| 15 | REGISTER_URLHANDLER("/v1/config/files", ConfigFilesHandler); |
| 16 | |
| 17 | bool ConfigFilesHandler::HandleRequest( |
| 18 | const WaitGroup::Ptr&, |
| 19 | const HttpApiRequest& request, |
| 20 | HttpApiResponse& response, |
| 21 | boost::asio::yield_context& yc |
| 22 | ) |
| 23 | { |
| 24 | namespace http = boost::beast::http; |
| 25 | |
| 26 | auto url = request.Url(); |
| 27 | auto user = request.User(); |
| 28 | auto params = request.Params(); |
| 29 | |
| 30 | if (request.method() != http::verb::get) |
| 31 | return false; |
| 32 | |
| 33 | const std::vector<String>& urlPath = url->GetPath(); |
| 34 | |
| 35 | if (urlPath.size() >= 4) |
| 36 | params->Set("package", urlPath[3]); |
| 37 | |
| 38 | if (urlPath.size() >= 5) |
| 39 | params->Set("stage", urlPath[4]); |
| 40 | |
| 41 | if (urlPath.size() >= 6) { |
| 42 | std::vector<String> tmpPath(urlPath.begin() + 5, urlPath.end()); |
| 43 | params->Set("path", boost::algorithm::join(tmpPath, "/")); |
| 44 | } |
| 45 | |
| 46 | if (request[http::field::accept] == "application/json") { |
| 47 | HttpUtility::SendJsonError(response, params, 400, "Invalid Accept header. Either remove the Accept header or set it to 'application/octet-stream'."); |
| 48 | return true; |
| 49 | } |
| 50 | |
| 51 | FilterUtility::CheckPermission(user, "config/query"); |
| 52 | |
| 53 | String packageName = HttpUtility::GetLastParameter(params, "package"); |
| 54 | String stageName = HttpUtility::GetLastParameter(params, "stage"); |
| 55 | |
| 56 | if (!ConfigPackageUtility::ValidatePackageName(packageName)) { |
| 57 | HttpUtility::SendJsonError(response, params, 400, "Invalid package name."); |
| 58 | return true; |
| 59 | } |
| 60 | |
| 61 | if (!ConfigPackageUtility::ValidateStageName(stageName)) { |
| 62 | HttpUtility::SendJsonError(response, params, 400, "Invalid stage name."); |
| 63 | return true; |
| 64 | } |
| 65 | |
| 66 | String relativePath = HttpUtility::GetLastParameter(params, "path"); |
| 67 | |
| 68 | if (ConfigPackageUtility::ContainsDotDot(relativePath)) { |
| 69 | HttpUtility::SendJsonError(response, params, 400, "Path contains '..' (not allowed)."); |
| 70 | return true; |
| 71 | } |
| 72 | |
| 73 | String path = ConfigPackageUtility::GetPackageDir() + "/" + packageName + "/" + stageName + "/" + relativePath; |
| 74 | |