mirrors
/
PretendYoureXyzzy
mirror of https://github.com/ajanata/PretendYoureXyzzy.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #100 from uecasm/admins 

Since we already have a handy list of Admins, why not use it?
This commit is contained in:
Andy Janata 2014-04-06 15:12:09 -07:00
parent a0e9c1d974 fadc80709b
commit 4dcf39f5b7
4 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
WebContent/addcard.jsp
View File

@ -30,15 +30,13 @@ Administration tools.
<%@ page import="net.socialgamer.cah.HibernateUtil" %>
<%@ page import="net.socialgamer.cah.db.BlackCard" %>
<%@ page import="net.socialgamer.cah.db.WhiteCard" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="org.hibernate.Session" %>
<%@ page import="org.hibernate.Transaction" %>
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
// TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

6
WebContent/admin.jsp
View File

@ -33,6 +33,7 @@ Administration tools.
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="net.socialgamer.cah.StartupUtils" %>
<%@ page import="net.socialgamer.cah.CahModule.BanList" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.Constants.DisconnectReason" %>
<%@ page import="net.socialgamer.cah.Constants.LongPollEvent" %>
<%@ page import="net.socialgamer.cah.Constants.LongPollResponse" %>
@ -49,10 +50,7 @@ Administration tools.
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
// TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

6
WebContent/cardsets.jsp
View File

@ -33,16 +33,14 @@ Administration tools.
<%@ page import="net.socialgamer.cah.db.BlackCard" %>
<%@ page import="net.socialgamer.cah.db.CardSet" %>
<%@ page import="net.socialgamer.cah.db.WhiteCard" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="org.apache.commons.lang3.StringEscapeUtils" %>
<%@ page import="org.hibernate.Session" %>
<%@ page import="org.hibernate.Transaction" %>
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
//TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

4
src/net/socialgamer/cah/handlers/AdminHandler.java
View File

@ -27,6 +27,7 @@ import java.util.Map;
import javax.servlet.http.HttpSession;
import net.socialgamer.cah.Constants;
import net.socialgamer.cah.Constants.ErrorCode;
import net.socialgamer.cah.Constants.ReturnableData;
import net.socialgamer.cah.RequestWrapper;
@ -42,8 +43,7 @@ public abstract class AdminHandler extends Handler {
@Override
public Map<ReturnableData, Object> handle(final RequestWrapper request, final HttpSession session) {
final String remoteAddr = request.getRemoteAddr();
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(request.getRemoteAddr())) {
return error(ErrorCode.ACCESS_DENIED);
}