mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

PLT-6358: Server HTTP client improvements (#6980)

Просмотр исходного кода 
* restrict untrusted, internal http connections by default

* command test fix

* more test fixes

* change setting from toggle to whitelist

* requested ui changes

* add isdefault diagnostic

* fix tests
Этот коммит содержится в:
Chris
2017-08-09 15:49:07 -05:00
коммит произвёл Christopher Speller
родитель 504582b824
Коммит ffbf8e51fe
19 изменённых файлов: 342 добавлений и 98 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

2
app/command.go
Просмотреть файл

@@ -209,7 +209,7 @@ func ExecuteCommand(args *model.CommandArgs) (*model.CommandResponse, *model.App
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
}
if resp, err := utils.HttpClient().Do(req); err != nil {
if resp, err := utils.HttpClient(false).Do(req); err != nil {
return nil, model.NewAppError("command", "api.command.execute_command.failed.app_error", map[string]interface{}{"Trigger": trigger}, err.Error(), http.StatusInternalServerError)
} else {
if resp.StatusCode == http.StatusOK {

87
app/diagnostics.go
Просмотреть файл

@@ -174,49 +174,50 @@ func trackActivity() {
func trackConfig() {
SendDiagnostic(TRACK_CONFIG_SERVICE, map[string]interface{}{
"web_server_mode": *utils.Cfg.ServiceSettings.WebserverMode,
"enable_security_fix_alert": *utils.Cfg.ServiceSettings.EnableSecurityFixAlert,
"enable_insecure_outgoing_connections": *utils.Cfg.ServiceSettings.EnableInsecureOutgoingConnections,
"enable_incoming_webhooks": utils.Cfg.ServiceSettings.EnableIncomingWebhooks,
"enable_outgoing_webhooks": utils.Cfg.ServiceSettings.EnableOutgoingWebhooks,
"enable_commands": *utils.Cfg.ServiceSettings.EnableCommands,
"enable_only_admin_integrations": *utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations,
"enable_post_username_override": utils.Cfg.ServiceSettings.EnablePostUsernameOverride,
"enable_post_icon_override": utils.Cfg.ServiceSettings.EnablePostIconOverride,
"enable_apiv3": *utils.Cfg.ServiceSettings.EnableAPIv3,
"enable_user_access_tokens": *utils.Cfg.ServiceSettings.EnableUserAccessTokens,
"enable_custom_emoji": *utils.Cfg.ServiceSettings.EnableCustomEmoji,
"enable_emoji_picker": *utils.Cfg.ServiceSettings.EnableEmojiPicker,
"restrict_custom_emoji_creation": *utils.Cfg.ServiceSettings.RestrictCustomEmojiCreation,
"enable_testing": utils.Cfg.ServiceSettings.EnableTesting,
"enable_developer": *utils.Cfg.ServiceSettings.EnableDeveloper,
"enable_multifactor_authentication": *utils.Cfg.ServiceSettings.EnableMultifactorAuthentication,
"enforce_multifactor_authentication": *utils.Cfg.ServiceSettings.EnforceMultifactorAuthentication,
"enable_oauth_service_provider": utils.Cfg.ServiceSettings.EnableOAuthServiceProvider,
"connection_security": *utils.Cfg.ServiceSettings.ConnectionSecurity,
"uses_letsencrypt": *utils.Cfg.ServiceSettings.UseLetsEncrypt,
"forward_80_to_443": *utils.Cfg.ServiceSettings.Forward80To443,
"maximum_login_attempts": utils.Cfg.ServiceSettings.MaximumLoginAttempts,
"session_length_web_in_days": *utils.Cfg.ServiceSettings.SessionLengthWebInDays,
"session_length_mobile_in_days": *utils.Cfg.ServiceSettings.SessionLengthMobileInDays,
"session_length_sso_in_days": *utils.Cfg.ServiceSettings.SessionLengthSSOInDays,
"session_cache_in_minutes": *utils.Cfg.ServiceSettings.SessionCacheInMinutes,
"isdefault_site_url": isDefault(*utils.Cfg.ServiceSettings.SiteURL, model.SERVICE_SETTINGS_DEFAULT_SITE_URL),
"isdefault_tls_cert_file": isDefault(*utils.Cfg.ServiceSettings.TLSCertFile, model.SERVICE_SETTINGS_DEFAULT_TLS_CERT_FILE),
"isdefault_tls_key_file": isDefault(*utils.Cfg.ServiceSettings.TLSKeyFile, model.SERVICE_SETTINGS_DEFAULT_TLS_KEY_FILE),
"isdefault_read_timeout": isDefault(*utils.Cfg.ServiceSettings.ReadTimeout, model.SERVICE_SETTINGS_DEFAULT_READ_TIMEOUT),
"isdefault_write_timeout": isDefault(*utils.Cfg.ServiceSettings.WriteTimeout, model.SERVICE_SETTINGS_DEFAULT_WRITE_TIMEOUT),
"isdefault_google_developer_key": isDefault(utils.Cfg.ServiceSettings.GoogleDeveloperKey, ""),
"isdefault_allow_cors_from": isDefault(*utils.Cfg.ServiceSettings.AllowCorsFrom, model.SERVICE_SETTINGS_DEFAULT_ALLOW_CORS_FROM),
"restrict_post_delete": *utils.Cfg.ServiceSettings.RestrictPostDelete,
"allow_edit_post": *utils.Cfg.ServiceSettings.AllowEditPost,
"post_edit_time_limit": *utils.Cfg.ServiceSettings.PostEditTimeLimit,
"enable_user_typing_messages": *utils.Cfg.ServiceSettings.EnableUserTypingMessages,
"enable_channel_viewed_messages": *utils.Cfg.ServiceSettings.EnableChannelViewedMessages,
"time_between_user_typing_updates_milliseconds": *utils.Cfg.ServiceSettings.TimeBetweenUserTypingUpdatesMilliseconds,
"cluster_log_timeout_milliseconds": *utils.Cfg.ServiceSettings.ClusterLogTimeoutMilliseconds,
"enable_post_search": *utils.Cfg.ServiceSettings.EnablePostSearch,
"enable_user_statuses": *utils.Cfg.ServiceSettings.EnableUserStatuses,
"web_server_mode": *utils.Cfg.ServiceSettings.WebserverMode,
"enable_security_fix_alert": *utils.Cfg.ServiceSettings.EnableSecurityFixAlert,
"enable_insecure_outgoing_connections": *utils.Cfg.ServiceSettings.EnableInsecureOutgoingConnections,
"enable_incoming_webhooks": utils.Cfg.ServiceSettings.EnableIncomingWebhooks,
"enable_outgoing_webhooks": utils.Cfg.ServiceSettings.EnableOutgoingWebhooks,
"enable_commands": *utils.Cfg.ServiceSettings.EnableCommands,
"enable_only_admin_integrations": *utils.Cfg.ServiceSettings.EnableOnlyAdminIntegrations,
"enable_post_username_override": utils.Cfg.ServiceSettings.EnablePostUsernameOverride,
"enable_post_icon_override": utils.Cfg.ServiceSettings.EnablePostIconOverride,
"enable_apiv3": *utils.Cfg.ServiceSettings.EnableAPIv3,
"enable_user_access_tokens": *utils.Cfg.ServiceSettings.EnableUserAccessTokens,
"enable_custom_emoji": *utils.Cfg.ServiceSettings.EnableCustomEmoji,
"enable_emoji_picker": *utils.Cfg.ServiceSettings.EnableEmojiPicker,
"restrict_custom_emoji_creation": *utils.Cfg.ServiceSettings.RestrictCustomEmojiCreation,
"enable_testing": utils.Cfg.ServiceSettings.EnableTesting,
"enable_developer": *utils.Cfg.ServiceSettings.EnableDeveloper,
"enable_multifactor_authentication": *utils.Cfg.ServiceSettings.EnableMultifactorAuthentication,
"enforce_multifactor_authentication": *utils.Cfg.ServiceSettings.EnforceMultifactorAuthentication,
"enable_oauth_service_provider": utils.Cfg.ServiceSettings.EnableOAuthServiceProvider,
"connection_security": *utils.Cfg.ServiceSettings.ConnectionSecurity,
"uses_letsencrypt": *utils.Cfg.ServiceSettings.UseLetsEncrypt,
"forward_80_to_443": *utils.Cfg.ServiceSettings.Forward80To443,
"maximum_login_attempts": utils.Cfg.ServiceSettings.MaximumLoginAttempts,
"session_length_web_in_days": *utils.Cfg.ServiceSettings.SessionLengthWebInDays,
"session_length_mobile_in_days": *utils.Cfg.ServiceSettings.SessionLengthMobileInDays,
"session_length_sso_in_days": *utils.Cfg.ServiceSettings.SessionLengthSSOInDays,
"session_cache_in_minutes": *utils.Cfg.ServiceSettings.SessionCacheInMinutes,
"isdefault_site_url": isDefault(*utils.Cfg.ServiceSettings.SiteURL, model.SERVICE_SETTINGS_DEFAULT_SITE_URL),
"isdefault_tls_cert_file": isDefault(*utils.Cfg.ServiceSettings.TLSCertFile, model.SERVICE_SETTINGS_DEFAULT_TLS_CERT_FILE),
"isdefault_tls_key_file": isDefault(*utils.Cfg.ServiceSettings.TLSKeyFile, model.SERVICE_SETTINGS_DEFAULT_TLS_KEY_FILE),
"isdefault_read_timeout": isDefault(*utils.Cfg.ServiceSettings.ReadTimeout, model.SERVICE_SETTINGS_DEFAULT_READ_TIMEOUT),
"isdefault_write_timeout": isDefault(*utils.Cfg.ServiceSettings.WriteTimeout, model.SERVICE_SETTINGS_DEFAULT_WRITE_TIMEOUT),
"isdefault_google_developer_key": isDefault(utils.Cfg.ServiceSettings.GoogleDeveloperKey, ""),
"isdefault_allow_cors_from": isDefault(*utils.Cfg.ServiceSettings.AllowCorsFrom, model.SERVICE_SETTINGS_DEFAULT_ALLOW_CORS_FROM),
"isdefault_allowed_untrusted_internal_connections": isDefault(*utils.Cfg.ServiceSettings.AllowedUntrustedInternalConnections, ""),
"restrict_post_delete": *utils.Cfg.ServiceSettings.RestrictPostDelete,
"allow_edit_post": *utils.Cfg.ServiceSettings.AllowEditPost,
"post_edit_time_limit": *utils.Cfg.ServiceSettings.PostEditTimeLimit,
"enable_user_typing_messages": *utils.Cfg.ServiceSettings.EnableUserTypingMessages,
"enable_channel_viewed_messages": *utils.Cfg.ServiceSettings.EnableChannelViewedMessages,
"time_between_user_typing_updates_milliseconds": *utils.Cfg.ServiceSettings.TimeBetweenUserTypingUpdatesMilliseconds,
"cluster_log_timeout_milliseconds": *utils.Cfg.ServiceSettings.ClusterLogTimeoutMilliseconds,
"enable_post_search": *utils.Cfg.ServiceSettings.EnablePostSearch,
"enable_user_statuses": *utils.Cfg.ServiceSettings.EnableUserStatuses,
})
SendDiagnostic(TRACK_CONFIG_TEAM, map[string]interface{}{

2
app/notification.go
Просмотреть файл

@@ -682,7 +682,7 @@ func sendToPushProxy(msg model.PushNotification, session *model.Session) {
request, _ := http.NewRequest("POST", *utils.Cfg.EmailSettings.PushNotificationServer+model.API_URL_SUFFIX_V1+"/send_push", strings.NewReader(msg.ToJson()))
if resp, err := utils.HttpClient().Do(request); err != nil {
if resp, err := utils.HttpClient(true).Do(request); err != nil {
l4g.Error("Device push reported as error for UserId=%v SessionId=%v message=%v", session.UserId, session.Id, err.Error())
} else {
pushResponse := model.PushResponseFromJson(resp.Body)

4
app/oauth.go
Просмотреть файл

@@ -673,7 +673,7 @@ func AuthorizeOAuthUser(w http.ResponseWriter, r *http.Request, service, code, s
var ar *model.AccessResponse
var bodyBytes []byte
if resp, err := utils.HttpClient().Do(req); err != nil {
if resp, err := utils.HttpClient(true).Do(req); err != nil {
return nil, "", stateProps, model.NewLocAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.token_failed.app_error", nil, err.Error())
} else {
bodyBytes, _ = ioutil.ReadAll(resp.Body)
@@ -702,7 +702,7 @@ func AuthorizeOAuthUser(w http.ResponseWriter, r *http.Request, service, code, s
req.Header.Set("Accept", "application/json")
req.Header.Set("Authorization", "Bearer "+ar.AccessToken)
if resp, err := utils.HttpClient().Do(req); err != nil {
if resp, err := utils.HttpClient(true).Do(req); err != nil {
return nil, "", stateProps, model.NewLocAppError("AuthorizeOAuthUser", "api.user.authorize_oauth_user.service.app_error",
map[string]interface{}{"Service": service}, err.Error())
} else {

2
app/post.go
Просмотреть файл

@@ -619,7 +619,7 @@ func GetFileInfosForPost(postId string, readFromMaster bool) ([]*model.FileInfo,
func GetOpenGraphMetadata(url string) *opengraph.OpenGraph {
og := opengraph.NewOpenGraph()
res, err := utils.HttpClient().Get(url)
res, err := utils.HttpClient(false).Get(url)
if err != nil {
l4g.Error("GetOpenGraphMetadata request failed for url=%v with err=%v", url, err.Error())
return og

2
app/webhook.go
Просмотреть файл

@@ -102,7 +102,7 @@ func TriggerWebhook(payload *model.OutgoingWebhookPayload, hook *model.OutgoingW
req, _ := http.NewRequest("POST", url, body)
req.Header.Set("Content-Type", contentType)
req.Header.Set("Accept", "application/json")
if resp, err := utils.HttpClient().Do(req); err != nil {
if resp, err := utils.HttpClient(false).Do(req); err != nil {
l4g.Error(utils.T("api.post.handle_webhook_events_and_forget.event_post.error"), err.Error())
} else {
defer CloseBody(resp)

17
app/webrtc.go
Просмотреть файл

@@ -59,7 +59,7 @@ func GetWebrtcToken(sessionId string) (string, *model.AppError) {
rq, _ := http.NewRequest("POST", *utils.Cfg.WebrtcSettings.GatewayAdminUrl, strings.NewReader(model.MapToJson(data)))
rq.Header.Set("Content-Type", "application/json")
if rp, err := utils.HttpClient().Do(rq); err != nil {
if rp, err := utils.HttpClient(true).Do(rq); err != nil {
return "", model.NewAppError("WebRTC.Token", "model.client.connecting.app_error", nil, err.Error(), http.StatusInternalServerError)
} else if rp.StatusCode >= 300 {
defer CloseBody(rp)
@@ -80,3 +80,18 @@ func GenerateTurnPassword(username string, secret string) string {
h.Write([]byte(username))
return base64.StdEncoding.EncodeToString(h.Sum(nil))
}
func RevokeWebrtcToken(sessionId string) {
token := base64.StdEncoding.EncodeToString([]byte(sessionId))
data := make(map[string]string)
data["janus"] = "remove_token"
data["token"] = token
data["transaction"] = model.NewId()
data["admin_secret"] = *utils.Cfg.WebrtcSettings.GatewayAdminSecret
rq, _ := http.NewRequest("POST", *utils.Cfg.WebrtcSettings.GatewayAdminUrl, strings.NewReader(model.MapToJson(data)))
rq.Header.Set("Content-Type", "application/json")
// we do not care about the response
utils.HttpClient(true).Do(rq)
}

28
app/webtrc.go
Просмотреть файл

@@ -1,28 +0,0 @@
// Copyright (c) 2017-present Mattermost, Inc. All Rights Reserved.
// See License.txt for license information.
package app
import (
"encoding/base64"
"net/http"
"strings"
"github.com/mattermost/platform/model"
"github.com/mattermost/platform/utils"
)
func RevokeWebrtcToken(sessionId string) {
token := base64.StdEncoding.EncodeToString([]byte(sessionId))
data := make(map[string]string)
data["janus"] = "remove_token"
data["token"] = token
data["transaction"] = model.NewId()
data["admin_secret"] = *utils.Cfg.WebrtcSettings.GatewayAdminSecret
rq, _ := http.NewRequest("POST", *utils.Cfg.WebrtcSettings.GatewayAdminUrl, strings.NewReader(model.MapToJson(data)))
rq.Header.Set("Content-Type", "application/json")
// we do not care about the response
utils.HttpClient().Do(rq)
}