mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

Merge remote-tracking branch 'origin/master' into advanced-permissions-phase-2

Просмотр исходного кода
Этот коммит содержится в:
Martin Kraft
2018-05-15 07:45:28 -04:00
родитель 51bd710ecd a1656dffa9
Коммит f82cc7896d
29 изменённых файлов: 1307 добавлений и 909 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

131
api/user.go
Просмотреть файл

@@ -4,11 +4,9 @@
package api
import (
b64 "encoding/base64"
"fmt"
"net/http"
"strconv"
"strings"
"time"
"github.com/gorilla/mux"
@@ -62,9 +60,6 @@ func (api *API) InitUser() {
api.BaseRoutes.NeedUser.Handle("/audits", api.ApiUserRequired(getAudits)).Methods("GET")
api.BaseRoutes.NeedUser.Handle("/image", api.ApiUserRequiredTrustRequester(getProfileImage)).Methods("GET")
api.BaseRoutes.NeedUser.Handle("/update_roles", api.ApiUserRequired(updateRoles)).Methods("POST")
api.BaseRoutes.Root.Handle("/login/sso/saml", api.AppHandlerIndependent(loginWithSaml)).Methods("GET")
api.BaseRoutes.Root.Handle("/login/sso/saml", api.AppHandlerIndependent(completeSaml)).Methods("POST")
}
func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -1080,132 +1075,6 @@ func checkMfa(c *Context, w http.ResponseWriter, r *http.Request) {
w.Write([]byte(model.MapToJson(rdata)))
}
func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
samlInterface := c.App.Saml
if samlInterface == nil {
c.Err = model.NewAppError("loginWithSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
return
}
teamId, err := c.App.GetTeamIdFromQuery(r.URL.Query())
if err != nil {
c.Err = err
return
}
action := r.URL.Query().Get("action")
redirectTo := r.URL.Query().Get("redirect_to")
relayProps := map[string]string{}
relayState := ""
if len(action) != 0 {
relayProps["team_id"] = teamId
relayProps["action"] = action
if action == model.OAUTH_ACTION_EMAIL_TO_SSO {
relayProps["email"] = r.URL.Query().Get("email")
}
}
if len(redirectTo) != 0 {
relayProps["redirect_to"] = redirectTo
}
if len(relayProps) > 0 {
relayState = b64.StdEncoding.EncodeToString([]byte(model.MapToJson(relayProps)))
}
if data, err := samlInterface.BuildRequest(relayState); err != nil {
c.Err = err
return
} else {
w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
http.Redirect(w, r, data.URL, http.StatusFound)
}
}
func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
samlInterface := c.App.Saml
if samlInterface == nil {
c.Err = model.NewAppError("completeSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
return
}
//Validate that the user is with SAML and all that
encodedXML := r.FormValue("SAMLResponse")
relayState := r.FormValue("RelayState")
relayProps := make(map[string]string)
if len(relayState) > 0 {
stateStr := ""
if b, err := b64.StdEncoding.DecodeString(relayState); err != nil {
c.Err = model.NewAppError("completeSaml", "api.user.authorize_oauth_user.invalid_state.app_error", nil, err.Error(), http.StatusFound)
return
} else {
stateStr = string(b)
}
relayProps = model.MapFromJson(strings.NewReader(stateStr))
}
action := relayProps["action"]
if user, err := samlInterface.DoLogin(encodedXML, relayProps); err != nil {
if action == model.OAUTH_ACTION_MOBILE {
err.Translate(c.T)
w.Write([]byte(err.ToJson()))
} else {
c.Err = err
c.Err.StatusCode = http.StatusFound
}
return
} else {
if err := c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
c.Err = err
c.Err.StatusCode = http.StatusFound
return
}
switch action {
case model.OAUTH_ACTION_SIGNUP:
teamId := relayProps["team_id"]
if len(teamId) > 0 {
c.App.Go(func() {
if err := c.App.AddUserToTeamByTeamId(teamId, user); err != nil {
mlog.Error(err.Error())
} else {
c.App.AddDirectChannels(teamId, user)
}
})
}
case model.OAUTH_ACTION_EMAIL_TO_SSO:
if err := c.App.RevokeAllSessions(user.Id); err != nil {
c.Err = err
return
}
c.LogAuditWithUserId(user.Id, "Revoked all sessions for user")
c.App.Go(func() {
if err := c.App.SendSignInChangeEmail(user.Email, strings.Title(model.USER_AUTH_SERVICE_SAML)+" SSO", user.Locale, c.App.GetSiteURL()); err != nil {
mlog.Error(err.Error())
}
})
}
doLogin(c, w, r, user, "")
if c.Err != nil {
return
}
if val, ok := relayProps["redirect_to"]; ok {
http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
return
}
if action == model.OAUTH_ACTION_MOBILE {
ReturnStatusOK(w)
} else {
http.Redirect(w, r, app.GetProtocol(r)+"://"+r.Host, http.StatusFound)
}
}
}
func sanitizeProfile(c *Context, user *model.User) *model.User {
options := c.App.Config().GetSanitizeOptions()

154
api/webhook_test.go
Просмотреть файл

@@ -4,8 +4,6 @@
package api
import (
"fmt"
"net/http"
"testing"
"github.com/mattermost/mattermost-server/model"
@@ -968,155 +966,3 @@ func TestRegenOutgoingHookToken(t *testing.T) {
t.Fatal("should have errored - webhooks turned off")
}
}
func TestIncomingWebhooks(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer th.TearDown()
Client := th.SystemAdminClient
team := th.SystemAdminTeam
channel1 := th.CreateChannel(Client, team)
user2 := th.CreateUser(Client)
th.LinkUserToTeam(user2, team)
th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = true })
hook := &model.IncomingWebhook{ChannelId: channel1.Id}
hook = Client.Must(Client.CreateIncomingWebhook(hook)).Data.(*model.IncomingWebhook)
url := "/hooks/" + hook.Id
text := `this is a \"test\"
that contains a newline and a tab`
if _, err := Client.DoPost(url, "{\"text\":\"this is a test\"}", "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, "{\"text\":\""+text+"\"}", "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", channel1.Name), "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"#%s\"}", channel1.Name), "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"@%s\"}", user2.Username), "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, "payload={\"text\":\"this is a test\"}", "application/x-www-form-urlencoded"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, "payload={\"text\":\""+text+"\"}", "application/x-www-form-urlencoded"); err != nil {
t.Fatal(err)
}
if _, err := th.BasicClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DEFAULT_CHANNEL), "application/json"); err != nil {
t.Fatal("should not have failed -- ExperimentalTownSquareIsReadOnly is false and it's not a read only channel")
}
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
th.App.SetLicense(model.NewTestLicense())
if _, err := th.BasicClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DEFAULT_CHANNEL), "application/json"); err == nil {
t.Fatal("should have failed -- ExperimentalTownSquareIsReadOnly is true and it's a read only channel")
}
attachmentPayload := `{
"text": "this is a test",
"attachments": [
{
"fallback": "Required plain-text summary of the attachment.",
"color": "#36a64f",
"pretext": "Optional text that appears above the attachment block",
"author_name": "Bobby Tables",
"author_link": "http://flickr.com/bobby/",
"author_icon": "http://flickr.com/icons/bobby.jpg",
"title": "Slack API Documentation",
"title_link": "https://api.slack.com/",
"text": "Optional text that appears within the attachment",
"fields": [
{
"title": "Priority",
"value": "High",
"short": false
}
],
"image_url": "http://my-website.com/path/to/image.jpg",
"thumb_url": "http://example.com/path/to/thumb.png"
}
]
}`
if _, err := Client.DoPost(url, attachmentPayload, "application/json"); err != nil {
t.Fatal(err)
}
if _, err := Client.DoPost(url, "{\"text\":\"\"}", "application/json"); err == nil || err.StatusCode != http.StatusBadRequest {
t.Fatal("should have failed - no text")
}
tooLongText := ""
for i := 0; i < 8200; i++ {
tooLongText += "a"
}
if _, err := Client.DoPost(url, "{\"text\":\""+tooLongText+"\"}", "application/json"); err != nil {
t.Fatal(err)
}
attachmentPayload = `{
"text": "this is a test",
"attachments": [
{
"fallback": "Required plain-text summary of the attachment.",
"color": "#36a64f",
"pretext": "Optional text that appears above the attachment block",
"author_name": "Bobby Tables",
"author_link": "http://flickr.com/bobby/",
"author_icon": "http://flickr.com/icons/bobby.jpg",
"title": "Slack API Documentation",
"title_link": "https://api.slack.com/",
"text": "` + tooLongText + `",
"fields": [
{
"title": "Priority",
"value": "High",
"short": false
}
],
"image_url": "http://my-website.com/path/to/image.jpg",
"thumb_url": "http://example.com/path/to/thumb.png"
}
]
}`
if _, err := Client.DoPost(url, attachmentPayload, "application/json"); err != nil {
t.Fatal(err)
}
th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = false })
if _, err := Client.DoPost(url, "{\"text\":\"this is a test\"}", "application/json"); err == nil {
t.Fatal("should have failed - webhooks turned off")
}
}

22
api4/api.go
Просмотреть файл

@@ -4,14 +4,12 @@
package api4
import (
"fmt"
"net/http"
"github.com/gorilla/mux"
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
"github.com/mattermost/mattermost-server/utils"
"github.com/mattermost/mattermost-server/web"
_ "github.com/nicksnyder/go-i18n/i18n"
)
@@ -234,7 +232,7 @@ func Init(a *app.App, root *mux.Router, full bool) *API {
api.InitScheme()
api.InitImage()
root.Handle("/api/v4/{anything:.*}", http.HandlerFunc(Handle404))
root.Handle("/api/v4/{anything:.*}", http.HandlerFunc(api.Handle404))
// REMOVE CONDITION WHEN APIv3 REMOVED
if full {
@@ -244,18 +242,8 @@ func Init(a *app.App, root *mux.Router, full bool) *API {
return api
}
func Handle404(w http.ResponseWriter, r *http.Request) {
err := model.NewAppError("Handle404", "api.context.404.app_error", nil, "", http.StatusNotFound)
mlog.Debug(fmt.Sprintf("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r)))
w.WriteHeader(err.StatusCode)
err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'."
w.Write([]byte(err.ToJson()))
func (api *API) Handle404(w http.ResponseWriter, r *http.Request) {
web.Handle404(api.App, w, r)
}
func ReturnStatusOK(w http.ResponseWriter) {
m := make(map[string]string)
m[model.STATUS] = model.STATUS_OK
w.Write([]byte(model.MapToJson(m)))
}
var ReturnStatusOK = web.ReturnStatusOK

2
api4/apitestlib.go
Просмотреть файл

@@ -26,6 +26,7 @@ import (
"github.com/mattermost/mattermost-server/store/sqlstore"
"github.com/mattermost/mattermost-server/store/storetest"
"github.com/mattermost/mattermost-server/utils"
"github.com/mattermost/mattermost-server/web"
"github.com/mattermost/mattermost-server/wsapi"
s3 "github.com/minio/minio-go"
@@ -120,6 +121,7 @@ func setupTestHelper(enterprise bool) *TestHelper {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ListenAddress = prevListenAddress })
Init(th.App, th.App.Srv.Router, true)
web.NewWeb(th.App, th.App.Srv.Router)
wsapi.Init(th.App, th.App.Srv.WebSocketRouter)
th.App.Srv.Store.MarkSystemRanUnitTests()
th.App.DoAdvancedPermissionsMigration()

191
api4/command_test.go
Просмотреть файл

@@ -5,9 +5,13 @@ package api4
import (
"fmt"
"strings"
"net/http"
"net/http/httptest"
"net/url"
"testing"
"github.com/stretchr/testify/require"
"github.com/mattermost/mattermost-server/model"
)
@@ -392,7 +396,7 @@ func TestRegenToken(t *testing.T) {
}
}
func TestExecuteCommand(t *testing.T) {
func TestExecuteInvalidCommand(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer th.TearDown()
Client := th.Client
@@ -407,56 +411,19 @@ func TestExecuteCommand(t *testing.T) {
})
}()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableCommands = true })
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.AllowedUntrustedInternalConnections = "localhost" })
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.AllowedUntrustedInternalConnections = "127.0.0.0/8" })
postCmd := &model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: fmt.Sprintf("http://localhost:%v", th.App.Srv.ListenAddr.Port) + model.API_URL_SUFFIX_V4 + "/teams/command_test",
Method: model.COMMAND_METHOD_POST,
Trigger: "postcommand",
}
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
rc := &model.CommandResponse{}
if _, err := th.App.CreateCommand(postCmd); err != nil {
t.Fatal("failed to create post command")
}
commandResponse, resp := Client.ExecuteCommand(channel.Id, "/postcommand")
CheckNoError(t, resp)
if commandResponse == nil {
t.Fatal("command response should have returned")
}
posts, err := th.App.GetPostsPage(channel.Id, 0, 10)
if err != nil || posts == nil || len(posts.Order) != 3 {
t.Fatal("Test command failed to send")
}
cmdPosted := false
for _, post := range posts.Posts {
if strings.Contains(post.Message, "test command response") {
if post.Type != "custom_test" {
t.Fatal("wrong type set in slash command post")
}
if post.Props["someprop"] != "somevalue" {
t.Fatal("wrong prop set in slash command post")
}
cmdPosted = true
break
}
}
if !cmdPosted {
t.Fatal("Test command response failed to post")
}
w.Write([]byte(rc.ToJson()))
}))
defer ts.Close()
getCmd := &model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: fmt.Sprintf("http://localhost:%v", th.App.Srv.ListenAddr.Port) + model.API_URL_SUFFIX_V4 + "/teams/command_test",
URL: fmt.Sprintf("%s/%s/teams/command_test", ts.URL, model.API_URL_SUFFIX_V4),
Method: model.COMMAND_METHOD_GET,
Trigger: "getcommand",
}
@@ -465,19 +432,7 @@ func TestExecuteCommand(t *testing.T) {
t.Fatal("failed to create get command")
}
commandResponse, resp = Client.ExecuteCommand(channel.Id, "/getcommand")
CheckNoError(t, resp)
if commandResponse == nil {
t.Fatal("command response should have returned")
}
posts, err = th.App.GetPostsPage(channel.Id, 0, 10)
if err != nil || posts == nil || len(posts.Order) != 4 {
t.Fatal("Test command failed to send")
}
_, resp = Client.ExecuteCommand(channel.Id, "")
_, resp := Client.ExecuteCommand(channel.Id, "")
CheckBadRequestStatus(t, resp)
_, resp = Client.ExecuteCommand(channel.Id, "/")
@@ -504,6 +459,124 @@ func TestExecuteCommand(t *testing.T) {
CheckNoError(t, resp)
}
func TestExecuteGetCommand(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer th.TearDown()
Client := th.Client
channel := th.BasicChannel
enableCommands := *th.App.Config().ServiceSettings.EnableCommands
allowedInternalConnections := *th.App.Config().ServiceSettings.AllowedUntrustedInternalConnections
defer func() {
th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableCommands = &enableCommands })
th.App.UpdateConfig(func(cfg *model.Config) {
cfg.ServiceSettings.AllowedUntrustedInternalConnections = &allowedInternalConnections
})
}()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableCommands = true })
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.AllowedUntrustedInternalConnections = "127.0.0.0/8" })
token := model.NewId()
expectedCommandResponse := &model.CommandResponse{
Text: "test get command response",
ResponseType: model.COMMAND_RESPONSE_TYPE_IN_CHANNEL,
Type: "custom_test",
Props: map[string]interface{}{"someprop": "somevalue"},
}
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
require.Equal(t, http.MethodGet, r.Method)
values, err := url.ParseQuery(r.URL.RawQuery)
require.NoError(t, err)
require.Equal(t, token, values.Get("token"))
require.Equal(t, th.BasicTeam.Name, values.Get("team_domain"))
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(expectedCommandResponse.ToJson()))
}))
defer ts.Close()
getCmd := &model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: fmt.Sprintf("%s/%s/teams/command_test", ts.URL, model.API_URL_SUFFIX_V4),
Method: model.COMMAND_METHOD_GET,
Trigger: "getcommand",
Token: token,
}
if _, err := th.App.CreateCommand(getCmd); err != nil {
t.Fatal("failed to create get command")
}
commandResponse, resp := Client.ExecuteCommand(channel.Id, "/getcommand")
CheckNoError(t, resp)
expectedCommandResponse.Props["from_webhook"] = "true"
require.Equal(t, expectedCommandResponse, commandResponse)
}
func TestExecutePostCommand(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer th.TearDown()
Client := th.Client
channel := th.BasicChannel
enableCommands := *th.App.Config().ServiceSettings.EnableCommands
allowedInternalConnections := *th.App.Config().ServiceSettings.AllowedUntrustedInternalConnections
defer func() {
th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableCommands = &enableCommands })
th.App.UpdateConfig(func(cfg *model.Config) {
cfg.ServiceSettings.AllowedUntrustedInternalConnections = &allowedInternalConnections
})
}()
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableCommands = true })
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.AllowedUntrustedInternalConnections = "127.0.0.0/8" })
token := model.NewId()
expectedCommandResponse := &model.CommandResponse{
Text: "test post command response",
ResponseType: model.COMMAND_RESPONSE_TYPE_IN_CHANNEL,
Type: "custom_test",
Props: map[string]interface{}{"someprop": "somevalue"},
}
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
require.Equal(t, http.MethodPost, r.Method)
r.ParseForm()
require.Equal(t, token, r.FormValue("token"))
require.Equal(t, th.BasicTeam.Name, r.FormValue("team_domain"))
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(expectedCommandResponse.ToJson()))
}))
defer ts.Close()
getCmd := &model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: fmt.Sprintf("%s/%s/teams/command_test", ts.URL, model.API_URL_SUFFIX_V4),
Method: model.COMMAND_METHOD_POST,
Trigger: "postcommand",
Token: token,
}
if _, err := th.App.CreateCommand(getCmd); err != nil {
t.Fatal("failed to create get command")
}
commandResponse, resp := Client.ExecuteCommand(channel.Id, "/postcommand")
CheckNoError(t, resp)
expectedCommandResponse.Props["from_webhook"] = "true"
require.Equal(t, expectedCommandResponse, commandResponse)
}
func TestExecuteCommandAgainstChannelOnAnotherTeam(t *testing.T) {
th := Setup().InitBasic()
defer th.TearDown()

3
api4/emoji.go
Просмотреть файл

@@ -9,6 +9,7 @@ import (
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/model"
"github.com/mattermost/mattermost-server/web"
)
const (
@@ -197,7 +198,7 @@ func searchEmojis(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
emojis, err := c.App.SearchEmoji(emojiSearch.Term, emojiSearch.PrefixOnly, PER_PAGE_MAXIMUM)
emojis, err := c.App.SearchEmoji(emojiSearch.Term, emojiSearch.PrefixOnly, web.PER_PAGE_MAXIMUM)
if err != nil {
c.Err = err
return

67
api4/handlers.go Обычный файл
Просмотреть файл

@@ -0,0 +1,67 @@
// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/web"
)
type Context = web.Context
func (api *API) ApiHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &web.Handler{
App: api.App,
HandleFunc: h,
RequireSession: false,
TrustRequester: false,
RequireMfa: false,
IsStatic: false,
}
}
func (api *API) ApiSessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &web.Handler{
App: api.App,
HandleFunc: h,
RequireSession: true,
TrustRequester: false,
RequireMfa: true,
IsStatic: false,
}
}
func (api *API) ApiSessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &web.Handler{
App: api.App,
HandleFunc: h,
RequireSession: true,
TrustRequester: false,
RequireMfa: false,
IsStatic: false,
}
}
func (api *API) ApiHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &web.Handler{
App: api.App,
HandleFunc: h,
RequireSession: false,
TrustRequester: true,
RequireMfa: false,
IsStatic: false,
}
}
func (api *API) ApiSessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &web.Handler{
App: api.App,
HandleFunc: h,
RequireSession: true,
TrustRequester: true,
RequireMfa: true,
IsStatic: false,
}
}

91
api4/webhook.go
Просмотреть файл

@@ -4,14 +4,8 @@
package api4
import (
"fmt"
"io"
"net/http"
"strings"
"github.com/gorilla/mux"
"github.com/gorilla/schema"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
)
@@ -28,12 +22,6 @@ func (api *API) InitWebhook() {
api.BaseRoutes.OutgoingHook.Handle("", api.ApiSessionRequired(updateOutgoingHook)).Methods("PUT")
api.BaseRoutes.OutgoingHook.Handle("", api.ApiSessionRequired(deleteOutgoingHook)).Methods("DELETE")
api.BaseRoutes.OutgoingHook.Handle("/regen_token", api.ApiSessionRequired(regenOutgoingHookToken)).Methods("POST")
api.BaseRoutes.Root.Handle("/hooks/commands/{id:[A-Za-z0-9]+}", api.ApiHandler(commandWebhook)).Methods("POST")
api.BaseRoutes.Root.Handle("/hooks/{id:[A-Za-z0-9]+}", api.ApiHandler(incomingWebhook)).Methods("POST")
// Old endpoint for backwards compatibility
api.BaseRoutes.Root.Handle("/api/v3/teams/{team_id:[A-Za-z0-9]+}/hooks/{id:[A-Za-z0-9]+}", api.ApiHandler(incomingWebhook)).Methods("POST")
}
func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -454,82 +442,3 @@ func deleteOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
c.LogAudit("success")
ReturnStatusOK(w)
}
func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
params := mux.Vars(r)
id := params["id"]
r.ParseForm()
var err *model.AppError
incomingWebhookPayload := &model.IncomingWebhookRequest{}
contentType := r.Header.Get("Content-Type")
if strings.Split(contentType, "; ")[0] == "application/x-www-form-urlencoded" {
payload := strings.NewReader(r.FormValue("payload"))
incomingWebhookPayload, err = decodePayload(payload)
if err != nil {
c.Err = err
return
}
} else if strings.HasPrefix(contentType, "multipart/form-data") {
r.ParseMultipartForm(0)
decoder := schema.NewDecoder()
err := decoder.Decode(incomingWebhookPayload, r.PostForm)
if err != nil {
c.Err = model.NewAppError("incomingWebhook", "api.webhook.incoming.error", nil, err.Error(), http.StatusBadRequest)
return
}
} else {
incomingWebhookPayload, err = decodePayload(r.Body)
if err != nil {
c.Err = err
return
}
}
if c.App.Config().LogSettings.EnableWebhookDebugging {
mlog.Debug(fmt.Sprint("Incoming webhook received. Content=", incomingWebhookPayload.ToJson()))
}
err = c.App.HandleIncomingWebhook(id, incomingWebhookPayload)
if err != nil {
c.Err = err
return
}
w.Header().Set("Content-Type", "text/plain")
w.Write([]byte("ok"))
}
func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
params := mux.Vars(r)
id := params["id"]
response, err := model.CommandResponseFromHTTPBody(r.Header.Get("Content-Type"), r.Body)
if err != nil {
c.Err = model.NewAppError("commandWebhook", "web.command_webhook.parse.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
appErr := c.App.HandleCommandWebhook(id, response)
if appErr != nil {
c.Err = appErr
return
}
w.Header().Set("Content-Type", "text/plain")
w.Write([]byte("ok"))
}
func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) {
incomingWebhookPayload, decodeError := model.IncomingWebhookRequestFromJson(payload)
if decodeError != nil {
return nil, decodeError
}
return incomingWebhookPayload, nil
}

45
api4/webhook_test.go
Просмотреть файл

@@ -4,8 +4,6 @@
package api4
import (
"bytes"
"net/http"
"testing"
"github.com/stretchr/testify/assert"
@@ -892,46 +890,3 @@ func TestDeleteOutgoingHook(t *testing.T) {
CheckForbiddenStatus(t, resp)
})
}
func TestCommandWebhooks(t *testing.T) {
th := Setup().InitBasic().InitSystemAdmin()
defer th.TearDown()
Client := th.SystemAdminClient
cmd := &model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: "http://nowhere.com",
Method: model.COMMAND_METHOD_POST,
Trigger: "delayed"}
cmd, _ = Client.CreateCommand(cmd)
args := &model.CommandArgs{
TeamId: th.BasicTeam.Id,
UserId: th.BasicUser.Id,
ChannelId: th.BasicChannel.Id,
}
hook, err := th.App.CreateCommandWebhook(cmd.Id, args)
if err != nil {
t.Fatal(err)
}
if resp, _ := http.Post(Client.Url+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusNotFound {
t.Fatal("expected not-found for non-existent hook")
}
if resp, err := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`)); err != nil || resp.StatusCode != http.StatusBadRequest {
t.Fatal(err)
}
for i := 0; i < 5; i++ {
if resp, err := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); err != nil || resp.StatusCode != http.StatusOK {
t.Fatal(err)
}
}
if resp, _ := http.Post(Client.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusBadRequest {
t.Fatal("expected error for sixth usage")
}
}

8
app/command.go
Просмотреть файл

@@ -230,12 +230,14 @@ func (a *App) ExecuteCommand(args *model.CommandArgs) (*model.CommandResponse, *
p.Set("response_url", args.SiteURL+"/hooks/commands/"+hook.Id)
}
method := "POST"
var req *http.Request
if cmd.Method == model.COMMAND_METHOD_GET {
method = "GET"
req, _ = http.NewRequest(http.MethodGet, cmd.URL, nil)
req.URL.RawQuery = p.Encode()
} else {
req, _ = http.NewRequest(http.MethodPost, cmd.URL, strings.NewReader(p.Encode()))
}
req, _ := http.NewRequest(method, cmd.URL, strings.NewReader(p.Encode()))
req.Header.Set("Accept", "application/json")
req.Header.Set("Authorization", "Token "+cmd.Token)
if cmd.Method == model.COMMAND_METHOD_POST {

25
app/login.go
Просмотреть файл

@@ -6,7 +6,6 @@ package app
import (
"fmt"
"net/http"
"strings"
"time"
"github.com/avct/uasurfer"
@@ -95,26 +94,10 @@ func (a *App) DoLogin(w http.ResponseWriter, r *http.Request, user *model.User,
ua := uasurfer.Parse(r.UserAgent())
plat := ua.OS.Platform.String()
if plat == "" {
plat = "unknown"
}
os := ua.OS.Name.String()
if os == "" {
os = "unknown"
}
bname := ua.Browser.Name.String()
if bname == "" {
bname = "unknown"
}
if strings.Contains(r.UserAgent(), "Mattermost") {
bname = "Desktop App"
}
bversion := ua.Browser.Version
plat := getPlatformName(ua)
os := getOSName(ua)
bname := getBrowserName(ua, r.UserAgent())
bversion := getBrowserVersion(ua, r.UserAgent())
session.AddProp(model.SESSION_PROP_PLATFORM, plat)
session.AddProp(model.SESSION_PROP_OS, os)

132
app/user_agent.go Обычный файл
Просмотреть файл

@@ -0,0 +1,132 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See LICENSE.txt for license information.
package app
import (
"fmt"
"strings"
"github.com/avct/uasurfer"
)
var platformNames = map[uasurfer.Platform]string{
uasurfer.PlatformUnknown: "Windows",
uasurfer.PlatformWindows: "Windows",
uasurfer.PlatformMac: "Macintosh",
uasurfer.PlatformLinux: "Linux",
uasurfer.PlatformiPad: "iPad",
uasurfer.PlatformiPhone: "iPhone",
uasurfer.PlatformiPod: "iPod",
uasurfer.PlatformBlackberry: "BlackBerry",
uasurfer.PlatformWindowsPhone: "Windows Phone",
}
func getPlatformName(ua *uasurfer.UserAgent) string {
platform := ua.OS.Platform
if name, ok := platformNames[platform]; !ok {
return platformNames[uasurfer.PlatformUnknown]
} else {
return name
}
}
var osNames = map[uasurfer.OSName]string{
uasurfer.OSUnknown: "",
uasurfer.OSWindowsPhone: "Windows Phone",
uasurfer.OSWindows: "Windows",
uasurfer.OSMacOSX: "Mac OS",
uasurfer.OSiOS: "iOS",
uasurfer.OSAndroid: "Android",
uasurfer.OSBlackberry: "BlackBerry",
uasurfer.OSChromeOS: "Chrome OS",
uasurfer.OSKindle: "Kindle",
uasurfer.OSWebOS: "webOS",
uasurfer.OSLinux: "Linux",
}
func getOSName(ua *uasurfer.UserAgent) string {
os := ua.OS
if os.Name == uasurfer.OSWindows {
major := os.Version.Major
minor := os.Version.Minor
name := "Windows"
// Adapted from https://github.com/mssola/user_agent/blob/master/operating_systems.go#L26
if major == 5 {
if minor == 0 {
name = "Windows 2000"
} else if minor == 1 {
name = "Windows XP"
} else if minor == 2 {
name = "Windows XP x64 Edition"
}
} else if major == 6 {
if minor == 0 {
name = "Windows Vista"
} else if minor == 1 {
name = "Windows 7"
} else if minor == 2 {
name = "Windows 8"
} else if minor == 3 {
name = "Windows 8.1"
}
} else if major == 10 {
name = "Windows 10"
}
return name
} else if name, ok := osNames[os.Name]; ok {
return name
} else {
return osNames[uasurfer.OSUnknown]
}
}
func getBrowserVersion(ua *uasurfer.UserAgent, userAgentString string) string {
if index := strings.Index(userAgentString, "Mattermost/"); index != -1 {
afterVersion := userAgentString[index+len("Mattermost/"):]
return strings.Fields(afterVersion)[0]
} else if index := strings.Index(userAgentString, "Franz/"); index != -1 {
afterVersion := userAgentString[index+len("Franz/"):]
return strings.Fields(afterVersion)[0]
} else {
return getUAVersion(ua.Browser.Version)
}
}
func getUAVersion(version uasurfer.Version) string {
if version.Patch == 0 {
return fmt.Sprintf("%v.%v", version.Major, version.Minor)
} else {
return fmt.Sprintf("%v.%v.%v", version.Major, version.Minor, version.Patch)
}
}
var browserNames = map[uasurfer.BrowserName]string{
uasurfer.BrowserUnknown: "Unknown",
uasurfer.BrowserChrome: "Chrome",
uasurfer.BrowserIE: "Internet Explorer",
uasurfer.BrowserSafari: "Safari",
uasurfer.BrowserFirefox: "Firefox",
uasurfer.BrowserAndroid: "Android",
uasurfer.BrowserOpera: "Opera",
uasurfer.BrowserBlackberry: "BlackBerry",
}
func getBrowserName(ua *uasurfer.UserAgent, userAgentString string) string {
browser := ua.Browser.Name
if strings.Contains(userAgentString, "Mattermost") {
return "Desktop App"
} else if browser == uasurfer.BrowserIE && ua.Browser.Version.Major > 11 {
return "Edge"
} else if name, ok := browserNames[browser]; ok {
return name
} else {
return browserNames[uasurfer.BrowserUnknown]
}
}

151
app/user_agent_test.go Обычный файл
Просмотреть файл

@@ -0,0 +1,151 @@
package app
import (
"fmt"
"testing"
"github.com/avct/uasurfer"
)
type testUserAgent struct {
Name string
UserAgent string
}
var testUserAgents = []testUserAgent{
{"Mozilla 40.1", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"},
{"Chrome 60", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36"},
{"Chrome Mobile", "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Mobile Safari/537.36"},
{"MM Classic App", "Mozilla/5.0 (Linux; Android 8.0.0; Nexus 5X Build/OPR6.170623.013; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/61.0.3163.81 Mobile Safari/537.36 Web-Atoms-Mobile-WebView"},
{"MM App 3.7.1", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Mattermost/3.7.1 Chrome/56.0.2924.87 Electron/1.6.11 Safari/537.36"},
{"Franz 4.0.4", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Franz/4.0.4 Chrome/52.0.2743.82 Electron/1.3.1 Safari/537.36"},
{"Edge 14", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393"},
{"Internet Explorer 9", "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 7.1; Trident/5.0"},
{"Internet Explorer 11", "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"},
{"Internet Explorer 11 2", "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Zoom 3.6.0; rv:11.0) like Gecko"},
{"Internet Explorer 11 (Compatibility Mode) 1", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; .NET CLR 1.1.4322; InfoPath.3; Zoom 3.6.0)"},
{"Internet Explorer 11 (Compatibility Mode) 2", "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; Zoom 3.6.0)"},
{"Safari 9", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Safari/604.1.38"},
{"Safari 8", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_4) AppleWebKit/600.7.12 (KHTML, like Gecko) Version/8.0.7 Safari/600.7.12"},
{"Safari Mobile", "Mozilla/5.0 (iPhone; CPU iPhone OS 9_1 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13B137 Safari/601.1"},
}
func TestGetPlatformName(t *testing.T) {
expected := []string{
"Windows",
"Macintosh",
"Linux",
"Linux",
"Macintosh",
"Macintosh",
"Windows",
"Windows",
"Windows",
"Windows",
"Windows",
"Windows",
"Macintosh",
"Macintosh",
"iPhone",
}
for i, userAgent := range testUserAgents {
t.Run(fmt.Sprintf("GetPlatformName_%v", i), func(t *testing.T) {
ua := uasurfer.Parse(userAgent.UserAgent)
if actual := getPlatformName(ua); actual != expected[i] {
t.Fatalf("%v Got %v, expected %v", userAgent.Name, actual, expected[i])
}
})
}
}
func TestGetOSName(t *testing.T) {
expected := []string{
"Windows 7",
"Mac OS",
"Android",
"Android",
"Mac OS",
"Mac OS",
"Windows 10",
"Windows",
"Windows 10",
"Windows 10",
"Windows 10",
"Windows 10",
"Mac OS",
"Mac OS",
"iOS",
}
for i, userAgent := range testUserAgents {
t.Run(fmt.Sprintf("GetOSName_%v", i), func(t *testing.T) {
ua := uasurfer.Parse(userAgent.UserAgent)
if actual := getOSName(ua); actual != expected[i] {
t.Fatalf("Got %v, expected %v", actual, expected[i])
}
})
}
}
func TestGetBrowserName(t *testing.T) {
expected := []string{
"Firefox",
"Chrome",
"Chrome",
"Chrome",
"Desktop App",
"Chrome",
"Edge",
"Internet Explorer",
"Internet Explorer",
"Internet Explorer",
"Internet Explorer",
"Internet Explorer",
"Safari",
"Safari",
"Safari",
}
for i, userAgent := range testUserAgents {
t.Run(fmt.Sprintf("GetBrowserName_%v", i), func(t *testing.T) {
ua := uasurfer.Parse(userAgent.UserAgent)
if actual := getBrowserName(ua, userAgent.UserAgent); actual != expected[i] {
t.Fatalf("Got %v, expected %v", actual, expected[i])
}
})
}
}
func TestGetBrowserVersion(t *testing.T) {
expected := []string{
"40.1",
"60.0.3112", // Doesn't report the fourth part of the version
"60.0.3112", // Doesn't report the fourth part of the version
"61.0.3163",
"3.7.1",
"4.0.4",
"14.14393",
"9.0",
"11.0",
"11.0",
"7.0",
"7.0",
"11.0",
"8.0.7",
"9.0",
}
for i, userAgent := range testUserAgents {
t.Run(fmt.Sprintf("GetBrowserVersion_%v", i), func(t *testing.T) {
ua := uasurfer.Parse(userAgent.UserAgent)
if actual := getBrowserVersion(ua, userAgent.UserAgent); actual != expected[i] {
t.Fatalf("Got %v, expected %v", actual, expected[i])
}
})
}
}

16
app/web_hub.go
Просмотреть файл

@@ -125,6 +125,10 @@ func (a *App) HubStop() {
}
func (a *App) GetHubForUserId(userId string) *Hub {
if len(a.Hubs) == 0 {
return nil
}
hash := fnv.New32a()
hash.Write([]byte(userId))
index := hash.Sum32() % uint32(len(a.Hubs))
@@ -132,11 +136,17 @@ func (a *App) GetHubForUserId(userId string) *Hub {
}
func (a *App) HubRegister(webConn *WebConn) {
a.GetHubForUserId(webConn.UserId).Register(webConn)
hub := a.GetHubForUserId(webConn.UserId)
if hub != nil {
hub.Register(webConn)
}
}
func (a *App) HubUnregister(webConn *WebConn) {
a.GetHubForUserId(webConn.UserId).Unregister(webConn)
hub := a.GetHubForUserId(webConn.UserId)
if hub != nil {
hub.Unregister(webConn)
}
}
func (a *App) Publish(message *model.WebSocketEvent) {
@@ -333,7 +343,7 @@ func (h *Hub) Unregister(webConn *WebConn) {
}
func (h *Hub) Broadcast(message *model.WebSocketEvent) {
if message != nil {
if h != nil && h.broadcast != nil && message != nil {
h.broadcast <- message
}
}

2
cmd/commands/server.go
Просмотреть файл

@@ -107,7 +107,7 @@ func runServer(configFileLocation string, disableConfigWatch bool, interruptChan
api4.Init(a, a.Srv.Router, false)
api3 := api.Init(a, a.Srv.Router)
wsapi.Init(a, a.Srv.WebSocketRouter)
web.Init(api3)
web.NewWeb(a, a.Srv.Router)
license := a.License()

4
i18n/en.json
Просмотреть файл

@@ -5982,10 +5982,6 @@
"id": "store.sql_channel.delete.channel.app_error",
"translation": "We couldn't delete the channel"
},
{
"id": "store.sql_channel.extra_updated.app_error",
"translation": "Problem updating members last updated time"
},
{
"id": "store.sql_channel.get.existing.app_error",
"translation": "We couldn't find the existing channel"

5
model/channel.go
Просмотреть файл

@@ -134,17 +134,12 @@ func (o *Channel) PreSave() {
o.CreateAt = GetMillis()
o.UpdateAt = o.CreateAt
o.ExtraUpdateAt = o.CreateAt
}
func (o *Channel) PreUpdate() {
o.UpdateAt = GetMillis()
}
func (o *Channel) ExtraUpdated() {
o.ExtraUpdateAt = GetMillis()
}
func (o *Channel) IsGroupOrDirect() bool {
return o.Type == CHANNEL_DIRECT || o.Type == CHANNEL_GROUP
}

37
store/sqlstore/channel_store.go
Просмотреть файл

@@ -466,25 +466,6 @@ func (s SqlChannelStore) Update(channel *model.Channel) store.StoreChannel {
})
}
func (s SqlChannelStore) extraUpdated(channel *model.Channel) store.StoreChannel {
return store.Do(func(result *store.StoreResult) {
channel.ExtraUpdated()
_, err := s.GetMaster().Exec(
`UPDATE
Channels
SET
ExtraUpdateAt = :Time
WHERE
Id = :Id`,
map[string]interface{}{"Id": channel.Id, "Time": channel.ExtraUpdateAt})
if err != nil {
result.Err = model.NewAppError("SqlChannelStore.extraUpdated", "store.sql_channel.extra_updated.app_error", nil, "id="+channel.Id+", "+err.Error(), http.StatusInternalServerError)
}
})
}
func (s SqlChannelStore) GetChannelUnread(channelId, userId string) store.StoreChannel {
return store.Do(func(result *store.StoreResult) {
var unreadChannel model.ChannelUnread
@@ -1313,21 +1294,9 @@ func (s SqlChannelStore) GetMemberCount(channelId string, allowFromCache bool) s
func (s SqlChannelStore) RemoveMember(channelId string, userId string) store.StoreChannel {
return store.Do(func(result *store.StoreResult) {
// Grab the channel we are saving this member to
if cr := <-s.Get(channelId, true); cr.Err != nil {
result.Err = cr.Err
} else {
channel := cr.Data.(*model.Channel)
_, err := s.GetMaster().Exec("DELETE FROM ChannelMembers WHERE ChannelId = :ChannelId AND UserId = :UserId", map[string]interface{}{"ChannelId": channelId, "UserId": userId})
if err != nil {
result.Err = model.NewAppError("SqlChannelStore.RemoveMember", "store.sql_channel.remove_member.app_error", nil, "channel_id="+channelId+", user_id="+userId+", "+err.Error(), http.StatusInternalServerError)
} else {
// If successfull record members have changed in channel
if mu := <-s.extraUpdated(channel); mu.Err != nil {
result.Err = mu.Err
}
}
_, err := s.GetMaster().Exec("DELETE FROM ChannelMembers WHERE ChannelId = :ChannelId AND UserId = :UserId", map[string]interface{}{"ChannelId": channelId, "UserId": userId})
if err != nil {
result.Err = model.NewAppError("SqlChannelStore.RemoveMember", "store.sql_channel.remove_member.app_error", nil, "channel_id="+channelId+", user_id="+userId+", "+err.Error(), http.StatusInternalServerError)
}
})
}

33
store/storetest/channel_store.go
Просмотреть файл

@@ -719,9 +719,6 @@ func testChannelMemberStore(t *testing.T, ss store.Store) {
c1.Type = model.CHANNEL_OPEN
c1 = *store.Must(ss.Channel().Save(&c1, -1)).(*model.Channel)
c1t1 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t1 := c1t1.ExtraUpdateAt
u1 := model.User{}
u1.Email = model.NewId()
u1.Nickname = model.NewId()
@@ -746,13 +743,6 @@ func testChannelMemberStore(t *testing.T, ss store.Store) {
o2.NotifyProps = model.GetDefaultChannelNotifyProps()
store.Must(ss.Channel().SaveMember(&o2))
c1t2 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t2 := c1t2.ExtraUpdateAt
if t2 <= t1 {
t.Fatal("Member update time incorrect")
}
count := (<-ss.Channel().GetMemberCount(o1.ChannelId, true)).Data.(int64)
if count != 2 {
t.Fatal("should have saved 2 members")
@@ -783,13 +773,6 @@ func testChannelMemberStore(t *testing.T, ss store.Store) {
t.Fatal("should have removed 1 member")
}
c1t3 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t3 := c1t3.ExtraUpdateAt
if t3 <= t2 || t3 <= t1 {
t.Fatal("Member update time incorrect on delete")
}
member := (<-ss.Channel().GetMember(o1.ChannelId, o1.UserId)).Data.(*model.ChannelMember)
if member.ChannelId != o1.ChannelId {
t.Fatal("should have go member")
@@ -798,12 +781,6 @@ func testChannelMemberStore(t *testing.T, ss store.Store) {
if err := (<-ss.Channel().SaveMember(&o1)).Err; err == nil {
t.Fatal("Should have been a duplicate")
}
c1t4 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t4 := c1t4.ExtraUpdateAt
if t4 != t3 {
t.Fatal("Should not update time upon failure")
}
}
func testChannelDeleteMemberStore(t *testing.T, ss store.Store) {
@@ -814,9 +791,6 @@ func testChannelDeleteMemberStore(t *testing.T, ss store.Store) {
c1.Type = model.CHANNEL_OPEN
c1 = *store.Must(ss.Channel().Save(&c1, -1)).(*model.Channel)
c1t1 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t1 := c1t1.ExtraUpdateAt
u1 := model.User{}
u1.Email = model.NewId()
u1.Nickname = model.NewId()
@@ -841,13 +815,6 @@ func testChannelDeleteMemberStore(t *testing.T, ss store.Store) {
o2.NotifyProps = model.GetDefaultChannelNotifyProps()
store.Must(ss.Channel().SaveMember(&o2))
c1t2 := (<-ss.Channel().Get(c1.Id, false)).Data.(*model.Channel)
t2 := c1t2.ExtraUpdateAt
if t2 <= t1 {
t.Fatal("Member update time incorrect")
}
count := (<-ss.Channel().GetMemberCount(o1.ChannelId, false)).Data.(int64)
if count != 2 {
t.Fatal("should have saved 2 members")

170
api4/context.go → web/context.go
Просмотреть файл

@@ -1,14 +1,13 @@
// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package api4
package web
import (
"fmt"
"net/http"
"regexp"
"strings"
"time"
goi18n "github.com/nicksnyder/go-i18n/i18n"
@@ -21,7 +20,7 @@ import (
type Context struct {
App *app.App
Session model.Session
Params *ApiParams
Params *Params
Err *model.AppError
T goi18n.TranslateFunc
RequestId string
@@ -30,169 +29,6 @@ type Context struct {
siteURLHeader string
}
func (api *API) ApiHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &handler{
app: api.App,
handleFunc: h,
requireSession: false,
trustRequester: false,
requireMfa: false,
}
}
func (api *API) ApiSessionRequired(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &handler{
app: api.App,
handleFunc: h,
requireSession: true,
trustRequester: false,
requireMfa: true,
}
}
func (api *API) ApiSessionRequiredMfa(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &handler{
app: api.App,
handleFunc: h,
requireSession: true,
trustRequester: false,
requireMfa: false,
}
}
func (api *API) ApiHandlerTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &handler{
app: api.App,
handleFunc: h,
requireSession: false,
trustRequester: true,
requireMfa: false,
}
}
func (api *API) ApiSessionRequiredTrustRequester(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &handler{
app: api.App,
handleFunc: h,
requireSession: true,
trustRequester: true,
requireMfa: true,
}
}
type handler struct {
app *app.App
handleFunc func(*Context, http.ResponseWriter, *http.Request)
requireSession bool
trustRequester bool
requireMfa bool
}
func (h handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
now := time.Now()
mlog.Debug(fmt.Sprintf("%v - %v", r.Method, r.URL.Path))
c := &Context{}
c.App = h.app
c.T, _ = utils.GetTranslationsAndLocale(w, r)
c.RequestId = model.NewId()
c.IpAddress = utils.GetIpAddress(r)
c.Params = ApiParamsFromRequest(r)
token, tokenLocation := app.ParseAuthTokenFromRequest(r)
// CSRF Check
if tokenLocation == app.TokenLocationCookie && h.requireSession && !h.trustRequester {
if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML {
c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt", http.StatusUnauthorized)
token = ""
}
}
c.SetSiteURLHeader(app.GetProtocol(r) + "://" + r.Host)
w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId)
w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v.%v", model.CurrentVersion, model.BuildNumber, c.App.ClientConfigHash(), c.App.License() != nil))
w.Header().Set("Content-Type", "application/json")
if r.Method == "GET" {
w.Header().Set("Expires", "0")
}
if len(token) != 0 {
session, err := c.App.GetSession(token)
if err != nil {
mlog.Info(fmt.Sprintf("Invalid session err=%v", err.Error()))
if err.StatusCode == http.StatusInternalServerError {
c.Err = err
} else if h.requireSession {
c.RemoveSessionCookie(w, r)
c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token, http.StatusUnauthorized)
}
} else if !session.IsOAuth && tokenLocation == app.TokenLocationQueryString {
c.Err = model.NewAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token, http.StatusUnauthorized)
} else {
c.Session = *session
}
// Rate limit by UserID
if c.App.Srv.RateLimiter != nil && c.App.Srv.RateLimiter.UserIdRateLimit(c.Session.UserId, w) {
return
}
}
c.Path = r.URL.Path
if c.Err == nil && h.requireSession {
c.SessionRequired()
}
if c.Err == nil && h.requireMfa {
c.MfaRequired()
}
if c.Err == nil {
h.handleFunc(c, w, r)
}
// Handle errors that have occurred
if c.Err != nil {
c.Err.Translate(c.T)
c.Err.RequestId = c.RequestId
if c.Err.Id == "api.context.session_expired.app_error" {
c.LogInfo(c.Err)
} else {
c.LogError(c.Err)
}
c.Err.Where = r.URL.Path
// Block out detailed error when not in developer mode
if !*c.App.Config().ServiceSettings.EnableDeveloper {
c.Err.DetailedError = ""
}
w.WriteHeader(c.Err.StatusCode)
w.Write([]byte(c.Err.ToJson()))
if c.App.Metrics != nil {
c.App.Metrics.IncrementHttpError()
}
}
if c.App.Metrics != nil {
c.App.Metrics.IncrementHttpRequest()
if r.URL.Path != model.API_URL_SUFFIX+"/websocket" {
elapsed := float64(time.Since(now)) / float64(time.Second)
c.App.Metrics.ObserveHttpRequestDuration(elapsed)
}
}
}
func (c *Context) LogAudit(extraInfo string) {
audit := &model.Audit{UserId: c.Session.UserId, IpAddress: c.IpAddress, Action: c.Path, ExtraInfo: extraInfo, SessionId: c.Session.Id}
if r := <-c.App.Srv.Store.Audit().Save(audit); r.Err != nil {

6
api4/context_test.go → web/context_test.go
Просмотреть файл

@@ -1,4 +1,4 @@
package api4
package web
import (
"net/http"
@@ -8,7 +8,7 @@ import (
func TestRequireHookId(t *testing.T) {
c := &Context{}
t.Run("WhenHookIdIsValid", func(t *testing.T) {
c.Params = &ApiParams{HookId: "abcdefghijklmnopqrstuvwxyz"}
c.Params = &Params{HookId: "abcdefghijklmnopqrstuvwxyz"}
c.RequireHookId()
if c.Err != nil {
@@ -17,7 +17,7 @@ func TestRequireHookId(t *testing.T) {
})
t.Run("WhenHookIdIsInvalid", func(t *testing.T) {
c.Params = &ApiParams{HookId: "abc"}
c.Params = &Params{HookId: "abc"}
c.RequireHookId()
if c.Err == nil {

158
web/handlers.go Обычный файл
Просмотреть файл

@@ -0,0 +1,158 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package web
import (
"fmt"
"net/http"
"time"
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
"github.com/mattermost/mattermost-server/utils"
)
func (w *Web) NewHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &Handler{
App: w.App,
HandleFunc: h,
RequireSession: false,
TrustRequester: false,
RequireMfa: false,
IsStatic: false,
}
}
func (w *Web) NewStaticHandler(h func(*Context, http.ResponseWriter, *http.Request)) http.Handler {
return &Handler{
App: w.App,
HandleFunc: h,
RequireSession: false,
TrustRequester: false,
RequireMfa: false,
IsStatic: true,
}
}
type Handler struct {
App *app.App
HandleFunc func(*Context, http.ResponseWriter, *http.Request)
RequireSession bool
TrustRequester bool
RequireMfa bool
IsStatic bool
}
func (h Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
now := time.Now()
mlog.Debug(fmt.Sprintf("%v - %v", r.Method, r.URL.Path))
c := &Context{}
c.App = h.App
c.T, _ = utils.GetTranslationsAndLocale(w, r)
c.RequestId = model.NewId()
c.IpAddress = utils.GetIpAddress(r)
c.Params = ParamsFromRequest(r)
token, tokenLocation := app.ParseAuthTokenFromRequest(r)
// CSRF Check
if tokenLocation == app.TokenLocationCookie && h.RequireSession && !h.TrustRequester {
if r.Header.Get(model.HEADER_REQUESTED_WITH) != model.HEADER_REQUESTED_WITH_XML {
c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token+" Appears to be a CSRF attempt", http.StatusUnauthorized)
token = ""
}
}
c.SetSiteURLHeader(app.GetProtocol(r) + "://" + r.Host)
w.Header().Set(model.HEADER_REQUEST_ID, c.RequestId)
w.Header().Set(model.HEADER_VERSION_ID, fmt.Sprintf("%v.%v.%v.%v", model.CurrentVersion, model.BuildNumber, c.App.ClientConfigHash(), c.App.License() != nil))
if h.IsStatic {
// Instruct the browser not to display us in an iframe unless is the same origin for anti-clickjacking
w.Header().Set("X-Frame-Options", "SAMEORIGIN")
w.Header().Set("Content-Security-Policy", "frame-ancestors 'self'")
} else {
// All api response bodies will be JSON formatted by default
w.Header().Set("Content-Type", "application/json")
if r.Method == "GET" {
w.Header().Set("Expires", "0")
}
}
if len(token) != 0 {
session, err := c.App.GetSession(token)
if err != nil {
mlog.Info(fmt.Sprintf("Invalid session err=%v", err.Error()))
if err.StatusCode == http.StatusInternalServerError {
c.Err = err
} else if h.RequireSession {
c.RemoveSessionCookie(w, r)
c.Err = model.NewAppError("ServeHTTP", "api.context.session_expired.app_error", nil, "token="+token, http.StatusUnauthorized)
}
} else if !session.IsOAuth && tokenLocation == app.TokenLocationQueryString {
c.Err = model.NewAppError("ServeHTTP", "api.context.token_provided.app_error", nil, "token="+token, http.StatusUnauthorized)
} else {
c.Session = *session
}
// Rate limit by UserID
if c.App.Srv.RateLimiter != nil && c.App.Srv.RateLimiter.UserIdRateLimit(c.Session.UserId, w) {
return
}
}
c.Path = r.URL.Path
if c.Err == nil && h.RequireSession {
c.SessionRequired()
}
if c.Err == nil && h.RequireMfa {
c.MfaRequired()
}
if c.Err == nil {
h.HandleFunc(c, w, r)
}
// Handle errors that have occurred
if c.Err != nil {
c.Err.Translate(c.T)
c.Err.RequestId = c.RequestId
if c.Err.Id == "api.context.session_expired.app_error" {
c.LogInfo(c.Err)
} else {
c.LogError(c.Err)
}
c.Err.Where = r.URL.Path
// Block out detailed error when not in developer mode
if !*c.App.Config().ServiceSettings.EnableDeveloper {
c.Err.DetailedError = ""
}
w.WriteHeader(c.Err.StatusCode)
w.Write([]byte(c.Err.ToJson()))
if c.App.Metrics != nil {
c.App.Metrics.IncrementHttpError()
}
}
if c.App.Metrics != nil {
c.App.Metrics.IncrementHttpRequest()
if r.URL.Path != model.API_URL_SUFFIX+"/websocket" {
elapsed := float64(time.Since(now)) / float64(time.Second)
c.App.Metrics.ObserveHttpRequestDuration(elapsed)
}
}
}

8
api4/params.go → web/params.go
Просмотреть файл

@@ -1,7 +1,7 @@
// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package api4
package web
import (
"net/http"
@@ -19,7 +19,7 @@ const (
LOGS_PER_PAGE_MAXIMUM = 10000
)
type ApiParams struct {
type Params struct {
UserId string
TeamId string
InviteId string
@@ -55,8 +55,8 @@ type ApiParams struct {
Permanent bool
}
func ApiParamsFromRequest(r *http.Request) *ApiParams {
params := &ApiParams{}
func ParamsFromRequest(r *http.Request) *Params {
params := &Params{}
props := mux.Vars(r)
query := r.URL.Query()

149
web/saml.go Обычный файл
Просмотреть файл

@@ -0,0 +1,149 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package web
import (
b64 "encoding/base64"
"net/http"
"strings"
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
)
func (w *Web) InitSaml() {
w.MainRouter.Handle("/login/sso/saml", w.NewHandler(loginWithSaml)).Methods("GET")
w.MainRouter.Handle("/login/sso/saml", w.NewHandler(completeSaml)).Methods("POST")
}
func loginWithSaml(c *Context, w http.ResponseWriter, r *http.Request) {
samlInterface := c.App.Saml
if samlInterface == nil {
c.Err = model.NewAppError("loginWithSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
return
}
teamId, err := c.App.GetTeamIdFromQuery(r.URL.Query())
if err != nil {
c.Err = err
return
}
action := r.URL.Query().Get("action")
redirectTo := r.URL.Query().Get("redirect_to")
relayProps := map[string]string{}
relayState := ""
if len(action) != 0 {
relayProps["team_id"] = teamId
relayProps["action"] = action
if action == model.OAUTH_ACTION_EMAIL_TO_SSO {
relayProps["email"] = r.URL.Query().Get("email")
}
}
if len(redirectTo) != 0 {
relayProps["redirect_to"] = redirectTo
}
if len(relayProps) > 0 {
relayState = b64.StdEncoding.EncodeToString([]byte(model.MapToJson(relayProps)))
}
if data, err := samlInterface.BuildRequest(relayState); err != nil {
c.Err = err
return
} else {
w.Header().Set("Content-Type", "application/x-www-form-urlencoded")
http.Redirect(w, r, data.URL, http.StatusFound)
}
}
func completeSaml(c *Context, w http.ResponseWriter, r *http.Request) {
samlInterface := c.App.Saml
if samlInterface == nil {
c.Err = model.NewAppError("completeSaml", "api.user.saml.not_available.app_error", nil, "", http.StatusFound)
return
}
//Validate that the user is with SAML and all that
encodedXML := r.FormValue("SAMLResponse")
relayState := r.FormValue("RelayState")
relayProps := make(map[string]string)
if len(relayState) > 0 {
stateStr := ""
if b, err := b64.StdEncoding.DecodeString(relayState); err != nil {
c.Err = model.NewAppError("completeSaml", "api.user.authorize_oauth_user.invalid_state.app_error", nil, err.Error(), http.StatusFound)
return
} else {
stateStr = string(b)
}
relayProps = model.MapFromJson(strings.NewReader(stateStr))
}
action := relayProps["action"]
if user, err := samlInterface.DoLogin(encodedXML, relayProps); err != nil {
if action == model.OAUTH_ACTION_MOBILE {
err.Translate(c.T)
w.Write([]byte(err.ToJson()))
} else {
c.Err = err
c.Err.StatusCode = http.StatusFound
}
return
} else {
if err := c.App.CheckUserAllAuthenticationCriteria(user, ""); err != nil {
c.Err = err
c.Err.StatusCode = http.StatusFound
return
}
switch action {
case model.OAUTH_ACTION_SIGNUP:
teamId := relayProps["team_id"]
if len(teamId) > 0 {
c.App.Go(func() {
if err := c.App.AddUserToTeamByTeamId(teamId, user); err != nil {
mlog.Error(err.Error())
} else {
c.App.AddDirectChannels(teamId, user)
}
})
}
case model.OAUTH_ACTION_EMAIL_TO_SSO:
if err := c.App.RevokeAllSessions(user.Id); err != nil {
c.Err = err
return
}
c.LogAuditWithUserId(user.Id, "Revoked all sessions for user")
c.App.Go(func() {
if err := c.App.SendSignInChangeEmail(user.Email, strings.Title(model.USER_AUTH_SERVICE_SAML)+" SSO", user.Locale, c.App.GetSiteURL()); err != nil {
mlog.Error(err.Error())
}
})
}
session, err := c.App.DoLogin(w, r, user, "")
if err != nil {
c.Err = err
return
}
c.Session = *session
if val, ok := relayProps["redirect_to"]; ok {
http.Redirect(w, r, c.GetSiteURLHeader()+val, http.StatusFound)
return
}
if action == model.OAUTH_ACTION_MOBILE {
ReturnStatusOK(w)
} else {
http.Redirect(w, r, app.GetProtocol(r)+"://"+r.Host, http.StatusFound)
}
}
}

84
web/static.go Обычный файл
Просмотреть файл

@@ -0,0 +1,84 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package web
import (
"fmt"
"net/http"
"path/filepath"
"strings"
"github.com/NYTimes/gziphandler"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
"github.com/mattermost/mattermost-server/utils"
)
func (w *Web) InitStatic() {
if *w.App.Config().ServiceSettings.WebserverMode != "disabled" {
staticDir, _ := utils.FindDir(model.CLIENT_DIR)
mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir))
staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir))))
pluginHandler := pluginHandler(w.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*w.App.Config().PluginSettings.ClientDirectory))))
if *w.App.Config().ServiceSettings.WebserverMode == "gzip" {
staticHandler = gziphandler.GzipHandler(staticHandler)
pluginHandler = gziphandler.GzipHandler(pluginHandler)
}
w.MainRouter.PathPrefix("/static/plugins/").Handler(pluginHandler)
w.MainRouter.PathPrefix("/static/").Handler(staticHandler)
w.MainRouter.Handle("/{anything:.*}", w.NewStaticHandler(root)).Methods("GET")
}
}
func root(c *Context, w http.ResponseWriter, r *http.Request) {
if !CheckClientCompatability(r.UserAgent()) {
w.Header().Set("Cache-Control", "no-store")
page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser")
page.Props["Title"] = c.T("web.error.unsupported_browser.title")
page.Props["Message"] = c.T("web.error.unsupported_browser.message")
page.RenderToWriter(w)
return
}
if IsApiCall(r) {
Handle404(c.App, w, r)
return
}
w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public")
staticDir, _ := utils.FindDir(model.CLIENT_DIR)
http.ServeFile(w, r, filepath.Join(staticDir, "root.html"))
}
func staticHandler(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Cache-Control", "max-age=31556926, public")
if strings.HasSuffix(r.URL.Path, "/") {
http.NotFound(w, r)
return
}
handler.ServeHTTP(w, r)
})
}
func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if *config().ServiceSettings.EnableDeveloper {
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
} else {
w.Header().Set("Cache-Control", "max-age=31556926, public")
}
if strings.HasSuffix(r.URL.Path, "/") {
http.NotFound(w, r)
return
}
handler.ServeHTTP(w, r)
})
}

106
web/web.go
Просмотреть файл

@@ -6,69 +6,39 @@ package web
import (
"fmt"
"net/http"
"path/filepath"
"strings"
"github.com/NYTimes/gziphandler"
"github.com/avct/uasurfer"
"github.com/gorilla/mux"
"github.com/mattermost/mattermost-server/api"
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
"github.com/mattermost/mattermost-server/utils"
)
func Init(api3 *api.API) {
type Web struct {
App *app.App
MainRouter *mux.Router
}
func NewWeb(a *app.App, root *mux.Router) *Web {
mlog.Debug("Initializing web routes")
mainrouter := api3.BaseRoutes.Root
if *api3.App.Config().ServiceSettings.WebserverMode != "disabled" {
staticDir, _ := utils.FindDir(model.CLIENT_DIR)
mlog.Debug(fmt.Sprintf("Using client directory at %v", staticDir))
staticHandler := staticHandler(http.StripPrefix("/static/", http.FileServer(http.Dir(staticDir))))
pluginHandler := pluginHandler(api3.App.Config, http.StripPrefix("/static/plugins/", http.FileServer(http.Dir(*api3.App.Config().PluginSettings.ClientDirectory))))
if *api3.App.Config().ServiceSettings.WebserverMode == "gzip" {
staticHandler = gziphandler.GzipHandler(staticHandler)
pluginHandler = gziphandler.GzipHandler(pluginHandler)
}
mainrouter.PathPrefix("/static/plugins/").Handler(pluginHandler)
mainrouter.PathPrefix("/static/").Handler(staticHandler)
mainrouter.Handle("/{anything:.*}", api3.AppHandlerIndependent(root)).Methods("GET")
web := &Web{
App: a,
MainRouter: root,
}
web.InitStatic()
web.InitWebhooks()
web.InitSaml()
return web
}
func staticHandler(handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Cache-Control", "max-age=31556926, public")
if strings.HasSuffix(r.URL.Path, "/") {
http.NotFound(w, r)
return
}
handler.ServeHTTP(w, r)
})
}
func pluginHandler(config model.ConfigFunc, handler http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if *config().ServiceSettings.EnableDeveloper {
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
} else {
w.Header().Set("Cache-Control", "max-age=31556926, public")
}
if strings.HasSuffix(r.URL.Path, "/") {
http.NotFound(w, r)
return
}
handler.ServeHTTP(w, r)
})
}
// Due to the complexities of UA detection and the ramifications of a misdetection only older Safari and IE browsers throw incompatibility errors.
// Due to the complexities of UA detection and the ramifications of a misdetection
// only older Safari and IE browsers throw incompatibility errors.
// Map should be of minimum required browser version.
var browserMinimumSupported = map[string]int{
"BrowserIE": 11,
@@ -85,24 +55,26 @@ func CheckClientCompatability(agentString string) bool {
return true
}
func root(c *api.Context, w http.ResponseWriter, r *http.Request) {
func Handle404(a *app.App, w http.ResponseWriter, r *http.Request) {
err := model.NewAppError("Handle404", "api.context.404.app_error", nil, "", http.StatusNotFound)
if !CheckClientCompatability(r.UserAgent()) {
w.Header().Set("Cache-Control", "no-store")
page := utils.NewHTMLTemplate(c.App.HTMLTemplates(), "unsupported_browser")
page.Props["Title"] = c.T("web.error.unsupported_browser.title")
page.Props["Message"] = c.T("web.error.unsupported_browser.message")
page.RenderToWriter(w)
return
mlog.Debug(fmt.Sprintf("%v: code=404 ip=%v", r.URL.Path, utils.GetIpAddress(r)))
if IsApiCall(r) {
w.WriteHeader(err.StatusCode)
err.DetailedError = "There doesn't appear to be an api call for the url='" + r.URL.Path + "'. Typo? are you missing a team_id or user_id as part of the url?"
w.Write([]byte(err.ToJson()))
} else {
utils.RenderWebAppError(w, r, err, a.AsymmetricSigningKey())
}
if api.IsApiCall(r) {
api.Handle404(c.App, w, r)
return
}
w.Header().Set("Cache-Control", "no-cache, max-age=31556926, public")
staticDir, _ := utils.FindDir(model.CLIENT_DIR)
http.ServeFile(w, r, filepath.Join(staticDir, "root.html"))
}
func IsApiCall(r *http.Request) bool {
return strings.Index(r.URL.Path, "/api/") == 0
}
func ReturnStatusOK(w http.ResponseWriter) {
m := make(map[string]string)
m[model.STATUS] = model.STATUS_OK
w.Write([]byte(model.MapToJson(m)))
}

99
web/web_test.go
Просмотреть файл

@@ -8,8 +8,6 @@ import (
"os"
"testing"
"github.com/mattermost/mattermost-server/api"
"github.com/mattermost/mattermost-server/api4"
"github.com/mattermost/mattermost-server/app"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
@@ -38,7 +36,14 @@ func StopTestStore() {
}
}
func Setup() *app.App {
type TestHelper struct {
App *app.App
BasicUser *model.User
BasicChannel *model.Channel
BasicTeam *model.Team
}
func Setup() *TestHelper {
a, err := app.New(app.StoreOverride(testStore), app.DisableConfigWatch)
if err != nil {
panic(err)
@@ -50,9 +55,8 @@ func Setup() *app.App {
panic(serverErr)
}
a.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.ListenAddress = prevListenAddress })
api4.Init(a, a.Srv.Router, false)
api3 := api.Init(a, a.Srv.Router)
Init(api3)
NewWeb(a, a.Srv.Router)
URL = fmt.Sprintf("http://localhost:%v", a.Srv.ListenAddr.Port)
ApiClient = model.NewClient(URL)
@@ -65,11 +69,31 @@ func Setup() *app.App {
*cfg.ServiceSettings.EnableAPIv3 = true
})
return a
th := &TestHelper{
App: a,
}
return th
}
func TearDown(a *app.App) {
a.Shutdown()
func (th *TestHelper) InitBasic() *TestHelper {
user, _ := th.App.CreateUser(&model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1", EmailVerified: true, Roles: model.SYSTEM_ADMIN_ROLE_ID})
team, _ := th.App.CreateTeam(&model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: user.Email, Type: model.TEAM_OPEN})
th.App.JoinUserToTeam(team, user, "")
channel, _ := th.App.CreateChannel(&model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id, CreatorId: user.Id}, true)
th.BasicUser = user
th.BasicChannel = channel
th.BasicTeam = team
return th
}
func (th *TestHelper) TearDown() {
th.App.Shutdown()
if err := recover(); err != nil {
StopTestStore()
panic(err)
@@ -93,63 +117,6 @@ func TestStatic(t *testing.T) {
}
*/
func TestIncomingWebhook(t *testing.T) {
a := Setup()
defer TearDown(a)
user := &model.User{Email: model.NewId() + "success+test@simulator.amazonses.com", Nickname: "Corey Hulen", Password: "passwd1"}
user = ApiClient.Must(ApiClient.CreateUser(user, "")).Data.(*model.User)
store.Must(a.Srv.Store.User().VerifyEmail(user.Id))
ApiClient.Login(user.Email, "passwd1")
team := &model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: "test@nowhere.com", Type: model.TEAM_OPEN}
team = ApiClient.Must(ApiClient.CreateTeam(team)).Data.(*model.Team)
a.JoinUserToTeam(team, user, "")
a.UpdateUserRoles(user.Id, model.SYSTEM_ADMIN_ROLE_ID, false)
ApiClient.SetTeamId(team.Id)
channel1 := &model.Channel{DisplayName: "Test API Name", Name: "zz" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id}
channel1 = ApiClient.Must(ApiClient.CreateChannel(channel1)).Data.(*model.Channel)
if a.Config().ServiceSettings.EnableIncomingWebhooks {
hook1 := &model.IncomingWebhook{ChannelId: channel1.Id}
hook1 = ApiClient.Must(ApiClient.CreateIncomingWebhook(hook1)).Data.(*model.IncomingWebhook)
payload := "payload={\"text\": \"test text\"}"
if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err != nil {
t.Fatal(err)
}
payload = "payload={\"text\": \"\"}"
if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil {
t.Fatal("should have errored - no text to post")
}
payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}"
if _, err := ApiClient.PostToWebhook(hook1.Id, payload); err == nil {
t.Fatal("should have errored - bad channel")
}
payload = "payload={\"text\": \"test text\"}"
if _, err := ApiClient.PostToWebhook("abc123", payload); err == nil {
t.Fatal("should have errored - bad hook")
}
payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--"
if _, err := ApiClient.DoPost("/hooks/"+hook1.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW"); err != nil {
t.Fatal("should have errored - bad hook")
}
} else {
if _, err := ApiClient.PostToWebhook("123", "123"); err == nil {
t.Fatal("should have failed - webhooks turned off")
}
}
}
func TestMain(m *testing.M) {
// Setup a global logger to catch tests logging outside of app context
// The global logger will be stomped by apps initalizing but that's fine for testing. Ideally this won't happen.

101
web/webhook.go Обычный файл
Просмотреть файл

@@ -0,0 +1,101 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package web
import (
"fmt"
"io"
"net/http"
"strings"
"github.com/gorilla/mux"
"github.com/gorilla/schema"
"github.com/mattermost/mattermost-server/mlog"
"github.com/mattermost/mattermost-server/model"
)
func (w *Web) InitWebhooks() {
w.MainRouter.Handle("/hooks/commands/{id:[A-Za-z0-9]+}", w.NewHandler(commandWebhook)).Methods("POST")
w.MainRouter.Handle("/hooks/{id:[A-Za-z0-9]+}", w.NewHandler(incomingWebhook)).Methods("POST")
}
func incomingWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
params := mux.Vars(r)
id := params["id"]
r.ParseForm()
var err *model.AppError
incomingWebhookPayload := &model.IncomingWebhookRequest{}
contentType := r.Header.Get("Content-Type")
if strings.Split(contentType, "; ")[0] == "application/x-www-form-urlencoded" {
payload := strings.NewReader(r.FormValue("payload"))
incomingWebhookPayload, err = decodePayload(payload)
if err != nil {
c.Err = err
return
}
} else if strings.HasPrefix(contentType, "multipart/form-data") {
r.ParseMultipartForm(0)
decoder := schema.NewDecoder()
err := decoder.Decode(incomingWebhookPayload, r.PostForm)
if err != nil {
c.Err = model.NewAppError("incomingWebhook", "api.webhook.incoming.error", nil, err.Error(), http.StatusBadRequest)
return
}
} else {
incomingWebhookPayload, err = decodePayload(r.Body)
if err != nil {
c.Err = err
return
}
}
if c.App.Config().LogSettings.EnableWebhookDebugging {
mlog.Debug(fmt.Sprint("Incoming webhook received. Content=", incomingWebhookPayload.ToJson()))
}
err = c.App.HandleIncomingWebhook(id, incomingWebhookPayload)
if err != nil {
c.Err = err
return
}
w.Header().Set("Content-Type", "text/plain")
w.Write([]byte("ok"))
}
func commandWebhook(c *Context, w http.ResponseWriter, r *http.Request) {
params := mux.Vars(r)
id := params["id"]
response, err := model.CommandResponseFromHTTPBody(r.Header.Get("Content-Type"), r.Body)
if err != nil {
c.Err = model.NewAppError("commandWebhook", "web.command_webhook.parse.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
appErr := c.App.HandleCommandWebhook(id, response)
if appErr != nil {
c.Err = appErr
return
}
w.Header().Set("Content-Type", "text/plain")
w.Write([]byte("ok"))
}
func decodePayload(payload io.Reader) (*model.IncomingWebhookRequest, *model.AppError) {
incomingWebhookPayload, decodeError := model.IncomingWebhookRequestFromJson(payload)
if decodeError != nil {
return nil, decodeError
}
return incomingWebhookPayload, nil
}

216
web/webhook_test.go Обычный файл
Просмотреть файл

@@ -0,0 +1,216 @@
// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package web
import (
"bytes"
"fmt"
"net/http"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/mattermost/mattermost-server/model"
)
func TestIncomingWebhook(t *testing.T) {
th := Setup().InitBasic()
defer th.TearDown()
if !th.App.Config().ServiceSettings.EnableIncomingWebhooks {
_, err := ApiClient.PostToWebhook("123", "123")
assert.NotNil(t, err, "should have errored - webhooks turned off")
return
}
hook, err := th.App.CreateIncomingWebhookForChannel(th.BasicUser.Id, th.BasicChannel, &model.IncomingWebhook{ChannelId: th.BasicChannel.Id})
require.Nil(t, err)
url := "/hooks/" + hook.Id
tooLongText := ""
for i := 0; i < 8200; i++ {
tooLongText += "a"
}
t.Run("WebhookBasics", func(t *testing.T) {
payload := "payload={\"text\": \"test text\"}"
_, err := ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
assert.Nil(t, err)
payload = "payload={\"text\": \"\"}"
_, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
assert.NotNil(t, err, "should have errored - no text to post")
payload = "payload={\"text\": \"test text\", \"channel\": \"junk\"}"
_, err = ApiClient.DoPost(url, payload, "application/x-www-form-urlencoded")
assert.NotNil(t, err, "should have errored - bad channel")
payload = "payload={\"text\": \"test text\"}"
_, err = ApiClient.DoPost("/hooks/abc123", payload, "application/x-www-form-urlencoded")
assert.NotNil(t, err, "should have errored - bad hook")
_, err = ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json")
assert.Nil(t, err)
text := `this is a \"test\"
that contains a newline and a tab`
_, err = ApiClient.DoPost(url, "{\"text\":\""+text+"\"}", "application/json")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", th.BasicChannel.Name), "application/json")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"#%s\"}", th.BasicChannel.Name), "application/json")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"@%s\"}", th.BasicUser.Username), "application/json")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, "payload={\"text\":\"this is a test\"}", "application/x-www-form-urlencoded")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, "payload={\"text\":\""+text+"\"}", "application/x-www-form-urlencoded")
assert.Nil(t, err)
_, err = ApiClient.DoPost(url, "{\"text\":\""+tooLongText+"\"}", "application/json")
assert.Nil(t, err)
payloadMultiPart := "------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nwebhook-bot\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"text\"\r\n\r\nthis is a test :tada:\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--"
_, err = ApiClient.DoPost("/hooks/"+hook.Id, payloadMultiPart, "multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW")
assert.Nil(t, err)
})
t.Run("WebhookExperimentReadOnly", func(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = false })
_, err := ApiClient.DoPost(url, fmt.Sprintf("{\"text\":\"this is a test\", \"channel\":\"%s\"}", model.DEFAULT_CHANNEL), "application/json")
assert.Nil(t, err, "Not read only")
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.ExperimentalTownSquareIsReadOnly = true })
th.App.SetLicense(model.NewTestLicense())
})
t.Run("WebhookAttachments", func(t *testing.T) {
attachmentPayload := `{
"text": "this is a test",
"attachments": [
{
"fallback": "Required plain-text summary of the attachment.",
"color": "#36a64f",
"pretext": "Optional text that appears above the attachment block",
"author_name": "Bobby Tables",
"author_link": "http://flickr.com/bobby/",
"author_icon": "http://flickr.com/icons/bobby.jpg",
"title": "Slack API Documentation",
"title_link": "https://api.slack.com/",
"text": "Optional text that appears within the attachment",
"fields": [
{
"title": "Priority",
"value": "High",
"short": false
}
],
"image_url": "http://my-website.com/path/to/image.jpg",
"thumb_url": "http://example.com/path/to/thumb.png"
}
]
}`
_, err := ApiClient.DoPost(url, attachmentPayload, "application/json")
assert.Nil(t, err)
attachmentPayload = `{
"text": "this is a test",
"attachments": [
{
"fallback": "Required plain-text summary of the attachment.",
"color": "#36a64f",
"pretext": "Optional text that appears above the attachment block",
"author_name": "Bobby Tables",
"author_link": "http://flickr.com/bobby/",
"author_icon": "http://flickr.com/icons/bobby.jpg",
"title": "Slack API Documentation",
"title_link": "https://api.slack.com/",
"text": "` + tooLongText + `",
"fields": [
{
"title": "Priority",
"value": "High",
"short": false
}
],
"image_url": "http://my-website.com/path/to/image.jpg",
"thumb_url": "http://example.com/path/to/thumb.png"
}
]
}`
_, err = ApiClient.DoPost(url, attachmentPayload, "application/json")
assert.Nil(t, err)
})
t.Run("DisableWebhooks", func(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableIncomingWebhooks = false })
_, err := ApiClient.DoPost(url, "{\"text\":\"this is a test\"}", "application/json")
assert.NotNil(t, err)
})
}
func TestCommandWebhooks(t *testing.T) {
th := Setup().InitBasic()
defer th.TearDown()
cmd, err := th.App.CreateCommand(&model.Command{
CreatorId: th.BasicUser.Id,
TeamId: th.BasicTeam.Id,
URL: "http://nowhere.com",
Method: model.COMMAND_METHOD_POST,
Trigger: "delayed"})
require.Nil(t, err)
args := &model.CommandArgs{
TeamId: th.BasicTeam.Id,
UserId: th.BasicUser.Id,
ChannelId: th.BasicChannel.Id,
}
hook, err := th.App.CreateCommandWebhook(cmd.Id, args)
if err != nil {
t.Fatal(err)
}
if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/123123123123", "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusNotFound {
t.Fatal("expected not-found for non-existent hook")
}
if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"invalid`)); err != nil || resp.StatusCode != http.StatusBadRequest {
t.Fatal(err)
}
for i := 0; i < 5; i++ {
if resp, err := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); err != nil || resp.StatusCode != http.StatusOK {
t.Fatal(err)
}
}
if resp, _ := http.Post(ApiClient.Url+"/hooks/commands/"+hook.Id, "application/json", bytes.NewBufferString(`{"text":"this is a test"}`)); resp.StatusCode != http.StatusBadRequest {
t.Fatal("expected error for sixth usage")
}
}