library/src/network/httpd/BP-HTTPdRequestHandlerHelpers.cc
// This function runs secure auth entry requests.  This is a rewrite of BP_HTTPD_REQUEST_HANDLER_SECURE_AUTH_ENTRY_SETUP_JSON.
This function runs secure auth entry requests.  This is a rewrite of BP_HTTPD_REQUEST_HANDLER_SECURE_AUTH_ENTRY_SETUP_JSON.
This function runs secure auth entry requests . This is a rewrite of BP_HTTPD_REQUEST_HANDLER_SECURE_AUTH_ENTRY_SETUP_JSON .
BP_ERROR_T BP_HTTPDRequestHandlerSecureAuthEntrySetupJSON
(
		void                          * request, 
		struct MHD_Connection *         connection,
		const char *                    url,
		const char *                    method,
		const char *                    version,
		const char *                    upload_data,
		size_t     *                    upload_data_size,
		void       **                   con_cls
)
{
	if(!request)
		return ERR_FAILURE;
	P_BP_HTTPD_REQUEST req = (P_BP_HTTPD_REQUEST) request;
	if(!req->httpd)
		return ERR_FAILURE;
	if(!connection)
		return ERR_FAILURE;
	if(!url)
		return ERR_FAILURE;
	if(!method)
		return ERR_FAILURE;
	if(!version)
		return ERR_FAILURE;
	BP_ZERO_STACK(req->params);
	req->params.connection       = connection;
	req->params.url              = url;
	req->params.method           = method;
	req->params.version          = version;
	req->params.upload_data      = upload_data;
	req->params.upload_data_size = upload_data_size;
	req->params.con_cls          = con_cls;
    req->json_output = BP_JSONCreate();
    if(!req->json_output)
	{
    	BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"no_json_object_could_be_created\"\n}");
	}
	req->xsrf_checks_passed_ok = BP_FALSE;
	char * xsrf_var = "xsrf";
	P_BP_HTTPD_REQUEST_VAR xsrf_key_var = BP_HTTPdRequestVarArgRegistryLookup(req, BP_HTTPD_REQUEST_VAR_TYPE_GET, (char *) xsrf_var);
	if(!xsrf_key_var)
		xsrf_key_var = BP_HTTPdRequestVarArgRegistryLookup(req, BP_HTTPD_REQUEST_VAR_TYPE_POST_DATA, (char *) xsrf_var);
	req->xsrf_checks_passed_ok = BP_TRUE;
	if(!xsrf_key_var)
	{
		req->xsrf_checks_passed_ok = BP_FALSE;
	}
	if(req->xsrf_checks_passed_ok)
	{
		if(!BP_StringIsReasonablePrintableString(xsrf_key_var->data, xsrf_key_var->data_size, BP_FALSE, BP_FALSE))
		{
			req->xsrf_checks_passed_ok = BP_FALSE;
		}
	}
	if(req->xsrf_checks_passed_ok)
	{
		if(!BP_HTTPdSessionXSRFTokenLookup((P_BP_HTTPD_USER_SESSION) req->session, (char *) xsrf_key_var->data))
		{
			req->xsrf_checks_passed_ok = BP_FALSE;
		}
	}
	P_BP_HTTPD_REQUEST_VAR logout_var = __POST(req, "logout");
	if(logout_var && req->xsrf_checks_passed_ok)
	{
		if(req->session)
		{
			BP_HTTPdSessionDestroy(req->httpd, (P_BP_HTTPD_USER_SESSION) req->session);
			req->session = NULL;
		}
		BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"logged_out\"\n}");
	}
	P_BP_HTTPD_REQUEST_VAR user_var = __POST(req, "lu");
	P_BP_HTTPD_REQUEST_VAR pass_var = __POST(req, "lp");
	if(user_var && pass_var && req->xsrf_checks_passed_ok)
	{
		if(user_var && pass_var)
		{
			if(req->session)
			{
				BP_HTTPdSessionDestroy(req->httpd, (P_BP_HTTPD_USER_SESSION) req->session);
				req->session = NULL;
			}
			req->session = BP_HTTPdSessionAuthUserFromCreds
			(
				req->httpd,
				user_var->data,
				pass_var->data
			);
			if(!req->session)
			{
				BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"bad_auth\"\n}");
			}
		}
	}
	char *api_key_name = "api_key";
	if(!req->session)
	{
		P_BP_HTTPD_REQUEST_VAR api_key_var = BP_HTTPdRequestVarArgRegistryLookup(req, BP_HTTPD_REQUEST_VAR_TYPE_GET, (char *) api_key_name);
		if(api_key_var)
		{
			if(!BP_StringIsReasonablePrintableString(api_key_var->data, api_key_var->data_size, BP_FALSE, BP_FALSE))
			{
				BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"api_invalid_auth\"\n}");
			}
			P_BP_HTTPD_API_KEY api_key_lookup = BP_HTTPdSessionLookupAPIKeyByIdentifier
			(
				req->httpd,
				api_key_var->data
			);
			if(!api_key_lookup && !req->session)
			{
				BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"api_bad_key\"\n}");
			}
			if(!req->session && api_key_lookup)
			{
				req->session               =   api_key_lookup->user_session;
				P_BP_HTTPD_USER_SESSION tmp_session = (P_BP_HTTPD_USER_SESSION) api_key_lookup->user_session;
				tmp_session->type                   =   BP_HTTPD_USER_SESSION_TYPE_AUTHENTICATED_API_KEY;
			}
		}
	}
	if(!req->session)
	{
			req->session = (void *) BP_HTTPdSessionCreateAnonymousGuest(req->httpd);
			if(!req->session)
			{
				BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"bad_anon_guest_auth\"\n}");
			}
	}
	if(!req->session)
	{
		BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"no_session\"\n}");
	}
	if(BP_HTTPdSessionExpired((P_BP_HTTPD_USER_SESSION) req->session))
	{
		BP_HTTPdSessionDestroy(req->httpd, (P_BP_HTTPD_USER_SESSION) req->session);
		req->session = NULL;
		BP_HTTPD_CHECK_LOGIN   (req);
		BP_HTTPD_CHECK_API_AUTH(req, "api_key");
		if(!req->session)
		{
			BP_HTTPdRequestHandlerRespondJSONFromStaticText(req, ERR_FAILURE, "{\n\t\"auth\": \"no_session\"\n}");
		}
	}
	return ERR_SUCCESS;
}
BP_ERROR_T BP_HTTPDRequestHandlerSecureAuthEntrySetupJSON ( void * request , struct MHD_Connection * connection , const char * url , const char * method , const char * version , const char * upload_data , size_t * upload_data_size , void * * con_cls ) { if ( ! request ) return ERR_FAILURE ; P_BP_HTTPD_REQUEST req = ( P_BP_HTTPD_REQUEST ) request ; if ( ! req -> httpd ) return ERR_FAILURE ; if ( ! connection ) return ERR_FAILURE ; if ( ! url ) return ERR_FAILURE ; if ( ! method ) return ERR_FAILURE ; if ( ! version ) return ERR_FAILURE ; BP_ZERO_STACK ( req -> params ) ; req -> params . connection = connection ; req -> params . url = url ; req -> params . method = method ; req -> params . version = version ; req -> params . upload_data = upload_data ; req -> params . upload_data_size = upload_data_size ; req -> params . con_cls = con_cls ; req -> json_output = BP_JSONCreate ( ) ; if ( ! req -> json_output ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } req -> xsrf_checks_passed_ok = BP_FALSE ; char * xsrf_var = " " ; P_BP_HTTPD_REQUEST_VAR xsrf_key_var = BP_HTTPdRequestVarArgRegistryLookup ( req , BP_HTTPD_REQUEST_VAR_TYPE_GET , ( char * ) xsrf_var ) ; if ( ! xsrf_key_var ) xsrf_key_var = BP_HTTPdRequestVarArgRegistryLookup ( req , BP_HTTPD_REQUEST_VAR_TYPE_POST_DATA , ( char * ) xsrf_var ) ; req -> xsrf_checks_passed_ok = BP_TRUE ; if ( ! xsrf_key_var ) { req -> xsrf_checks_passed_ok = BP_FALSE ; } if ( req -> xsrf_checks_passed_ok ) { if ( ! BP_StringIsReasonablePrintableString ( xsrf_key_var -> data , xsrf_key_var -> data_size , BP_FALSE , BP_FALSE ) ) { req -> xsrf_checks_passed_ok = BP_FALSE ; } } if ( req -> xsrf_checks_passed_ok ) { if ( ! BP_HTTPdSessionXSRFTokenLookup ( ( P_BP_HTTPD_USER_SESSION ) req -> session , ( char * ) xsrf_key_var -> data ) ) { req -> xsrf_checks_passed_ok = BP_FALSE ; } } P_BP_HTTPD_REQUEST_VAR logout_var = __POST ( req , " " ) ; if ( logout_var && req -> xsrf_checks_passed_ok ) { if ( req -> session ) { BP_HTTPdSessionDestroy ( req -> httpd , ( P_BP_HTTPD_USER_SESSION ) req -> session ) ; req -> session = NULL ; } BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } P_BP_HTTPD_REQUEST_VAR user_var = __POST ( req , " " ) ; P_BP_HTTPD_REQUEST_VAR pass_var = __POST ( req , " " ) ; if ( user_var && pass_var && req -> xsrf_checks_passed_ok ) { if ( user_var && pass_var ) { if ( req -> session ) { BP_HTTPdSessionDestroy ( req -> httpd , ( P_BP_HTTPD_USER_SESSION ) req -> session ) ; req -> session = NULL ; } req -> session = BP_HTTPdSessionAuthUserFromCreds ( req -> httpd , user_var -> data , pass_var -> data ) ; if ( ! req -> session ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } } } char * api_key_name = " " ; if ( ! req -> session ) { P_BP_HTTPD_REQUEST_VAR api_key_var = BP_HTTPdRequestVarArgRegistryLookup ( req , BP_HTTPD_REQUEST_VAR_TYPE_GET , ( char * ) api_key_name ) ; if ( api_key_var ) { if ( ! BP_StringIsReasonablePrintableString ( api_key_var -> data , api_key_var -> data_size , BP_FALSE , BP_FALSE ) ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } P_BP_HTTPD_API_KEY api_key_lookup = BP_HTTPdSessionLookupAPIKeyByIdentifier ( req -> httpd , api_key_var -> data ) ; if ( ! api_key_lookup && ! req -> session ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } if ( ! req -> session && api_key_lookup ) { req -> session = api_key_lookup -> user_session ; P_BP_HTTPD_USER_SESSION tmp_session = ( P_BP_HTTPD_USER_SESSION ) api_key_lookup -> user_session ; tmp_session -> type = BP_HTTPD_USER_SESSION_TYPE_AUTHENTICATED_API_KEY ; } } } if ( ! req -> session ) { req -> session = ( void * ) BP_HTTPdSessionCreateAnonymousGuest ( req -> httpd ) ; if ( ! req -> session ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } } if ( ! req -> session ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } if ( BP_HTTPdSessionExpired ( ( P_BP_HTTPD_USER_SESSION ) req -> session ) ) { BP_HTTPdSessionDestroy ( req -> httpd , ( P_BP_HTTPD_USER_SESSION ) req -> session ) ; req -> session = NULL ; BP_HTTPD_CHECK_LOGIN ( req ) ; BP_HTTPD_CHECK_API_AUTH ( req , " " ) ; if ( ! req -> session ) { BP_HTTPdRequestHandlerRespondJSONFromStaticText ( req , ERR_FAILURE , " \n \t \" \" \" \" \n " ) ; } } return ERR_SUCCESS ; }
This function runs secure auth entry requests.
This function runs secure auth entry requests .
/* P_BP_HTTPD_REQUEST */ // ensure we have a request parameter // convert type so we can have an easier time using it // ensure we have an attached httpd // ensure we have a connection // ensure we have a url // ensure we have a HTTP method // ensure we have a HTTP version // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Set Request Handler Parameters %%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // zero out the parameters buffer within the request (static sized) // set parameters directly, do not copy or modify these values, they are // here for reference use only. // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Init JSON For Request and Run JSON Checks %%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // attempt to create the JSON output // ensure we have an output managment structure // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run XSRF Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // override check pass token // attempt to get the xsrf key var from either GET or POST // set default check value to true, it will be disqualified below if necessary // if there is no key var // if the token hasn't been disqualified yet, check to ensure it's reasonable/printable // if the checks were passed ok // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run Logout Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // attampt to run logout checks // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run U/P Login Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // attempt to run login checks // if we have a user and pass var // ensure we have a user var and a pass var // destroy session if it exists // attempt to authenticate the user from creds if they're passed in // if we are unable to create our session from user creds, exit immediately // send bad auth message // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run API Auth Login Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Create Anon Session if All Other Session Creation Fails %%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // if we have no session, attempt to create an anonymous guest session // send bad anon guest message // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%% Run Session Checks %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% // ensure we have a session // return indicating success