third-party-mirrors/EDDN
1
0
Fork 0
mirror of https://github.com/EDCD/EDDN.git synced 2025-06-05 01:43:20 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

Gateway: Log where upload data is form-encoded

Browse Source 
We suspect no-one is actually using this possible form of upload, and
ideally would remove the code for it entirely.  First we need to log any
uploaders that do use this form to be sure.
This commit is contained in:
Athanasius 2022-01-18 15:53:06 +00:00
parent 4ae424f887
commit 8d5b03915b
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/eddn/Gateway.py
View File

@ -160,6 +160,7 @@ def get_decompressed_message():
# Auto header checking.
logger.debug('Trying zlib.decompress (15 + 32)...')
message_body = zlib.decompress(request.body.read(), 15 + 32)
except zlib.error:
logger.error('zlib.error, trying zlib.decompress (-15)')
# Negative wbits suppresses adler32 checksumming.
@ -171,12 +172,14 @@ def get_decompressed_message():
# body. If it's not form-encoded, this will return an empty dict.
form_enc_parsed = urlparse.parse_qs(message_body)
if form_enc_parsed:
logger.debug('Request is form-encoded')
logger.info('Request is form-encoded, compressed, from %s' % (get_remote_address()))
# This is a form-encoded POST. The value of the data attrib will
# be the body we're looking for.
try:
message_body = form_enc_parsed['data'][0]
except (KeyError, IndexError):
logger.error('form-encoded, compressed, upload did not contain a "data" key. From %s', get_remote_address())
raise MalformedUploadError(
"No 'data' POST key/value found. Check your POST key "
"name for spelling, and make sure you're passing a value."
@ -192,7 +195,7 @@ def get_decompressed_message():
# POST key/vals, or un-encoded body.
data_key = request.forms.get('data')
if data_key:
logger.debug('form-encoded POST request detected...')
logger.info('Request is form-encoded, uncompressed, from %s' % (get_remote_address()))
# This is a form-encoded POST. Support the silly people.
message_body = data_key