i.kologriv/playground
1
0
Fork 0
Code Issues Pull Requests 14 Actions Packages Projects Releases Wiki Activity

orders module: add auth, fix command injection, add requirements #13

Merged
testclient-admin merged 15 commits from feature/orders-module into main 2026-08-25 03:44:38 +00:00
Conversation 41 Commits 15 Files Changed 12
+7 -3
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1c392834d3 - Show all commits
orders.py
+7 -3
View File
@@ -80,12 +80,12 @@ class OrdersHandler(BaseHTTPRequestHandler):
else: else:
self.send_json_response(400, {"error": "Missing amount field"}) self.send_json_response(400, {"error": "Missing amount field"})
elif self.path == "/admin/backup": elif self.path == "/admin/backup":
if not getattr(self, "_user_id", None) == "admin":
self.send_json_response(403, {"error": "Forbidden - admin access required"})
return
if not self.check_auth(): if not self.check_auth():
self.send_json_response(401, {"error": "Unauthorized"}) self.send_json_response(401, {"error": "Unauthorized"})
return return
if not getattr(self, "_user_id", None) == "admin":
self.send_json_response(403, {"error": "Forbidden - admin access required"})
return
content_length = int(self.headers.get("Content-Length", 0)) content_length = int(self.headers.get("Content-Length", 0))
body = self.rfile.read(content_length).decode() body = self.rfile.read(content_length).decode()
data = json.loads(body) data = json.loads(body)
@@ -130,6 +130,10 @@ class OrdersHandler(BaseHTTPRequestHandler):
host = host.strip() host = host.strip()
if len(host) > 255: if len(host) > 255:
return None return None
if host.startswith('--'):
return None
if ' ' in host:
return None
ip_pattern = r'^(\d{1,3}\.){3}\d{1,3}$' ip_pattern = r'^(\d{1,3}\.){3}\d{1,3}$'
domain_pattern = r'^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$' domain_pattern = r'^([a-zA-Z0-9]([a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$'
if re.match(ip_pattern, host): if re.match(ip_pattern, host):