Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
@app.route('/vmware/unlinked')
@cortex.lib.user.login_required
def vmware_data_unlinked():
"""Displays page containing a giant table of information of everything
we know about VMs which are not linked to Cortex system records. It is
currently hard coded to exclude virtual machines on the ECS cluster."""
# Check user permissions
if not does_user_have_permission("vmware.view"):
abort(403)
# Get a cursor to the database
curd = g.db.cursor(mysql.cursors.DictCursor)
# Get all the information about every VM
curd.execute('SELECT * FROM `vmware_cache_vm` WHERE `template` = 0 AND `cluster` != "ORANGE_ECS_TIDT" AND `uuid` NOT IN (SELECT `vmware_uuid` FROM `systems` WHERE `vmware_uuid` IS NOT NULL) ORDER BY `name`')
results = curd.fetchall()
@app.route('/puppet/nodes')
@app.route('/puppet/nodes/status/')
@cortex.lib.user.login_required
def puppet_nodes(status = None):
"""Handles the Puppet nodes list page"""
# Check user permissions
if not does_user_have_permission("puppet.nodes.view"):
abort(403)
# Get a cursor to the database
curd = g.db.cursor(mysql.cursors.DictCursor)
# Get Puppet nodes from the database
curd.execute('SELECT `puppet_nodes`.`certname` AS `certname`, `puppet_nodes`.`env` AS `env`, `systems`.`id` AS `id`, `systems`.`name` AS `name`, `systems`.`allocation_comment` AS `allocation_comment` FROM `puppet_nodes` LEFT JOIN `systems` ON `puppet_nodes`.`id` = `systems`.`id` ORDER BY `puppet_nodes`.`certname` ')
results = curd.fetchall()
@app.route('/favourites/', methods=['GET'])
@cortex.lib.user.login_required
def favourites_by_type(system_type):
return favourites(system_type)
@app.route('/certificates/add', methods=['GET', 'POST'])
@cortex.lib.user.login_required
def certificates_add():
"""Adds a certificate to the list of tracked certificates."""
if not does_user_have_permission("certificates.add"):
abort(403)
if request.method == 'GET':
# Just show the form
return render_template('certificates/add.html', active='certificates', title='Add Certificate')
elif request.method == 'POST':
# Extract the certificate from the request
if 'uploaded_cert' in request.files:
# Read the contents (maximum 1MB so we don't DoS ourselves with large files)
cert_data = request.files['uploaded_cert'].read(1048576)
elif 'pasted_cert' in request.form:
@app.route('/admin/events/json/', methods=['POST'])
@cortex.lib.user.login_required
@app.disable_csrf_check
def admin_events_json(event_source):
# Check user permissions
if not does_user_have_permission("events.view"):
abort(403)
# Get a cursor to the database
cur = g.db.cursor()
# Extract stuff from DataTables requests
(draw, start, length, order_column, order_asc, search, hide_frequent, filters) = _extract_datatables()
# Choose the order column
if order_column == 0:
order_by = "id"
@app.route('/systems/add', methods=['GET', 'POST'])
@cortex.lib.user.login_required
def systems_add_existing():
"""Handles the Add Existing System page, which can be used to add missing
systems to Cortex"""
# Check user permissions
if not does_user_have_permission("systems.add_existing"):
abort(403)
# Get the list of enabled classes
classes = cortex.lib.classes.get_list(hide_disabled=True)
# Get the list of Puppet environments
puppet_envs = cortex.lib.puppet.get_puppet_environments()
# On GET requests, just show the form
@app.route('/systems/download/csv')
@cortex.lib.user.login_required
def systems_download_csv():
"""Downloads the list of allocated server names as a CSV file."""
# Get the list of systems
cur = cortex.lib.systems.get_systems(return_cursor=True)
# Return the response
return Response(systems_csv_stream(cur), mimetype="text/csv", headers={'Content-Disposition': 'attachment; filename="systems.csv"'})
@app.route('/admin/events/')
@cortex.lib.user.login_required
def admin_events(src="all"):
"""Displays the list of events, excluding any system events"""
# Check user permissions
if not does_user_have_permission("events.view"):
abort(403)
# Render the page
return render_template('admin/events.html', active='admin', title="Events", event_source=src, json_source=url_for('admin_events_json', event_source=src))
@app.route('/puppet/catalog/')
@cortex.lib.user.login_required
def puppet_catalog(node):
"""Show the Puppet catalog for a given node."""
# Get the system
system = cortex.lib.systems.get_system_by_puppet_certname(node)
if system == None:
abort(404)
## Check if the user is allowed to edit the Puppet configuration
if not does_user_have_system_permission(system['id'],"view.puppet.catalog","systems.all.view.puppet.catalog"):
abort(403)
dbnode = None
catalog = None