mirrors
/
PretendYoureXyzzy
mirror of https://github.com/ajanata/PretendYoureXyzzy.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Since we already have a handy list of Admins, why not use it? (Fixes TODO.)

This commit is contained in:
uecasm 2014-04-02 23:19:50 +13:00
parent de65ad2383
commit fadc80709b
4 changed files with 8 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
WebContent/addcard.jsp
View File

@ -30,15 +30,13 @@ Administration tools.
<%@ page import="net.socialgamer.cah.HibernateUtil" %>
<%@ page import="net.socialgamer.cah.db.BlackCard" %>
<%@ page import="net.socialgamer.cah.db.WhiteCard" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="org.hibernate.Session" %>
<%@ page import="org.hibernate.Transaction" %>
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
// TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

6
WebContent/admin.jsp
View File

@ -33,6 +33,7 @@ Administration tools.
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="net.socialgamer.cah.StartupUtils" %>
<%@ page import="net.socialgamer.cah.CahModule.BanList" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.Constants.DisconnectReason" %>
<%@ page import="net.socialgamer.cah.Constants.LongPollEvent" %>
<%@ page import="net.socialgamer.cah.Constants.LongPollResponse" %>
@ -49,10 +50,7 @@ Administration tools.
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
// TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

6
WebContent/cardsets.jsp
View File

@ -33,16 +33,14 @@ Administration tools.
<%@ page import="net.socialgamer.cah.db.BlackCard" %>
<%@ page import="net.socialgamer.cah.db.CardSet" %>
<%@ page import="net.socialgamer.cah.db.WhiteCard" %>
<%@ page import="net.socialgamer.cah.Constants" %>
<%@ page import="net.socialgamer.cah.RequestWrapper" %>
<%@ page import="org.apache.commons.lang3.StringEscapeUtils" %>
<%@ page import="org.hibernate.Session" %>
<%@ page import="org.hibernate.Transaction" %>
<%
RequestWrapper wrapper = new RequestWrapper(request);
String remoteAddr = wrapper.getRemoteAddr();
//TODO better access control than hard-coding IP addresses.
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1") ||
remoteAddr.equals("98.248.33.90") || remoteAddr.equals("207.161.39.198"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(wrapper.getRemoteAddr())) {
response.sendError(403, "Access is restricted to known hosts");
return;
}

4
src/net/socialgamer/cah/handlers/AdminHandler.java
View File

@ -27,6 +27,7 @@ import java.util.Map;
import javax.servlet.http.HttpSession;
import net.socialgamer.cah.Constants;
import net.socialgamer.cah.Constants.ErrorCode;
import net.socialgamer.cah.Constants.ReturnableData;
import net.socialgamer.cah.RequestWrapper;
@ -42,8 +43,7 @@ public abstract class AdminHandler extends Handler {
@Override
public Map<ReturnableData, Object> handle(final RequestWrapper request, final HttpSession session) {
final String remoteAddr = request.getRemoteAddr();
if (!(remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.equals("127.0.0.1"))) {
if (!Constants.ADMIN_IP_ADDRESSES.contains(request.getRemoteAddr())) {
return error(ErrorCode.ACCESS_DENIED);
}