Added new modules to help prevent Cross Site Request Forgery
[sdnc/oam.git] / admportal / server / router / routes / user.js
1 var express = require('express');
2 var router = express.Router();
3 var exec = require('child_process').exec;
4 var util = require('util');
5 var fs = require('fs');
6 var dbRoutes = require('./dbRoutes');
7 var csp = require('./csp');
8 var cookieParser = require('cookie-parser');
9 var csrf = require('csurf');
10 var bodyParser = require('body-parser');
11 //var sax = require('sax'),strict=true,parser = sax.parser(strict);
12
13 var csrfProtection = csrf({cookie: true});
14 router.use(cookieParser());
15
16 // SVC_LOGIC table columns
17 var _module=''; // cannot use module its a reserved word
18 var version='';
19 var rpc='';
20 var mode='';
21 var xmlfile='';
22
23
24 //router.use(bodyParser());
25 router.use(bodyParser.urlencoded({ extended: true }));
26
27
28 // GET
29 router.get('/listUsers', csp.checkAuth, function(req,res) {
30         dbRoutes.listUsers(req,res, {user:req.session.loggedInAdmin,code:'', msg:''} );
31 });
32 // POST
33 router.post('/updateUser', csp.checkAuth, csrfProtection, function(req,res,next){
34         dbRoutes.updateUser(req,res,{code:'',msg:''});
35 });
36 router.post('/addUser', csp.checkAuth, csrfProtection, function(req,res) {
37         dbRoutes.addUser(req,res, {code:'', msg:''} );
38 });
39 router.get('/deleteUser', csp.checkAuth, csrfProtection, function(req,res) {
40         dbRoutes.deleteUser(req,res, {code:'', msg:''} );
41 });
42
43 //router.get('/activate', csp.checkAuth, function(req,res){
44
45         //var _module = req.query.module;
46         //var rpc = req.query.rpc;
47         //var version = req.query.version;
48         //var mode = req.query.mode;
49
50         //dbRoutes.activate(req,res,_module,rpc,version,mode);
51 //});
52
53 //router.get('/deactivate', csp.checkAuth, function(req,res){
54
55         //var _module = req.query.module;
56         //var rpc = req.query.rpc;
57         //var version = req.query.version;
58         //var mode = req.query.mode;
59 //
60         //dbRoutes.deactivate(req,res,_module,rpc,version,mode);
61 //});
62
63 //router.get('/deleteDG', csp.checkAuth, function(req,res){
64
65         //var _module = req.query.module;
66         //var rpc = req.query.rpc;
67         //var version = req.query.version;
68         //var mode = req.query.mode;
69
70         //dbRoutes.deleteDG(req,res,_module,rpc,version,mode);
71 //});
72 /*
73 // SAX
74 parser.onerror = function (e) {
75         logger.debug('onerror');
76   // an error happened.
77 };
78 parser.ontext = function (t) {
79   // got some text.  t is the string of text.
80         logger.debug('ontext:'+t);
81 };
82 parser.onopentag = function (node) {
83   // opened a tag.  node has "name" and "attributes"
84         if ( node.name == 'service-logic' )
85         {
86                 _module = node.attributes.module;
87                 version = node.attributes.version;
88         }
89         if ( node.name == 'method' )
90         {
91                 rpc = node.attributes.rpc;
92                 mode = node.attributes.mode;
93         }
94 };
95 parser.onattribute = function (attr) {
96   // an attribute.  attr has "name" and "value"
97         logger.debug('onattribute:'+attr);
98 };
99 parser.onend = function () {
100   // parser stream is done, and ready to have more stuff written to it.
101         logger.debug('onend:');
102 };
103 */
104
105
106
107 //router.post('/upload', csp.checkAuth, function(req, res, next){
108
109 /*
110 logger.debug("upload");
111         if(req.files.filename){
112         if (req.files.filename.size == 0) {
113                         resultObj = 
114                                 {code:'danger', msg:'There was an error uploading the file, please try again.'};
115                         dbRoutes.listSLA(req,res, resultObj);
116         }
117         fs.exists(req.files.filename.path, function(exists) {
118             if(exists) {
119                                 resultObj = {code:'success', msg:'File sucessfully uploaded.'};
120
121                                 // parse xml
122                                 try {
123                                 var file_buf = fs.readFileSync(req.files.filename.path, "utf8");
124 logger.debug('file '+req.files.filename);
125
126                                         
127                                         // call Dan's svclogic shell script from here
128                                          var commandToExec = process.cwd()
129                                 + "/shell/svclogic.sh load "
130                                                 + req.files.filename.path + " "
131                                                 + process.cwd()
132                                                 + "/config/svclogic.properties";
133
134                                 logger.debug("commandToExec:" + commandToExec);
135                                 child = exec(commandToExec ,function (error,stdout,stderr){
136                                 if(error){
137                                         logger.info("error:" + error);
138                                 }
139                                 if(stderr){
140                                         logger.info("stderr:" + stderr);
141                                 }
142                                 if(stdout){
143                                                         logger.info("OUTPUT:" + stdout);
144                                                         dbRoutes.listSLA(req,res, resultObj);
145                                                 }
146
147                                                 // remove the grave accents, the sax parser does not like them
148                                         //parser.write(file_buf.replace(/\`/g,'').toString('utf8')).close();
149                                                 //dbRoutes.addDG(_module,version,rpc,mode,file_buf,req,res);
150                                                 //dbRoutes.listSLA(req,res, resultObj);
151                                         });
152                                 } catch(ex) {
153                                 // keep 'em silent
154                                         logger.debug('sax error:'+ex);
155                                 }
156
157             } else {
158                                 resultObj = 
159                                         {code:'danger', msg:'There was an error uploading the file, please try again.'};
160                                 dbRoutes.listSLA(req,res, resultObj);
161             }
162         });
163         }
164         else {
165                 resultObj = 
166                         {code:'danger', msg:'There was an error uploading the file, please try again.'};
167                 dbRoutes.listSLA(req,res, resultObj);
168         }
169 });
170 */
171
172 module.exports = router;