Mercurial > farol > farol
annotate farol/producttree.py @ 78:264d4579f6bf
More input validation
| author | Benoît Allard <benoit.allard@greenbone.net> |
|---|---|
| date | Thu, 09 Oct 2014 12:15:52 +0200 |
| parents | ce49bd1512dd |
| children | c00f20bd90ba |
| rev | line source |
|---|---|
| 0 | 1 # -*- encoding: utf-8 -*- |
| 2 # Description: | |
| 3 # Web stuff about the ProductTree | |
| 4 # | |
| 5 # Authors: | |
| 6 # Benoît Allard <benoit.allard@greenbone.net> | |
| 7 # | |
| 8 # Copyright: | |
| 9 # Copyright (C) 2014 Greenbone Networks GmbH | |
| 10 # | |
| 11 # This program is free software; you can redistribute it and/or | |
| 12 # modify it under the terms of the GNU General Public License | |
| 13 # as published by the Free Software Foundation; either version 2 | |
| 14 # of the License, or (at your option) any later version. | |
| 15 # | |
| 16 # This program is distributed in the hope that it will be useful, | |
| 17 # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| 19 # GNU General Public License for more details. | |
| 20 # | |
| 21 # You should have received a copy of the GNU General Public License | |
| 22 # along with this program; if not, write to the Free Software | |
| 23 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| 24 | |
| 25 """\ | |
| 26 Web-stuff about the producttree | |
| 27 """ | |
| 28 | |
| 29 from functools import wraps | |
| 30 | |
| 31 from flask import Blueprint, render_template, redirect, url_for, abort, request, flash | |
| 32 | |
| 33 from farolluz.cvrf import (CVRFProductBranch, CVRFFullProductName, | |
| 34 CVRFRelationship, CVRFGroup) | |
| 35 from .session import document_required, get_current | |
| 36 | |
| 37 producttree = Blueprint('producttree', __name__) | |
| 38 | |
| 39 def producttree_required(f): | |
| 40 @wraps(f) | |
| 41 def decorated_function(*args, **kwargs): | |
| 42 if get_current()._producttree is None: | |
| 43 flash('Operation invalid without producttree', 'warning') | |
|
22
dbfe89e3c6fe
Fix producttree urls
Benoît Allard <benoit.allard@greenbone.net>
parents:
0
diff
changeset
|
44 return redirect(url_for('document.view')) |
| 0 | 45 return f(*args, **kwargs) |
| 46 return decorated_function | |
| 47 | |
| 48 @producttree.route('/create', methods=['POST']) | |
| 49 @document_required | |
| 50 def create(): | |
| 51 get_current().createProductTree() | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
52 return redirect(url_for('.view')) |
| 0 | 53 |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
54 @producttree.route('/') |
|
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
55 @document_required |
|
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
56 @producttree_required |
|
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
57 def view(): |
|
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
58 return render_template('producttree/view.j2', |
|
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
59 producttree=get_current()._producttree) |
| 0 | 60 |
| 61 @producttree.route('/branch/<path:path>/edit', methods=['GET', 'POST']) | |
| 62 @document_required | |
| 63 @producttree_required | |
| 64 def edit_branch(path): | |
| 65 path = [int(p) for p in path.split('/')] | |
| 66 cvrf = get_current() | |
| 67 ptree = cvrf._producttree | |
|
78
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
68 try: branch = cvrf._producttree.getBranch(path) |
|
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
69 except (ValueError, IndexError): abort(404) |
| 0 | 70 if request.method != 'POST': |
| 71 branches = [('', '')] + [(b.getName(), b.getPath(True)) for b in ptree.getNotTerminalBranches(branch)] | |
| 72 return render_template('producttree/edit_branch.j2', branch=branch, branches=branches, types=branch.TYPES) | |
| 73 | |
| 74 pbranch = ptree | |
| 75 if request.form['parent']: | |
|
78
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
76 try: pbranch = ptree.getBranch([int(p) for p in request.form['parent'].split('/')]) |
|
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
77 except (ValueError, IndexError): abort(404) |
| 0 | 78 |
| 79 if pbranch is not branch.getParent(): | |
| 80 # We have to 're-link' the element ... | |
| 81 # 1. unlink | |
| 82 branch.unlink() | |
| 83 # 2. set the new parent | |
| 84 branch._parentbranch = pbranch | |
| 85 # 3. add to the Tree (again) | |
| 86 ptree.addBranch(branch) | |
| 87 | |
| 88 branch._type = request.form['type'] | |
| 89 branch._name = request.form['name'] | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
90 return redirect(url_for('.view')) |
| 0 | 91 |
| 92 @producttree.route('/branch/add', methods=['GET', 'POST']) | |
| 93 @document_required | |
| 94 @producttree_required | |
| 95 def add_branch(): | |
| 96 cvrf = get_current() | |
| 97 ptree = cvrf._producttree | |
| 98 if request.method != 'POST': | |
| 99 branches = [('', '')] + [(b.getName(), b.getPath(True)) for b in ptree.getNotTerminalBranches()] | |
| 100 return render_template('producttree/edit_branch.j2', branch=CVRFProductBranch('', '', ptree), action='Add', branches=branches, types=CVRFProductBranch.TYPES) | |
| 101 | |
| 102 pbranch = ptree | |
| 103 if request.form['parent']: | |
|
78
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
104 try: pbranch = ptree.getBranch([int(p) for p in request.form['parent'].split('/')]) |
|
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
105 except (ValueError, IndexError): abort(404) |
| 0 | 106 branch = CVRFProductBranch(request.form['type'], request.form['name'], pbranch) |
| 107 ptree.addBranch(branch) | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
108 return redirect(url_for('.view')) |
| 0 | 109 |
| 110 @producttree.route('/product/<productid>') | |
| 111 @document_required | |
| 112 @producttree_required | |
| 113 def view_product(productid): | |
| 114 cvrf = get_current() | |
| 115 try: | |
| 116 product = cvrf.getProductForID(productid) | |
| 117 except IndexError: | |
| 118 abort(404) | |
| 119 return render_template('producttree/view_product.j2', product=product, cvrf=cvrf) | |
| 120 | |
| 121 @producttree.route('/product/<productid>/edit', methods=['GET', 'POST']) | |
| 122 @document_required | |
| 123 @producttree_required | |
| 124 def edit_product(productid): | |
| 125 cvrf = get_current() | |
| 126 ptree = cvrf._producttree | |
| 127 try: | |
| 128 product = cvrf.getProductForID(productid) | |
| 129 except KeyError: | |
| 130 abort(404) | |
| 131 | |
| 132 if request.method != 'POST': | |
| 133 current_rel = '' | |
| 134 if product.isRelationship(): | |
| 135 current_rel = str(ptree._relationships.index(product.getCurrentRelationship())) | |
| 136 leaves = [('', '')] + [(b.getName(), b.getPath(True)) for b in ptree.getOrphanedBranches(product)] | |
| 137 rels = [('', '')] + [(ptree.getNameOfRelationship(r), str(i)) for i, r in ptree.getOrphanedRelationships(product)] | |
| 138 return render_template('producttree/edit_product.j2', product=product, action='Update', orphaned_leaves=leaves, orphaned_relationships=rels, current_rel=current_rel) | |
| 139 | |
| 140 if request.form['parent_branch'] and request.form['parent_relationship']: | |
| 141 flash('Cannot set a parent branch and parent relationship', 'danger') | |
| 142 return redirect(url_for('.edit_product', productid=productid)) | |
| 143 | |
| 144 oldp = product._parent | |
| 145 if request.form['parent_branch']: | |
|
78
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
146 try: pbranch = ptree.getBranch([int(p) for p in request.form['parent_branch'].split('/')]) |
|
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
147 except (ValueError, IndexError): abort(404) |
| 0 | 148 if pbranch is not oldp: |
| 149 # Gonna be funny, needs re-link | |
| 150 product.unlink() | |
| 151 product._parent = pbranch | |
| 152 ptree.addProduct(product) | |
| 153 elif request.form['parent_relationship']: | |
| 154 prel = ptree._relationships[int(request.form['parent_relationship'])] | |
| 155 if prel is not oldp: | |
| 156 product.unlink() | |
| 157 product._parent = prel | |
| 158 ptree.addProduct(product) | |
| 159 else: | |
| 160 if ptree is not oldp: | |
| 161 product.unlink() | |
| 162 product._parent = ptree | |
| 163 ptree.addProduct(product) | |
| 164 | |
| 165 product._productid = request.form['productid'] | |
| 166 product._name = request.form['name'] | |
| 167 product._cpe = request.form['cpe'] or None | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
168 return redirect(url_for('.view')) |
| 0 | 169 |
| 170 @producttree.route('/product/add', methods=['GET', 'POST']) | |
| 171 @document_required | |
| 172 @producttree_required | |
| 173 def add_product(): | |
| 174 cvrf = get_current() | |
| 175 ptree = cvrf._producttree | |
| 176 | |
| 177 if request.method != 'POST': | |
| 178 product=CVRFFullProductName('', '', ptree) | |
| 179 leaves = [('', '')] + [(b.getName(), b.getPath(True)) for b in ptree.getOrphanedBranches()] | |
| 180 rels = [('', '')] + [(ptree.getNameOfRelationship(r), str(i)) for i, r in ptree.getOrphanedRelationships()] | |
| 181 return render_template('producttree/edit_product.j2', product=product, action='Add', orphaned_leaves=leaves, orphaned_relationships=rels, current_rel='') | |
| 182 | |
| 183 if request.form['parent_branch'] and request.form['parent_relationship']: | |
| 184 flash('Cannot set a parent branch and parent relationship', 'danger') | |
|
62
ce49bd1512dd
Make pyflafes a happier
Benoît Allard <benoit.allard@greenbone.net>
parents:
45
diff
changeset
|
185 return redirect(url_for('.add_product')) |
| 0 | 186 |
| 187 parent = ptree | |
| 188 if request.form['parent_branch']: | |
|
78
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
189 try: pbranch = ptree.getBranch([int(p) for p in request.form['parent_branch'].split('/')]) |
|
264d4579f6bf
More input validation
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
190 except (ValueError, IndexError): abort(404) |
| 0 | 191 elif request.form['parent_relationship']: |
| 192 parent = ptree._relationships[int(request.form['parent_relationship'])] | |
| 193 | |
| 194 product = CVRFFullProductName(request.form['productid'], request.form['name'], parent, request.form['cpe'] or None) | |
| 195 ptree.addProduct(product) | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
196 return redirect(url_for('.view')) |
| 0 | 197 |
| 198 @producttree.route('/relationship/<int:index>/edit', methods=['GET', 'POST']) | |
| 199 @document_required | |
| 200 @producttree_required | |
| 201 def edit_relationship(index): | |
| 202 cvrf = get_current() | |
| 203 ptree = cvrf._producttree | |
| 204 try: | |
| 205 rel = ptree._relationships[index] | |
| 206 except IndexError: | |
| 207 abort(404) | |
| 208 | |
| 209 if request.method != 'POST': | |
| 210 return render_template('producttree/edit_relationship.j2', productreference=rel._productreference, relationtype=rel._relationtype, relatestoproductreference=rel._relatestoproductreference, types=rel.TYPES) | |
| 211 | |
| 212 rel._productreference = request.form['productreference'] | |
| 213 rel._relationtype = request.form['relationtype'] | |
| 214 rel._relatestoproductreference = request.form['relatestoproductreference'] | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
215 return redirect(url_for('.view')) |
| 0 | 216 |
| 217 @producttree.route('/relationship/add', methods=['GET', 'POST']) | |
| 218 @document_required | |
| 219 @producttree_required | |
| 220 def add_relationship(): | |
| 221 cvrf = get_current() | |
| 222 ptree = cvrf._producttree | |
| 223 if len(ptree._products) < 2: | |
| 224 flash('You need to have at least two products to create a relationship', 'warning') | |
| 225 return redirect(url_for('.add_product')) | |
| 226 | |
| 227 if request.method != 'POST': | |
| 228 return render_template('producttree/edit_relationship.j2', action='Add', types=CVRFRelationship.TYPES) | |
| 229 | |
| 230 prodid1 = request.form['productreference'] | |
| 231 prodid2 = request.form['relatestoproductreference'] | |
| 232 | |
| 233 if prodid1 == prodid2: | |
| 234 flash('You cannot create a relationship with the same product twice', 'danger') | |
| 235 return redirect(url_for('.add_relationship')) | |
| 236 | |
| 237 rel = CVRFRelationship(prodid1, request.form['relationtype'], prodid2) | |
| 238 ptree.addRelationship(rel) | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
239 return redirect(url_for('.view')) |
| 0 | 240 |
| 241 @producttree.route('/group/<groupid>/edit', methods=['GET', 'POST']) | |
| 242 @document_required | |
| 243 @producttree_required | |
| 244 def edit_group(groupid): | |
| 245 try: | |
| 246 group = get_current().getGroupForID(groupid) | |
| 247 except KeyError: | |
| 248 abort(404) | |
| 249 if request.method != 'POST': | |
| 250 return render_template('producttree/edit_group.j2', groupid=group._groupid, description=group._description, productids=group._productids) | |
| 251 | |
| 252 group._groupid = request.form['groupid'] | |
| 253 group.setDescription(request.form['description'] or None) | |
| 254 group._productids = [] | |
| 255 for productid in request.form.getlist('products'): | |
| 256 group.addProductID(productid) | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
257 return redirect(url_for('.view')) |
| 0 | 258 |
| 259 @producttree.route('/group/add', methods=['GET', 'POST']) | |
| 260 @document_required | |
| 261 @producttree_required | |
| 262 def add_group(): | |
| 263 if request.method != 'POST': | |
| 264 return render_template('producttree/edit_group.j2', action='Add') | |
| 265 | |
| 266 group = CVRFGroup(request.form['groupid']) | |
| 267 group.setDescription(request.form['description'] or None) | |
| 268 for productid in request.form.getlist('products'): | |
| 269 group.addProductID(productid) | |
| 270 get_current()._producttree.addGroup(group) | |
|
45
7c4d001839e7
Move the Display of the ProductTree to its own page
Benoît Allard <benoit.allard@greenbone.net>
parents:
22
diff
changeset
|
271 return redirect(url_for('.view')) |