load', req.file.path, process.env.SDNC_CONFIG_DIR + "/svclogic.properties." + currentDB]);
159                                         child.on('error', function(error){
160                                                 console.log('error: '+error);
161                                                 dbRoutes.listSLA(req,res,{code:'failure', msg:error});
162                                                 return;
163                                         });
164                                         child.stdout.on('data', function(data) {
165                                                 console.log('stdout: ' + data);
166                                                 _lstdout = _lstdout.concat(data);
167                                         });
168                                         child.stderr.on('data', function(data) {
169                                                 console.log("stderr:" + data);
170                                                 _lstderr = _lstderr.concat(data);
171                                         });
172                                         child.on('exit', function(code,signal){
173                                                 console.log('code: ' + code);
174                                                 console.log('stdout: [[' + _lstdout + ']]');
175                                                 console.log('stderr: [[' + _lstderr + ']]');
176                                                 if ( _lstderr.indexOf("Saving") > -1 )
177                                                 {
178                                                         dbRoutes.listSLA(req,res,{code:'success', msg:'File sucessfully uploaded.'});
179                                                 }
180                                                 else
181                                                 {
182                                                         dbRoutes.listSLA(req,res,{code:'failure', msg:_lstderr} );
183                                                 }
184                                                 return;
185                                         });
186                                 } catch(ex) {
187                                         console.log("error: " + ex);
188                                         dbRoutes.listSLA(req,res,{code:'failure',msg:ex} );
189                                         return;
190                                 }
191                         }
192                         else {
193                                 dbRoutes.listSLA(req,res,{code:'danger', msg:'There was an error uploading the file, please try again.'});
194                                 return;
195                         }
196                 });
197         }
198         else {
199                 dbRoutes.listSLA(req,res,{code:'danger', msg:'There was an error uploading the file, please try again.'});
200                 return;
201         }
202 });
203
204 router.get('/printAsXml', csp.checkAuth, csrfProtection, function(req,res){
205
206         try {
207                 var _lstdout = "";
208                 var _lstderr = "";
209                 var _module = req.query.module;
210     var rpc = req.query.rpc;
211     var version = req.query.version;
212     var mode = req.query.mode;
213                 var currentDB = dbRoutes.getCurrentDB();
214
215     // call Dan's svclogic shell script from here
216     var commandToExec = process.cwd() + "/shell/svclogic.sh";
217                 console.log("commandToExec:" + commandToExec);
218                 console.log("_mode: " + _module);
219                 console.log("rpc: " + rpc);
220                 console.log("version: " + version);
221                 console.log("currentDB: " +  process.env.SDNC_CONFIG_DIR + "/svclogic.properties." + currentDB);
222
223     child = spawn(commandToExec, ['get-source', _module, rpc, mode, version, process.env.SDNC_CONFIG_DIR + "/svclogic.properties." + currentDB], {maxBuffer: 1024*5000});
224                 child.on('error', function(error){
225                         console.log("error: " + error);
226                         dbRoutes.listSLA(req,res,{code:'failure',msg:error} );
227                         return;
228                 });
229                 child.stderr.on('data', function(data){
230                         console.log('stderr: ' + data);
231                         _lstderr = _lstderr.concat(data);
232                 });
233                 child.stdout.on('data', function(data){
234                         console.log("OUTPUT:" + data);
235                         _lstdout = _lstdout.concat(data);
236                 });
237                 child.on('exit', function(code,signal){
238
239                         console.log('code: ' + code);
240                         console.log('close:stdout: ' + _lstdout);
241                         console.log('close:stderr: ' + _lstderr);
242
243                         if ( code != 0 ){
244                                 dbRoutes.listSLA(req,res,{code:'failure',msg:_lstderr} );
245                         }
246                         else {
247                                 res.render('sla/printasxml', {result:{code:'success', 
248                                         msg:'Module : ' + _module + '\n' + 
249                                         'RPC    : ' + rpc + '\n' + 
250                                         'Mode   : ' + mode + '\n' +
251                                         'Version: ' + version + '\n\n' + _lstdout}, header:process.env.MAIN_MENU});
252                         }
253                         return;
254                 });
255         } catch(ex) {
256                 console.error("error:" + ex);
257                 dbRoutes.listSLA(req,res,{code:'failure',msg:ex} );
258                 return;
259  }
260 });
261
262 module.exports = router;