Files
Facilitor/APPL/API/api.inc
Jos Groot Lipman 8f5fb67942 FSN#29385 Concrete Reflective XSS uit de pentest
svn path=/Website/branches/v5.4.1/; revision=21386
2014-04-23 17:33:01 +00:00

110 lines
3.0 KiB
C++

<% /*
$Revision$
$Id$
File: api.inc
Description: Functies voor API's
Notes:
*/
function API_func(APIname, APIKEY)
{
this.APIname = APIname;
this.APIKEY = APIKEY;
var sql = "SELECT *"
+ " FROM fac_api"
+ " WHERE fac_api_name = " + safe.quoted_sql(APIname);
var oRs = Oracle.Execute(sql);
if (oRs.Eof)
{
this.error("Invalid API: " + APIname);
oRs.Close();
Response.End;
}
var sql2 = "SELECT prs_perslid_key, prs_perslid_naam"
+ " FROM prs_perslid"
+ " WHERE prs_perslid_apikey = " + safe.quoted_sql(APIKEY);
var oRs2 = Oracle.Execute(sql2);
if (oRs2.Eof)
{
this.error("Invalid APIKEY: " + APIKEY);
oRs2.Close();
Response.End;
};
__Log("API User is: " + oRs2("prs_perslid_naam"));
this.apidata =
{
APIname: APIname,
APIKEY: APIKEY,
file: oRs("fac_api_filepath").Value,
prs_perslid_key: oRs2("prs_perslid_key").Value,
loglevel: oRs("fac_api_loglevel").Value,
usrrap_key: oRs("fac_usrrap_key").Value,
stylesheet: oRs("fac_api_stylesheet").Value,
import_app_key: oRs("fac_import_app_key").Value,
options: eval("("+oRs("fac_api_options_json").Value+")"),
viewmapping: eval("("+oRs("fac_api_viewmapping_json").Value+")")
};
oRs2.Close();
oRs.Close();
// Wij doen niets met eventuele prs_perslid_key; dat doet loginTry.asp maar voor ons
}
API_func.prototype.error = function (msg)
{
if (JSON_Result && JSON) // Merk op dat 'invalid APIKEY' al door /default.asp
{ // is onderschept en dus niet hier komt.
Response.Write(JSON.stringify({ success: false, message: msg }));
}
else
{
Response.Status = "500 Internal server error";
Response.Write(safe.html(msg));
}
Response.End;
}
// LET OP: Verwacht wordt dat de JSON-code in de body utf-8 encoded is, niet windows-1252!
// (in de praktijk moet je *moeite* doen om windows-1252 te krijgen dus dit is handiger)
function RequestJSON()
{
var jvraag;
if(Request.TotalBytes > 0)
{
var lngBytesCount = Request.TotalBytes;
jvraag = BytesToStr(Request.BinaryRead(lngBytesCount));
}
__Log("Vraag: " + jvraag);
try
{
var vraag = myJSON.parse(jvraag);
}
catch (e)
{
__DoLog("eval faalt met: {0}<br>{1}".format(e.description, jvraag), "ffff00");
return null;
}
return vraag;
}
function BytesToStr(bytes)
{
var stream = Server.CreateObject("ADODB.STREAM");
stream.type = 1;
stream.open;
stream.write(bytes);
stream.position = 0;
stream.type = 2; // Text
stream.charset = "utf-8";
var sOut = stream.readtext();
stream.close;
return sOut;
}
%>