Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
@app.route('/systems/edit/', methods=['GET', 'POST'])
@cortex.lib.user.login_required
def systems_edit(id):
if request.method == 'GET' or request.method == 'HEAD':
# Get the system out of the database
system = cortex.lib.systems.get_system_by_id(id)
system_class = cortex.lib.classes.get(system['class'])
return render_template('systems-edit.html', system=system, system_class=system_class, active='systems', title=system['name'])
elif request.method == 'POST':
try:
# Get a cursor to the database
cur = g.db.cursor(mysql.cursors.DictCursor)
# Update the system
cur.execute('UPDATE `systems` SET `allocation_comment` = %s, `cmdb_id` = %s, `vmware_uuid` = %s WHERE `id` = %s', (request.form['allocation_comment'], request.form['cmdb_id'], request.form['vmware_uuid'], id))
g.db.commit();
@app.route('/systems/bulk/save', methods=['POST'])
@cortex.lib.user.login_required
def systems_bulk_save():
"""This is a POST handler used to set comments for a series of existing
systems which have been allocated already"""
# Check user permissions
if not does_user_have_permission("systems.allocate_name"):
abort(403)
found_keys = []
# Find a list of systems from the form. Each of the form input elements
# containing a system comment has a name that starts "system_comment_"
for key, value in request.form.iteritems():
if key.startswith("system_comment_"):
# Yay we found one! blindly update it!
updateid = key.replace("system_comment_", "")
@cortex.lib.user.login_required
def puppet_catalog(node):
"""Show the Puppet catalog for a given node."""
# Get the system
system = cortex.lib.systems.get_system_by_puppet_certname(node)
if system == None:
abort(404)
## Check if the user is allowed to edit the Puppet configuration
if not does_user_have_system_permission(system['id'],"view.puppet.catalog","systems.all.view.puppet.catalog"):
abort(403)
dbnode = None
catalog = None
try:
@app.route('/systems/expired')
@cortex.lib.user.login_required
def systems_expired():
"""Shows the list of expired systems to the user."""
# Check user permissions
if not does_user_have_permission("systems.all.view"):
abort(403)
# Get the list of active classes (used to populate the tab bar)
classes = cortex.lib.classes.list()
# Render
return render_template('systems/list.html', classes=classes, active='systems', title="Expired systems", expired=True, hide_inactive=True)
@cortex.lib.user.login_required
def systems():
"""Shows the list of known systems to the user."""
# Check user permissions
if not (does_user_have_permission("systems.all.view") or does_user_have_permission("systems.own.view")):
abort(403)
# Get the list of active classes (used to populate the tab bar)
classes = {}
if does_user_have_permission("systems.all.view"):
classes = cortex.lib.classes.get_list()
# Get the search string, if any
q = request.args.get('q', None)
# Strip any leading and or trailing spaces
@app.route('/systems/vmware/json', methods=['POST'])
@cortex.lib.user.login_required
@app.disable_csrf_check
def systems_vmware_json():
"""Used by DataTables to extract infromation from the VMware cache. The
parameters and return format are dictated by DataTables"""
# Check user permissions
# either they have systems.all.view (view all systems)
# OR they have at least one instance of the per-system permission 'edit.vmware'
# (cos if they have that they need to be able to list the VMWare UUIDs)
# or if they have systems.all.edit.vmware
if not does_user_have_permission("systems.all.view") and not does_user_have_permission("systems.all.edit.vmware"):
if not does_user_have_any_system_permission("edit.vmware"):
abort(403)
# Extract information from DataTables
@cortex.lib.user.login_required
@app.disable_csrf_check
def systems_cmdb_json():
"""Used by DataTables to extract information from the ServiceNow CMDB CI
cache. The parameters and return format are as dictated by DataTables"""
# Check user permissions
# either they have systems.all.view (view all systems)
# OR they have at least one instance of the per-system permission 'edit.cmdb'
# (cos if they have that they need to be able to list the CMDB entries)
# or if they have systems.all.edit.cmdb
if not does_user_have_permission("systems.all.view") and not does_user_have_permission("systems.all.edit.cmdb"):
if not does_user_have_any_system_permission("edit.cmdb"):
abort(403)
# Extract information from DataTables
@cortex.lib.user.login_required
def system_status(id):
# Check user permissions. User must have either systems.all or specific
# access to the system
if not does_user_have_system_permission(id,"view.overview","systems.all.view"):
abort(403)
system = cortex.lib.systems.get_system_by_id(id)
# Ensure that the system actually exists, and return a 404 if it doesn't
if system is None:
abort(404)
data = {
'hostname': '',
'dns_resolvers': [],
'search_domain': '',
@cortex.lib.user.login_required
def puppet_dashboard():
"""Handles the Puppet dashboard page."""
# Check user permissions
if not does_user_have_permission("puppet.dashboard.view"):
abort(403)
try:
stats=cortex.lib.puppet.puppetdb_get_node_stats()
except Exception as e:
return stderr("Unable to connect to PuppetDB","Unable to connect to the Puppet database. The error was: " + type(e).__name__ + " - " + str(e))
return render_template('puppet/dashboard.html', stats=stats,active='puppet', title="Puppet Dashboard")