89 lines
3.0 KiB
C
89 lines
3.0 KiB
C
String test_demo_normalize_ip(String ip)
|
|
{
|
|
if(ip.find(",") != String::npos)
|
|
ip = trim(nibble(ip, ","));
|
|
ip = trim(ip);
|
|
if(str_starts_with(ip, "::ffff:"))
|
|
ip = ip.substr(7);
|
|
return(ip);
|
|
}
|
|
|
|
bool test_demo_ip_is_private(String ip)
|
|
{
|
|
ip = trim(ip);
|
|
if(ip == "" || ip == "localhost" || ip == "::1")
|
|
return(true);
|
|
if(str_starts_with(ip, "127."))
|
|
return(true);
|
|
if(str_starts_with(ip, "10."))
|
|
return(true);
|
|
if(str_starts_with(ip, "192.168."))
|
|
return(true);
|
|
if(str_starts_with(ip, "fc") || str_starts_with(ip, "fd") || str_starts_with(ip, "fe80:"))
|
|
return(true);
|
|
|
|
auto parts = split(ip, ".");
|
|
if(parts.size() == 4 && parts[0] == "172")
|
|
{
|
|
s64 second = int_val(parts[1]);
|
|
if(second >= 16 && second <= 31)
|
|
return(true);
|
|
}
|
|
|
|
return(false);
|
|
}
|
|
|
|
String test_demo_request_ip(Request& context)
|
|
{
|
|
String remote_ip = test_demo_normalize_ip(context.params["REMOTE_ADDR"]);
|
|
String forwarded_ip = test_demo_normalize_ip(first(context.params["HTTP_X_FORWARDED_FOR"], context.params["HTTP_X_REAL_IP"]));
|
|
|
|
if(remote_ip != "" && !test_demo_ip_is_private(remote_ip))
|
|
return(remote_ip);
|
|
if(forwarded_ip != "")
|
|
return(forwarded_ip);
|
|
return(remote_ip);
|
|
}
|
|
|
|
bool test_demo_request_allowed(Request& context)
|
|
{
|
|
return(test_demo_ip_is_private(test_demo_request_ip(context)));
|
|
}
|
|
|
|
void test_demo_render_restricted_html(Request& context, String title, String risk, String style_href = "style.css", String back_href = "index.uce")
|
|
{
|
|
context.set_status(403, "Restricted");
|
|
String request_ip = first(test_demo_request_ip(context), "unknown");
|
|
print("<html><head>");
|
|
print("<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"></meta>");
|
|
print("<link rel=\"stylesheet\" href='", html_escape(style_href), "?v=", time(), "'></link>");
|
|
print("</head><body>");
|
|
print("<h1><a href=\"", html_escape(back_href), "\">UCE Test</a>: ", html_escape(title), "</h1>");
|
|
print("<p>This test page is disabled for public access because it can ", html_escape(risk), ".</p>");
|
|
print("<p>It remains available from localhost or a private network for local development and server administration.</p>");
|
|
print("<p>Detected request source: <code>", html_escape(request_ip), "</code></p>");
|
|
print("</body></html>");
|
|
}
|
|
|
|
void test_demo_render_restricted_text(Request& context, String title, String risk)
|
|
{
|
|
context.set_status(403, "Restricted");
|
|
context.header["Content-Type"] = "text/plain; charset=utf-8";
|
|
print(title, ": restricted on public access\n");
|
|
print("Reason: this test can ", risk, ".\n");
|
|
print("Detected request source: ", first(test_demo_request_ip(context), "unknown"), "\n");
|
|
}
|
|
|
|
void test_demo_render_restricted_json(Request& context, String title, String risk)
|
|
{
|
|
context.set_status(403, "Restricted");
|
|
context.header["Content-Type"] = "application/json; charset=utf-8";
|
|
DValue payload;
|
|
payload["ok"].set_bool(false);
|
|
payload["error"] = "restricted";
|
|
payload["title"] = title;
|
|
payload["reason"] = "This test is disabled for public access because it can " + risk + ".";
|
|
payload["request_ip"] = first(test_demo_request_ip(context), "unknown");
|
|
print(json_encode(payload));
|
|
}
|