server-ajax.php 19.9 KB
Newer Older
1 2
<?php
#
3
# Copyright (c) 2000-2017 University of Utah and the Flux Group.
4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27
# 
# {{{EMULAB-LICENSE
# 
# This file is part of the Emulab network testbed software.
# 
# This file is free software: you can redistribute it and/or modify it
# under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or (at
# your option) any later version.
# 
# This file is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General Public
# License for more details.
# 
# You should have received a copy of the GNU Affero General Public License
# along with this file.  If not, see <http://www.gnu.org/licenses/>.
# 
# }}}
#
chdir("..");
include("defs.php3");
chdir("apt");
include("quickvm_sup.php");
28 29
# Must be after quickvm_sup.php since it changes the auth domain.
include_once("../session.php");
30

31 32 33 34 35 36 37 38 39 40 41 42 43
#
# We need all errors to come back to us so that we can report the error
# to the user.
# 
function handle_error($message, $death)
{
    SPITAJAX_ERROR(-1, $message);
    # Always exit; ignore $death.
    exit(1);
}
$session_errorhandler = 'handle_error';
$session_interactive  = 0;

44 45 46 47 48
#
# Poor man routing description.
#
$routing = array("myprofiles" =>
			array("file"    => "myprofiles.ajax",
49 50 51
			      "guest"   => false,
			      "methods" => array("GetProfile" =>
						      "Do_GetProfile")),
52 53 54
		 "geni-login" =>
			array("file"    => "geni-login.ajax",
			      "guest"   => true,
55 56 57
			      "methods" => array("GetSignerInfo" =>
						      "Do_GetSignerInfo",
						 "CreateSecret" =>
58 59 60
						      "Do_CreateSecret",
						 "VerifySpeaksfor" =>
						      "Do_VerifySpeaksfor")),
61 62
		 "dashboard" =>
			array("file"    => "dashboard.ajax",
63
			      "guest"   => false,
64 65
			      "methods" => array("GetStats" =>
						      "Do_GetStats")),
66 67 68 69 70
		 "rspec2genilib" =>
			array("file"    => "rspec2genilib.ajax",
			      "guest"   => false,
			      "methods" => array("Convert" =>
						      "Do_Convert")),
71 72 73 74
		 "cluster-status" =>
			array("file"    => "cluster-status.ajax",
			      "guest"   => false,
			      "methods" => array("GetStatus" =>
75 76 77
                                                    "Do_GetStatus",
                                                 "GetPreReservations" =>
						      "Do_GetPreReservations")),
78 79 80 81 82
		 "sumstats" =>
			array("file"    => "sumstats.ajax",
			      "guest"   => false,
			      "methods" => array("GetDurationInfo" =>
						      "Do_GetDurationInfo")),
83 84 85
		 "instantiate" =>
			array("file"    => "instantiate.ajax",
			      "guest"   => true,
86
			      "methods" => array("GetProfile" =>
87
						     "Do_GetProfile",
88 89
						 "CheckForm" =>
						     "Do_CheckForm",
90 91
						 "RunScript" =>
						     "Do_RunScript",
92 93 94 95
						 "VerifyEmail" =>
						     "Do_VerifyEmail",
						 "Submit" =>
						     "Do_Submit",
96 97 98
						 "Instantiate" =>
						     "Do_Instantiate",
						 "GetParameters" =>
99
                                                     "Do_GetParameters",
100 101
						     "GetImageList" =>
						     "Do_GetImageList",
102
						 "GetImageInfo" =>
103 104 105 106 107
						     "Do_GetImageInfo",
						 "MarkFavorite" =>
						     "Do_MarkFavorite",
						 "ClearFavorite" =>
						     "Do_ClearFavorite")),
108 109
		 "manage_profile" =>
			array("file"    => "manage_profile.ajax",
110
			      "guest"   => false,
Leigh B Stoller's avatar
Leigh B Stoller committed
111 112 113
			      "methods" => array("Create" =>
						     "Do_Create",
                                                 "CloneStatus" =>
114
						     "Do_CloneStatus",
115 116 117 118
						 "DeleteProfile" =>
						     "Do_DeleteProfile",
						 "PublishProfile" =>
						     "Do_PublishProfile",
119
						 "InstantiateAsGuest" =>
120 121
						     "Do_GuestInstantiate",
						 "CheckScript" =>
122 123
						     "Do_CheckScript",
						 "BindParameters" =>
124 125
						     "Do_BindParameters",
						 "ConvertClassic" =>
126
                                                     "Do_ConvertClassic",
Leigh B Stoller's avatar
Leigh B Stoller committed
127 128
						 "ConvertRspec" =>
                                                     "Do_ConvertRspec",
129 130
						 "RTECheck" =>
                                                     "Do_RTECheck",
131 132 133 134 135 136 137 138 139 140
						 "UpdateRepository" =>
                                                     "Do_UpdateRepository",
						 "GetRepository" =>
                                                     "Do_GetRepository",
						 "GetRepoSource" =>
                                                     "Do_GetRepoSource",
						 "GetBranchList" =>
                                                     "Do_GetBranchList",
						 "GetCommitInfo" =>
                                                     "Do_GetCommitInfo",
141 142
						 "GetRepoHash" =>
                                                     "Do_GetRepoHash",
143 144
						 "GetCommitList" =>
                                                     "Do_GetCommitList")),
145 146
		 "status" =>
			array("file"    => "status.ajax",
147
			      "guest"   => true,
148 149
			      "methods" => array("GetInstanceStatus" =>
						   "Do_GetInstanceStatus",
150 151
						 "ExpInfo" =>
						    "Do_ExpInfo",
152 153
						 "IdleData" =>
						    "Do_IdleData",
154 155
						 "Utilization" =>
						    "Do_Utilization",
156 157 158 159 160 161
						 "TerminateInstance" =>
						    "Do_TerminateInstance",
						 "GetInstanceManifest" =>
						    "Do_GetInstanceManifest",
						 "GetSSHAuthObject" =>
						    "Do_GetSSHAuthObject",
162 163
						 "ConsoleURL" =>
						     "Do_ConsoleURL",
Leigh B Stoller's avatar
Leigh B Stoller committed
164 165
						 "DeleteNodes" =>
						     "Do_DeleteNodes",
166
						 "RequestExtension" =>
167
						     "Do_RequestExtension",
168 169
						 "DenyExtension" =>
						     "Do_DenyExtension",
170 171
						 "MoreInfo" =>
						     "Do_MoreInfo",
172 173
						 "SchedTerminate" =>
						     "Do_SchedTerminate",
174 175 176
						 "SnapShot" =>
						     "Do_Snapshot",
						 "SnapshotStatus" =>
177 178 179
                                                     "Do_SnapshotStatus",
						 "Reboot" =>
                                                     "Do_Reboot",
180 181
						 "Reload" =>
                                                     "Do_Reload",
182
						 "Refresh" =>
183
						     "Do_Refresh",
Leigh B Stoller's avatar
Leigh B Stoller committed
184 185
						 "ReloadTopology" =>
						     "Do_ReloadTopology",
186 187
						 "DecryptBlocks" =>
						     "Do_DecryptBlocks",
188
						 "Lockout" =>
189
                                                     "Do_Lockout",
Leigh B Stoller's avatar
Leigh B Stoller committed
190 191
						 "Lockdown" =>
                                                     "Do_Lockdown",
192
						 "Quarantine" =>
193
						     "Do_Quarantine",
194 195
						 "SaveAdminNotes" =>
						     "Do_SaveAdminNotes",
196
						 "LinktestControl" =>
197
						     "Do_Linktest",
198 199
						 "OpenstackStats" =>
						     "Do_OpenstackStats",
200 201
						 "MaxExtension" =>
						     "Do_MaxExtension",
202
						 "dismissExtensionDenied" =>
203 204 205
						     "Do_DismissExtensionDenied",
						 "GetHealthStatus" =>
						    "Do_GetHealthStatus")),
206 207 208 209 210 211 212
		 "approveuser" =>
			array("file"    => "approveuser.ajax",
			      "guest"   => false,
			      "methods" => array("approve" =>
						     "Do_Approve",
						 "deny" =>
						      "Do_Deny")),
213 214 215 216 217
		 "dataset" =>
			array("file"    => "dataset.ajax",
			      "guest"   => false,
			      "methods" => array("create" =>
						      "Do_CreateDataset",
Leigh B Stoller's avatar
Leigh B Stoller committed
218 219
						 "modify" =>
						      "Do_ModifyDataset",
220 221
						 "delete" =>
						      "Do_DeleteDataset",
Leigh B Stoller's avatar
Leigh B Stoller committed
222 223
						 "refresh" =>
						      "Do_RefreshDataset",
224
						 "approve" =>
225 226
						     "Do_ApproveDataset",
						 "extend" =>
227 228 229
                                                      "Do_ExtendDataset",
						 "getinfo" =>
						      "Do_GetInfo")),
230 231 232 233 234 235 236
		 "ssh-keys" =>
			array("file"    => "ssh-keys.ajax",
			      "guest"   => false,
			      "methods" => array("addkey" =>
						      "Do_AddKey",
						 "deletekey" =>
                                                      "Do_DeleteKey")),
237 238 239
		 "myaccount" =>
			array("file"    => "myaccount.ajax",
			      "guest"   => false,
240
                              "unapproved" => true,
241
			      "methods" => array("update" =>
242 243 244 245 246 247 248 249
                                                     "Do_Update")),
		 "changepswd" =>
			array("file"    => "changepswd.ajax",
			      "guest"   => false,
                              "unapproved" => true,
                              "notloggedinokay" => true,
			      "methods" => array("changepswd" =>
                                                     "Do_ChangePassword")),
250 251 252 253 254 255 256
		 "lists" =>
			array("file"    => "lists.ajax",
			      "guest"   => false,
			      "methods" => array("SearchUsers" =>
                                                     "Do_SearchUsers",
                                                 "SearchProjects" =>
                                                     "Do_SearchProjects")),
257 258 259 260 261
		 "user-dashboard" =>
			array("file"    => "user-dashboard.ajax",
			      "guest"   => false,
			      "methods" => array("ExperimentList" =>
						      "Do_ExperimentList",
262 263 264 265
                                                 "ClassicExperimentList" =>
						      "Do_ClassicExperimentList",
                                                 "ClassicProfileList" =>
						      "Do_ClassicProfileList",
266 267 268 269
                                                 "DatasetList" =>
						      "Do_DatasetList",
                                                 "ClassicDatasetList" =>
						      "Do_ClassicDatasetList",
270 271
                                                 "ProjectList" =>
                                                      "Do_ProjectList",
272 273
                                                 "UsageSummary" =>
                                                      "Do_UsageSummary",
274 275
                                                 "ProfileList" =>
                                                      "Do_ProfileList",
276 277
                                                 "Toggle" =>
                                                     "Do_Toggle",
Leigh B Stoller's avatar
Leigh B Stoller committed
278 279
                                                 "SendTestMessage" =>
                                                     "Do_SendTestMessage",
280 281
                                                 "NagPI" =>
                                                     "Do_NagPI",
282
                                                 "AccountDetails" =>
283 284 285 286 287 288 289
                                                     "Do_AccountDetails")),
		 "nag" =>
			array("file"    => "user-dashboard.ajax",
                              "unapproved" => true,
			      "guest"   => false,
			      "methods" => array("NagPI" =>
                                                     "Do_NagPI",)),
290 291 292 293 294
		 "show-project" =>
			array("file"    => "show-project.ajax",
			      "guest"   => false,
			      "methods" => array("ExperimentList" =>
						      "Do_ExperimentList",
295 296 297 298
                                                 "ClassicExperimentList" =>
						      "Do_ClassicExperimentList",
                                                 "ClassicProfileList" =>
						      "Do_ClassicProfileList",
299 300 301 302
                                                 "DatasetList" =>
						      "Do_DatasetList",
                                                 "ClassicDatasetList" =>
						      "Do_ClassicDatasetList",
303 304 305 306
                                                 "ProfileList" =>
                                                      "Do_ProfileList",
                                                 "MemberList" =>
                                                      "Do_MemberList",
307 308
                                                 "GroupList" =>
                                                      "Do_GroupList",
309 310
                                                 "UsageSummary" =>
                                                      "Do_UsageSummary",
311 312
                                                 "ProjectProfile" =>
                                                      "Do_ProjectProfile")),
313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331
		 "groups" =>
			array("file"    => "groups.ajax",
			      "guest"   => false,
			      "methods" => array("ExperimentList" =>
						      "Do_ExperimentList",
                                                 "ClassicExperimentList" =>
						     "Do_ClassicExperimentList",
                                                 "MemberList" =>
                                                      "Do_MemberList",
                                                 "EditMembership" =>
                                                      "Do_EditMembership",
                                                 "EditPrivs" =>
                                                      "Do_EditPrivs",
                                                 "Create" =>
                                                      "Do_CreateGroup",
                                                 "Delete" =>
                                                      "Do_DeleteGroup",
                                                 "GroupProfile" =>
                                                      "Do_GroupProfile")),
332 333 334 335 336
		 "ranking" =>
			array("file"    => "ranking.ajax",
			      "guest"   => false,
			      "methods" => array("RankList" =>
                                                     "Do_RankList")),
337 338 339 340 341 342
                 "announcement" =>
                        array("file"    => "announcement.ajax",
                              "guest"   => false,
                              "methods" => array("Dismiss" =>
                                                     "Do_Dismiss",
                                                 "Click" =>
Leigh B Stoller's avatar
Leigh B Stoller committed
343 344 345
                                                     "Do_Click",
                                                 "Announcements" =>
                                                     "Do_Announcements")),
346 347 348 349 350 351 352 353 354 355 356
		 "reserve" =>
			array("file"    => "reserve.ajax",
			      "guest"   => false,
			      "methods" => array("Reserve" =>
                                                     "Do_Reserve",
                                                 "Validate" =>
                                                     "Do_Validate",
                                                 "ListReservations" =>
                                                     "Do_ListReservations",
                                                 "GetReservation" =>
                                                     "Do_GetReservation",
357 358
                                                 "Approve" =>
                                                     "Do_Approve",
359 360
                                                 "WarnUser" =>
                                                     "Do_WarnUser",
361 362
                                                 "Delete" =>
                                                     "Do_Delete",
363 364
                                                 "RequestInfo" =>
                                                     "Do_RequestInfo",
365 366
                                                 "ReservationInfo" =>
                                                     "Do_ReservationInfo")),
367 368 369 370 371 372
		 "images" =>
			array("file"    => "images.ajax",
			      "guest"   => false,
			      "methods" => array("ListImages" =>
                                                     "Do_ListImages",
                                                 "DeleteImage" =>
373 374 375
                                                     "Do_DeleteImage",
                                                 "ClassicImages" =>
                                                     "Do_ClassicImageList")),
376 377 378 379 380 381 382 383 384 385 386
		 "news" =>
			array("file"    => "news.ajax",
			      "guest"   => true,
			      "methods" => array("create" =>
						      "Do_CreateNews",
						 "modify" =>
						      "Do_ModifyNews",
						 "delete" =>
						      "Do_DeleteNews",
						 "getnews" =>
						      "Do_GetNews")),
387 388 389 390
		 "experiments" =>
			array("file"    => "experiments.ajax",
			      "guest"   => false,
			      "methods" => array("ExperimentList" =>
391 392 393
                                                     "Do_ExperimentList",
                                                 "ExperimentErrors" =>
                                                     "Do_ExperimentErrors")),
394 395 396 397 398 399 400 401 402 403 404 405 406
		 "approve-projects" =>
			array("file"    => "approve-projects.ajax",
			      "guest"   => false,
			      "methods" => array("ProjectList" =>
                                                     "Do_ProjectList",
                                                 "SaveDescription" =>
                                                     "Do_SaveDescription",
                                                 "MoreInfo" =>
                                                     "Do_MoreInfo",
                                                 "Deny" =>
                                                     "Do_Deny",
                                                 "Approve" =>
                                                     "Do_Approve")),
407
);
408

409 410 411 412 413 414 415 416 417 418 419 420
#
# Redefine this so we return XML instead of html for all errors.
#
$PAGEERROR_HANDLER = function($msg, $status_code = 0) {
    if ($status_code == 0) {
	$status_code = 1;
    }
    SPITAJAX_ERROR(1, $msg);
    return;
};

#
421
# Included file determines if guest user okay.
422 423
#
$this_user = CheckLogin($check_status);
424 425 426 427 428 429

#
# Check user login, called by included code. Basically just a
# way to let guest users pass through when allowed, without
# duplicating the code in each file.
#
430
function CheckLoginForAjax($route)
431 432
{
    global $this_user, $check_status;
433
    global $ISAPT;
434 435
    $guestokay = false;
    $unapprovedokay = false;
436
    $notloggedinokay = false;
437 438 439 440 441 442 443
    
    if (array_key_exists("guest", $route)) {
        $guestokay = $route["guest"];
    }
    if (array_key_exists("unapproved", $route)) {
        $unapprovedokay = $route["unapproved"];
    }
444 445 446
    if (array_key_exists("notloggedinokay", $route)) {
        $notloggedinokay = $route["notloggedinokay"];
    }
447 448
    # Known user, but timed out.
    if ($check_status & CHECKLOGIN_TIMEDOUT) {
449 450
	SPITAJAX_ERROR(222, "Your login has timed out");
	exit(1);
451 452 453 454
    }
    # Logged in user always okay.
    if (isset($this_user)) {
	if ($check_status & CHECKLOGIN_MAYBEVALID) {
455 456 457
	    SPITAJAX_ERROR(222, "Your login cannot be verified. ".
                           "Cookie problem?");
	    exit(1);
458
	}
459 460
        # Known user, but not frozen.
        if ($check_status & CHECKLOGIN_FROZEN) {
461 462
            SPITAJAX_ERROR(222, "Your account has been frozen");
            exit(1);
463 464 465 466
        }
        if (! $unapprovedokay) {
            # Known user, but not approved.
            if ($check_status & CHECKLOGIN_UNAPPROVED) {
467 468
	        SPITAJAX_ERROR(222, "Your account has not been approved yet");
                exit(1);
469 470 471
            }
            # Known user, but not active.
            if (! ($check_status & CHECKLOGIN_ACTIVE)) {
472 473
                SPITAJAX_ERROR(222, "Your account is no longer active");
                exit(1);
474 475
            }
        }
476 477 478 479
        # Kludge, still thinking about it. If a geni user has no project
        # permissions at their SA, then we mark the acount as WEBONLY, and
        # deny access to anything that is not marked as guest okay. 
	if ($check_status & CHECKLOGIN_WEBONLY && !$guestokay) {
480 481
	    SPITAJAX_ERROR(222, "Your account is not allowed to do this");
	    exit(1);
482
        }
483 484
	return;
    }
485
    if (!($guestokay || $notloggedinokay)) {
486 487
	SPITAJAX_ERROR(222, "You are not logged in");	
	exit(1);
488
    }
489 490
}

491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516
#
# So we can capture stderr. Sheesh.
# 
function myexec($cmd)
{
    ignore_user_abort(1);

    $myexec_output_array = array();
    $myexec_output       = "";
    $myexec_retval       = 0;
    
    exec("$cmd 2>&1", $myexec_output_array, $myexec_retval);
    if ($myexec_retval) {
	for ($i = 0; $i < count($myexec_output_array); $i++) {
	    $myexec_output .= "$myexec_output_array[$i]\n";
	}
	$foo  = "Shell Program Error. Exit status: $myexec_retval\n";
	$foo .= "  '$cmd'\n";
	$foo .= "\n";
	$foo .= $myexec_output;
	TBERROR($foo, 0);
	return 1;
    }
    return 0;
}

517 518 519
#
# Verify page arguments.
#
520
$optargs = RequiredPageArguments("ajax_route",    PAGEARG_STRING,
521 522 523 524
				 "ajax_method",   PAGEARG_STRING,
				 "ajax_args",     PAGEARG_ARRAY);

#
525
# Verify page and method.
526
#
527 528 529
if (! array_key_exists($ajax_route, $routing)) {
    SPITAJAX_ERROR(1, "Invalid route: $ajax_route");
    exit(1);
530
}
531 532 533
if (! array_key_exists($ajax_method, $routing[$ajax_route]["methods"])) {
    SPITAJAX_ERROR(1, "Invalid method: $ajax_route,$ajax_method");
    exit(1);
534
}
535
CheckLoginForAjax($routing[$ajax_route]);
536 537 538
include($routing[$ajax_route]["file"]);
call_user_func($routing[$ajax_route]["methods"][$ajax_method]);

539
?>