Skip to content

Commit d3319fd

Browse files
austinwbestaustinwbest
committed
Change access checking to functions
Fix the logger to show the allowed endpoint when wildcard endpoints are used
1 parent 94c8541 commit d3319fd

File tree

3 files changed

+76
-59
lines changed

3 files changed

+76
-59
lines changed

‎root/app/www/public/api/index.php‎

Lines changed: 16 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -169,60 +169,27 @@
169169
readfile($proxyBackup);
170170
}
171171
} else {
172-
// CHECK IF THE ENDPOINT HAS WILDCARDS: /{...}/{...} OR /{...}
173-
if (!$proxiedApp['access'][$endpoint]) {
174-
$endpointRegexes = ['/(.*)\/(.*)\/(.*)/', '/(.*)\/(.*)/'];
175-
$wildcardRegexes = ['/(.*)({.*})\/({.*})/', '/(.*)({.*})/'];
176-
$wildcard = false;
172+
if ($accessEndpoint = $starr->isAllowedEndpoint($proxiedApp['access'], $endpoint)) {
173+
$endpoint = $accessEndpoint;
174+
} else {
175+
logger($logfile, $apikey, $endpoint, 401);
176+
logger(str_replace('access.log', 'access_' . $proxiedApp['proxiedAppDetails']['name'] . '.log', $logfile), $apikey, $endpoint, 401);
177+
$usageDb->adjustAppUsage($proxiedApp['proxiedAppDetails']['id'], 401);
177178

178-
foreach ($wildcardRegexes as $index => $wildcardRegex) {
179-
preg_match($endpointRegexes[$index], $endpoint, $requestMatches);
180-
181-
if (!$requestMatches) {
182-
continue;
183-
}
184-
185-
foreach ($proxiedApp['access'] as $accessEndpoint => $accessMethods) {
186-
preg_match($wildcardRegex, $accessEndpoint, $accessMatches);
187-
188-
if (!$accessMatches) {
189-
continue;
190-
}
191-
192-
if ($accessMatches[1] == $requestMatches[1] . '/') {
193-
if (count($accessMatches) == count($requestMatches)) {
194-
$wildcard = true;
195-
$endpoint = $accessEndpoint; //-- ALLOW LATER CHECKS TO PASS
196-
break;
197-
}
198-
}
199-
}
200-
201-
if ($wildcard) {
202-
break;
203-
}
179+
if ($proxyDb->isNotificationTriggerEnabled('blocked')) {
180+
$payload = [
181+
'event' => 'blocked',
182+
'proxyApp' => $proxiedApp['proxiedAppDetails']['name'],
183+
'starrApp' => $proxiedApp['starrAppDetails']['name'],
184+
'endpoint' => $endpoint
185+
];
186+
$notifications->notify(0, 'blocked', $payload);
204187
}
205188

206-
if (!$wildcard) {
207-
logger($logfile, $apikey, $endpoint, 401);
208-
logger(str_replace('access.log', 'access_' . $proxiedApp['proxiedAppDetails']['name'] . '.log', $logfile), $apikey, $endpoint, 401);
209-
$usageDb->adjustAppUsage($proxiedApp['proxiedAppDetails']['id'], 401);
210-
211-
if ($proxyDb->isNotificationTriggerEnabled('blocked')) {
212-
$payload = [
213-
'event' => 'blocked',
214-
'proxyApp' => $proxiedApp['proxiedAppDetails']['name'],
215-
'starrApp' => $proxiedApp['starrAppDetails']['name'],
216-
'endpoint' => $endpoint
217-
];
218-
$notifications->notify(0, 'blocked', $payload);
219-
}
220-
221-
apiResponse(401, ['error' => sprintf(APP_API_ERROR, 'provided apikey is missing access to ' . $endpoint)]);
222-
}
189+
apiResponse(401, ['error' => sprintf(APP_API_ERROR, 'provided apikey is missing access to ' . $endpoint)]);
223190
}
224191

225-
if (!in_array($method, $proxiedApp['access'][$endpoint])) {
192+
if (!$accessMethod = $starr->isAllowedEndpointMethod($proxiedApp['access'], $endpoint, $method)) {
226193
logger($logfile, $apikey, $endpoint, 405);
227194
logger(str_replace('access.log', 'access_' . $proxiedApp['proxiedAppDetails']['name'] . '.log', $logfile), $apikey, $endpoint, 405);
228195
$usageDb->adjustAppUsage($proxiedApp['proxiedAppDetails']['id'], 405);

‎root/app/www/public/classes/Starr.php‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,4 +211,58 @@ public function getAppFromStarrKey($apikey, $starrsTable)
211211

212212
return [];
213213
}
214+
215+
public function isAllowedEndpoint($endpoints, $endpoint)
216+
{
217+
if (!$endpoints || !$endpoint) {
218+
return;
219+
}
220+
221+
if ($endpoints[$endpoint]) {
222+
return $endpoint;
223+
}
224+
225+
// CHECK IF THE ENDPOINT HAS WILDCARDS: /{...}/{...} OR /{...}
226+
if (!$endpoints[$endpoint]) {
227+
$endpointRegexes = ['/(.*)\/(.*)\/(.*)/', '/(.*)\/(.*)/'];
228+
$wildcardRegexes = ['/(.*)({.*})\/({.*})/', '/(.*)({.*})/'];
229+
230+
foreach ($wildcardRegexes as $index => $wildcardRegex) {
231+
preg_match($endpointRegexes[$index], $endpoint, $requestMatches);
232+
233+
if (!$requestMatches) {
234+
continue;
235+
}
236+
237+
foreach ($endpoints as $accessEndpoint => $accessMethods) {
238+
preg_match($wildcardRegex, $accessEndpoint, $accessMatches);
239+
240+
if (!$accessMatches) {
241+
continue;
242+
}
243+
244+
if ($accessMatches[1] == $requestMatches[1] . '/') {
245+
if (count($accessMatches) == count($requestMatches)) {
246+
return $accessEndpoint;
247+
}
248+
}
249+
}
250+
}
251+
}
252+
253+
return;
254+
}
255+
256+
public function isAllowedEndpointMethod($endpoints, $endpoint, $method)
257+
{
258+
if (!$endpoints || !$endpoint || !$method) {
259+
return false;
260+
}
261+
262+
if (in_array($method, $endpoints[$endpoint]) || in_array(strtolower($method), $endpoints[$endpoint])) {
263+
return true;
264+
}
265+
266+
return false;
267+
}
214268
}

‎root/app/www/public/functions/logger.php‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -194,19 +194,15 @@ function getLog($logfile, $page = 1, $app = false)
194194
<h4>Endpoint usage <span class="text-small">(<?= count($endpointUsage) ?> endpoint<?= count($endpointUsage) == 1 ? '' : 's' ?>)</span></h4>
195195
<?php
196196
foreach ($endpointUsage as $endpoint => $methods) {
197-
foreach ($methods as $method => $usage) {
198-
$accessError = true;
197+
$accessEndpoint = $starr->isAllowedEndpoint($proxiedApp['access'], $endpoint);
199198

200-
if ($proxiedApp['access'][$endpoint] || $proxiedApp['access'][strtolower($endpoint)]) {
201-
if (in_array(strtolower($method), $proxiedApp['access'][$endpoint]) || in_array(strtolower($method), $proxiedApp['access'][strtolower($endpoint)])) {
202-
$accessError = false;
203-
}
204-
}
199+
foreach ($methods as $method => $usage) {
200+
$accessMethod = $starr->isAllowedEndpointMethod($proxiedApp['access'], $accessEndpoint, $method);
205201

206202
?>
207-
<i id="disallowed-endpoint-<?= md5($endpoint.$method) ?>" class="far fa-times-circle text-danger" title="Disallowed endpoint, click to allow it" style="display: <?= $accessError ? 'inline-block' : 'none' ?>; cursor: pointer;" onclick="addEndpointAccess('<?= $app ?>', <?= $proxiedApp['proxiedAppDetails']['id'] ?>, '<?= $endpoint ?>', '<?= $method ?>', '<?= md5($endpoint.$method) ?>')"></i>
208-
<i id="allowed-endpoint-<?= md5($endpoint.$method) ?>" class="far fa-check-circle text-success" title="Allowed endpoint" style="display: <?= !$accessError ? 'inline-block' : 'none' ?>;"></i>
209-
[<?= strtoupper($method) ?>] <?= $endpoint . ': ' . number_format($usage) ?> hit<?= $usage == 1 ? '' : 's' ?><br>
203+
<i id="disallowed-endpoint-<?= md5($endpoint.$method) ?>" class="far fa-times-circle text-danger" title="Disallowed endpoint, click to allow it" style="display: <?= !$accessMethod ? 'inline-block' : 'none' ?>; cursor: pointer;" onclick="addEndpointAccess('<?= $app ?>', <?= $proxiedApp['proxiedAppDetails']['id'] ?>, '<?= $endpoint ?>', '<?= $method ?>', '<?= md5($endpoint.$method) ?>')"></i>
204+
<i id="allowed-endpoint-<?= md5($endpoint.$method) ?>" class="far fa-check-circle text-success" title="Allowed endpoint" style="display: <?= $accessMethod ? 'inline-block' : 'none' ?>;"></i>
205+
[<?= strtoupper($method) ?>] <?= ($accessEndpoint != $endpoint ? $accessEndpoint . ' → ' : '') . $endpoint . ': ' . number_format($usage) ?> hit<?= $usage == 1 ? '' : 's' ?><br>
210206
<?php
211207
}
212208
}

0 commit comments

Comments
 (0)