Commit c33f0922 authored by Alain Takoudjou's avatar Alain Takoudjou

Solve ACE arbitrary file Modification

parent a71c3189
$(document).ready( function() {
var editor = ace.edit("editor");
editor.setTheme("ace/theme/crimson_editor");
var CurentMode = require("ace/mode/buildout").Mode;
editor.getSession().setMode(new CurentMode());
editor.getSession().setTabSize(2);
editor.getSession().setUseSoftTabs(true);
editor.renderer.setHScrollBarAlwaysVisible(false);
var file = $("input#profile").val();
var edit = false;
selectFile(file);
$("#save").click(function(){
if(!edit){
error("Error: Can not load your file, please make sure that you have selected a Software Release");
return false;
}
send = false;
$.ajax({
type: "POST",
url: $SCRIPT_ROOT + '/saveFileContent',
data: {file: file, content: editor.getSession().getValue()},
success: function(data){
if(data.code == 1){
error("File Saved!");
}
else{
error(data.result);
}
send = false;
}
});
return false;
});
function error(msg){
$("#flash").fadeOut('normal');
$("#flash").empty();
$("#flash").fadeIn('normal');
$("#flash").append("<ul class='flashes'><li>" + msg + "</li></ul>");
}
function selectFile(file){
edit = false;
$.ajax({
type: "POST",
url: $SCRIPT_ROOT + '/getFileContent',
data: "file=" + file,
success: function(data){
if(data.code == 1){
editor.getSession().setValue(data.result);
edit = true;
}
else{
error("Error: Can not load your file, please make sure that you have selected a Software Release");
}
}
});
return;
}
});
\ No newline at end of file
......@@ -13,28 +13,7 @@
<meta name="description" content="" />
<link href="{{ url_for('static', filename='css/styles.css', _external=False) }}" rel="stylesheet" type="text/css" media="screen" />
<script src="{{ url_for('static', filename='jquery/jquery-1.6.2.min.js') }}" type="text/javascript" charset="utf-8"></script>
{% if request.path == '/editSoftwareProfile' or request.path == '/editInstanceProfile' %}
<script src="{{ url_for('static', filename='ace/ace-uncompressed.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/theme-crimson_editor.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/mode-buildout.js') }}" type="text/javascript" charset="utf-8"></script>
<script type="text/javascript">
$(document).ready(function() {
var editor = ace.edit("editor");
editor.setTheme("ace/theme/crimson_editor");
var CurentMode = require("ace/mode/buildout").Mode;
editor.getSession().setMode(new CurentMode());
editor.getSession().setTabSize(2);
editor.getSession().setUseSoftTabs(true);
editor.renderer.setHScrollBarAlwaysVisible(false);
$('#save').click(function(){
$('#editor_content').val(editor.getSession().getValue());
});
});
</script>
{% endif %}
<script src="{{ url_for('static', filename='jquery/jquery-1.6.2.min.js') }}" type="text/javascript" charset="utf-8"></script>
<script type=text/javascript>
$SCRIPT_ROOT = {{ request.script_root|tojson|safe }};
</script>
......
{% extends "layout.html" %}
{% block title %}Update instance profile{% endblock %}
{% block head %}
{{ super() }}
<script src="{{ url_for('static', filename='ace/ace-uncompressed.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/theme-crimson_editor.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/mode-buildout.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='scripts/editor.js') }}" type="text/javascript" charset="utf-8"></script>
{% endblock %}
{% block body %}
<form action="{{ url_for('updateInstanceProfile') }}" method=post class=add-entry>
<form method=post class=add-entry>
<dl>
<dd><h2>Instance Profile:</h2></dd>
<dd> <!--<textarea name=content rows=20 cols=103 id="editor">{{ profile }}</textarea>-->
<dd>
<div class="main_content">
<pre id="editor">
{{ profile }}
</pre>
<pre id="editor"></pre>
<input type="hidden" name="profile" id="profile" value="{{ profile|safe }}" />
</div>
<input type="hidden" name=content id="editor_content"/>
</dd>
......
{% extends "layout.html" %}
{% block title %}Update software profile{% endblock %}
{% block head %}
{{ super() }}
<script src="{{ url_for('static', filename='ace/ace-uncompressed.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/theme-crimson_editor.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='ace/mode-buildout.js') }}" type="text/javascript" charset="utf-8"></script>
<script src="{{ url_for('static', filename='scripts/editor.js') }}" type="text/javascript" charset="utf-8"></script>
{% endblock %}
{% block body %}
<form action="{{ url_for('updateSoftwareProfile') }}" method=post class=add-entry>
<form method=post class=add-entry>
<dl>
<dt><strong>Note:</strong> Url of instance.cfg is <tt>{{ instance_url }}</tt></dt>
<dd><h2>Software Profile:</h2></dd>
<dd> <!--<textarea name=content rows=20 cols=103 id="editor">{{ profile }}</textarea>-->
<dd>
<div class="main_content">
<pre id="editor">
{{ profile }}
</pre>
<pre id="editor"></pre>
</div>
<input type="hidden" value="{{ profile }}" name=content id="editor_content"/>
<input type="hidden" name="profile" id="profile" value="{{ profile|safe }}" />
</dd>
<dd><input type=submit value=Update id="save" class="button"></dd>
</dl>
......
......@@ -4,7 +4,7 @@ from utils import *
import os
import shutil
from gittools import cloneRepo, gitStatus, switchBranch, createBranch, getDiff, \
gitPush
gitPush, gitPull
app = Flask(__name__)
......@@ -27,7 +27,7 @@ def configRepo():
# software views
@app.route('/editSoftwareProfile')
def editSoftwareProfile():
profile = getProfile(app.config['runner_workdir'], app.config['software_profile'])
profile = getProfilePath(app.config['runner_workdir'], app.config['software_profile'])
if profile == "":
flash('Error: can not open profile, please select your project first')
return render_template('updateSoftwareProfile.html',
......@@ -75,17 +75,10 @@ def viewSoftwareLog():
return render_template('viewLog.html', type='Software',
result=result, running=isSoftwareRunning(app.config))
@app.route('/updateSoftwareProfile', methods=['POST'])
def updateSoftwareProfile():
profile = getProfilePath(app.config['runner_workdir'], app.config['software_profile'])
if profile != "":
open(profile, 'w').write(request.form['content'])
return redirect(url_for('editSoftwareProfile'))
# instance views
@app.route('/editInstanceProfile')
def editInstanceProfile():
profile = getProfile(app.config['runner_workdir'], app.config['instance_profile'])
profile = getProfilePath(app.config['runner_workdir'], app.config['instance_profile'])
if profile == "":
flash('Error: can not open instance profile for this Software Release')
return render_template('updateInstanceProfile.html',
......@@ -136,13 +129,6 @@ def viewInstanceLog():
return render_template('viewLog.html', type='Instance',
result=result, running=isInstanceRunning(app.config))
@app.route('/updateInstanceProfile', methods=['POST'])
def updateInstanceProfile():
profile = getProfilePath(app.config['runner_workdir'], app.config['instance_profile'])
if profile != "":
open(profile, 'w').write(request.form['content'])
return redirect(url_for('editInstanceProfile'))
@app.route('/stopAllPartition', methods=['GET'])
def stopAllPartition():
svcStopAll(app.config)
......@@ -287,4 +273,8 @@ def getProjectDiff(project):
@app.route("/pushProjectFiles", methods=['POST'])
def pushProjectFiles():
return gitPush(request.form['project'], request.form['msg'], False)
\ No newline at end of file
return gitPush(request.form['project'], request.form['msg'])
@app.route("/pullProjectFiles", methods=['POST'])
def pullProjectFiles():
return gitPull(request.form['project'])
\ No newline at end of file
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment