2017-03-27 Fred Gleason <fredg@paravelsystems.com>

* Added a 'WEBAPI_AUTHS' table to the database. * Added a 'USERS.WEBAPI_AUTH_TIMEOUT' field to the database. * Incremented the database version to 260. * Added 'RDUser::webapiAuthTimeout()' and 'RDUser::setWebapiAuthTimeout()' methods in 'lib/rduser.cpp' and 'lib/rduser.h'. * Added a 'WebAPI Timeout' control to the Edit User dialog in 'rdadmin/edit_user.cpp' and 'rdadmin/edit_user.h'. * Implemented a 'CreateTicket' Web API call.
2026-01-12 07:35:55 +01:00 · 2017-03-27 13:43:42 -04:00
parent 60a9deb349
commit bc2c441680
61 changed files with 602 additions and 639 deletions
--- a/web/rdxport/rdxport.cpp
+++ b/web/rdxport/rdxport.cpp
@@ -24,6 +24,7 @@
 #include <ctype.h>
 #include <stdlib.h>
 #include <stdio.h>
+#include <openssl/sha.h>

 #include <map>

@@ -32,6 +33,7 @@
 #include <qstringlist.h>

 #include <rddb.h>
+#include <rdescape_string.h>
 #include <rdweb.h>
 #include <rdformpost.h>
 #include <rdxport_interface.h>
@@ -278,6 +280,26 @@ bool Xport::Authenticate()
 {
  QString name;
  QString passwd;
+  QString ticket;
+  int command;
+  QString sql;
+  RDSqlQuery *q;
+  unsigned char rawstr[1024];
+  unsigned char sha1[SHA_DIGEST_LENGTH];
+
+  if(xport_post->getValue("TICKET",&ticket)) {
+    sql=QString("select LOGIN_NAME from WEBAPI_AUTHS where ")+
+      "(TICKET=\""+RDEscapeString(ticket)+"\")&&"+
+      "(IPV4_ADDRESS=\""+xport_post->clientAddress().toString()+"\")&&"+
+      "(EXPIRATION_DATETIME>now())";
+    q=new RDSqlQuery(sql);
+    if(q->first()) {
+      xport_user=new RDUser(q->value(0).toString());
+      delete q;
+      return true;
+    }
+    delete q;
+  }

  if(!xport_post->getValue("LOGIN_NAME",&name)) {
    return false;
@@ -286,8 +308,43 @@ bool Xport::Authenticate()
    return false;
  }
  xport_user=new RDUser(name);
+  if(!xport_user->checkPassword(passwd,false)) {
+    return false;
+  }

-  return xport_user->checkPassword(passwd,false);
+  if(xport_post->getValue("COMMAND",&command)) {
+    if(command==RDXPORT_COMMAND_CREATETICKET) {
+      QDateTime now=QDateTime::currentDateTime();
+      snprintf((char *)rawstr,1024,"%s %s %s",
+	       (const char *)now.toString("yyyy-MM-dd hh:mm:ss.zzz"),
+	       (const char *)name,
+	       (const char *)xport_post->clientAddress().toString());
+      SHA1(rawstr,strlen((char *)rawstr),sha1);
+      ticket="";
+      for(int i=0;i<SHA_DIGEST_LENGTH;i++) {
+	ticket+=QString().sprintf("%02x",0xFF&rawstr[i]);
+      }
+      sql=QString("insert into WEBAPI_AUTHS set ")+
+	"TICKET=\""+RDEscapeString(ticket)+"\","+
+	"LOGIN_NAME=\""+RDEscapeString(name)+"\","+
+	"IPV4_ADDRESS=\""+xport_post->clientAddress().toString()+"\","+
+	"EXPIRATION_DATETIME=\""+
+	now.addSecs(xport_user->webapiAuthTimeout()).
+	toString("yyyy-MM-dd hh:mm:ss")+"\"";
+      q=new RDSqlQuery(sql);
+      delete q;
+      printf("Content-type: application/xml\n\n");
+      printf("<?xml version=\"1.0\" encoding=\"UTF-8\" ?>\n");
+      printf("<ticketInfo>\n");
+      printf("  %s\n",(const char *)RDXmlField("ticket",ticket));
+      printf("  %s\n",(const char *)
+	  RDXmlField("expires",now.addSecs(xport_user->webapiAuthTimeout())));
+      printf("</ticketInfo>\n");
+      exit(0);
+    }
+  }
+
+  return true;
 }


--- a/web/tests/Makefile.am
+++ b/web/tests/Makefile.am
@@ -28,6 +28,7 @@ install-exec-am:
 	cp audioinfo.html $(DESTDIR)@libexecdir@
 	cp audiostore.html $(DESTDIR)@libexecdir@
 	cp copyaudio.html $(DESTDIR)@libexecdir@
+	cp createticket.html $(DESTDIR)@libexecdir@
 	cp delete_audio.html $(DESTDIR)@libexecdir@
 	cp deletelog.html $(DESTDIR)@libexecdir@
 	cp editcart.html $(DESTDIR)@libexecdir@
@@ -64,6 +65,7 @@ uninstall-local:
 	rm -f $(DESTDIR)@libexecdir@/audioinfo.html
 	rm -f $(DESTDIR)@libexecdir@/audiostore.html
 	rm -f $(DESTDIR)@libexecdir@/copyaudio.html
+	rm -f $(DESTDIR)@libexecdir@/createticket.html
 	rm -f $(DESTDIR)@libexecdir@/delete_audio.html
 	rm -f $(DESTDIR)@libexecdir@/deletelog.html
 	rm -f $(DESTDIR)@libexecdir@/editcart.html
@@ -98,6 +100,7 @@ EXTRA_DIST = addcart.html\
             audioinfo.html\
             audiostore.html\
             copyaudio.html\
+             createticket.html\
             delete_audio.html\
             deletelog.html\
             editcart.html\
--- a/web/tests/addcart.html
+++ b/web/tests/addcart.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">GROUP NAME:</td>
 <td><input type="text" name="GROUP_NAME" size="12" maxlength="10"></td>
 </tr>
--- a/web/tests/addcut.html
+++ b/web/tests/addcut.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/addlog.html
+++ b/web/tests/addlog.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">LOG NAME:</td>
 <td><input type="text" name="LOG_NAME" size="20" maxlength="64"></td>
 </tr>
--- a/web/tests/assignschedcode.html
+++ b/web/tests/assignschedcode.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/audioinfo.html
+++ b/web/tests/audioinfo.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/audiostore.html
+++ b/web/tests/audiostore.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td colspan="2" align="right">&nbsp;</td>
 </tr>
 <tr>
--- a/web/tests/copyaudio.html
+++ b/web/tests/copyaudio.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">SOURCE_CART NUMBER:</td>
 <td><input type="text" name="SOURCE_CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/createticket.html
+++ b/web/tests/createticket.html
@@ -0,0 +1,25 @@
+<html>
+<head>
+<title>Rivendell CREATETICKET Service Test Harness</title>
+<body>
+<form action="/rd-bin/rdxport.cgi" method="post" enctype="multipart/form-data">
+<input type="hidden" name="COMMAND" value="31">
+<table cellpadding="0" cellspacing="2" border="0">
+<tr>
+<td align="right">LOGIN NAME:</td>
+<td><input type="text" name="LOGIN_NAME" size="20" maxlength="255"></td>
+</tr>
+<tr>
+<td align="right">PASSWORD:</td>
+<td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
+</tr>
+<tr>
+<td colspan="2" align="right">&nbsp;</td>
+</tr>
+<tr>
+<td colspan="2" align="right"><input type="submit" value="OK"></td>
+</tr>
+</table>
+</form>
+</body>
+</html>
--- a/web/tests/delete_audio.html
+++ b/web/tests/delete_audio.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/deletelog.html
+++ b/web/tests/deletelog.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">LOG NAME:</td>
 <td><input type="text" name="LOG_NAME" size="20" maxlength="64"></td>
 </tr>
--- a/web/tests/editcart.html
+++ b/web/tests/editcart.html
@@ -21,6 +21,12 @@
 <td>&nbsp;</td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" id="TICKET" size="40" maxlength="40"></td>
+<td>&nbsp;</td>
+<td>&nbsp;</td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" id="CART_NUMBER" size="64" maxlength="255"></td>
 <td>&nbsp;</td>
--- a/web/tests/editcart.js
+++ b/web/tests/editcart.js
@@ -32,6 +32,7 @@ function EditCart_MakePost()
    var form='COMMAND=14';
    form+='&LOGIN_NAME='+document.getElementById("LOGIN_NAME").value;
    form+='&PASSWORD='+document.getElementById("PASSWORD").value;
+    form+='&TICKET='+document.getElementById("TICKET").value;
    form+='&CART_NUMBER='+document.getElementById("CART_NUMBER").value;
    if(document.getElementById("INCLUDE_CUTS").value.length==0) {
 	form+="&INCLUDE_CUTS=0";
--- a/web/tests/editcut.html
+++ b/web/tests/editcut.html
@@ -21,6 +21,12 @@
 <td>&nbsp;</td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" id="TICKET" size="40" maxlength="40"></td>
+<td>&nbsp;</td>
+<td>&nbsp;</td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" id="CART_NUMBER" size="8" maxlength="6"></td>
 <td>&nbsp;</td>
--- a/web/tests/editcut.js
+++ b/web/tests/editcut.js
@@ -32,6 +32,7 @@ function EditCut_MakePost()
    var form='COMMAND=15';
    form+='&LOGIN_NAME='+document.getElementById("LOGIN_NAME").value;
    form+='&PASSWORD='+document.getElementById("PASSWORD").value;
+    form+='&TICKET='+document.getElementById("TICKET").value;
    form+='&CART_NUMBER='+document.getElementById("CART_NUMBER").value;
    form+='&CUT_NUMBER='+document.getElementById("CUT_NUMBER").value;

--- a/web/tests/export.html
+++ b/web/tests/export.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/exportpeaks.html
+++ b/web/tests/exportpeaks.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/import.html
+++ b/web/tests/import.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/listcart.html
+++ b/web/tests/listcart.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="255"></td>
 </tr>
--- a/web/tests/listcarts.html
+++ b/web/tests/listcarts.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">GROUP NAME:</td>
 <td><input type="text" name="GROUP_NAME" size="20" maxlength="255"></td>
 </tr>
--- a/web/tests/listcartschedcodes.html
+++ b/web/tests/listcartschedcodes.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>
--- a/web/tests/listcut.html
+++ b/web/tests/listcut.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/listcuts.html
+++ b/web/tests/listcuts.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/listgroup.html
+++ b/web/tests/listgroup.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">GROUP NAME:</td>
 <td><input type="text" name="GROUP_NAME" size="20" maxlength="255"></td>
 </tr>
--- a/web/tests/listgroups.html
+++ b/web/tests/listgroups.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td colspan="2" align="right">&nbsp;</td>
 </tr>
 <tr>
--- a/web/tests/listlog.html
+++ b/web/tests/listlog.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">NAME:</td>
 <td><input type="text" name="NAME" size="20" maxlength="64"></td>
 </tr>
--- a/web/tests/listlogs.html
+++ b/web/tests/listlogs.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">SERVICE NAME:</td>
 <td><input type="text" name="SERVICE_NAME" size="20" maxlength="10"></td>
 </tr>
--- a/web/tests/listschedcodes.html
+++ b/web/tests/listschedcodes.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td colspan="2" align="right">&nbsp;</td>
 </tr>
 <tr>
--- a/web/tests/listservices.html
+++ b/web/tests/listservices.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">TRACKABLE:</td>
 <td><input type="text" name="TRACKABLE" size="2" maxlength="1"></td>
 </tr>
--- a/web/tests/removecart.html
+++ b/web/tests/removecart.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/removecut.html
+++ b/web/tests/removecut.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/savelog.html
+++ b/web/tests/savelog.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">LOG_NAME:</td>
 <td><input type="text" name="LOG_NAME" size="20" maxlength="64"></td>
 </tr>
--- a/web/tests/trimaudio.html
+++ b/web/tests/trimaudio.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="20" maxlength="6"></td>
 </tr>
--- a/web/tests/unassignschedcode.html
+++ b/web/tests/unassignschedcode.html
@@ -14,6 +14,10 @@
 <td><input type="password" name="PASSWORD" size="20" maxlength="32"></td>
 </tr>
 <tr>
+<td align="right">TICKET:</td>
+<td><input type="text" name="TICKET" size="40" maxlength="40"></td>
+</tr>
+<tr>
 <td align="right">CART NUMBER:</td>
 <td><input type="text" name="CART_NUMBER" size="8" maxlength="6"></td>
 </tr>