From 3bab3f4be1211d70bbc97fe30d2a3b3ffe0f72d4 Mon Sep 17 00:00:00 2001 From: Paulus Schoutsen Date: Tue, 28 Oct 2014 00:38:25 -0700 Subject: [PATCH] Frontend password checking is now done in polymer --- build_polymer | 2 +- homeassistant/components/http/__init__.py | 52 ++------ homeassistant/components/http/frontend.py | 2 +- .../components/http/www_static/frontend.html | 117 ++++++++++++++++-- .../polymer/home-assistant-main.html | 1 - .../http/www_static/polymer/splash-login.html | 96 ++++++++++++++ 6 files changed, 212 insertions(+), 58 deletions(-) create mode 100644 homeassistant/components/http/www_static/polymer/splash-login.html diff --git a/build_polymer b/build_polymer index 0f303489196..36595227592 100755 --- a/build_polymer +++ b/build_polymer @@ -4,7 +4,7 @@ cd homeassistant/components/http/www_static/polymer bower install cd .. cp polymer/bower_components/platform/platform.js polymer_platform.js -vulcanize -o frontend.html --inline polymer/home-assistant-main.html +vulcanize -o frontend.html --inline polymer/splash-login.html cd .. echo '""" DO NOT MODIFY. Auto-generated by build_polymer script """' > frontend.py echo 'VERSION = "'`md5 -q www_static/frontend.html`'"' >> frontend.py diff --git a/homeassistant/components/http/__init__.py b/homeassistant/components/http/__init__.py index 631c2fb269a..4720137f49e 100644 --- a/homeassistant/components/http/__init__.py +++ b/homeassistant/components/http/__init__.py @@ -301,10 +301,12 @@ class RequestHandler(SimpleHTTPRequestHandler): # Did we find a handler for the incoming request? if handle_request_method: - # Do not enforce api password for static files - if handle_request_method == self._handle_get_static or \ - self._verify_api_password(api_password): + # For API calls we need a valid password + if self.use_json and api_password != self.server.api_password: + self._message( + "API password missing or incorrect.", HTTP_UNAUTHORIZED) + else: handle_request_method(path_match, data) elif path_matched_but_not_method: @@ -333,44 +335,6 @@ class RequestHandler(SimpleHTTPRequestHandler): """ DELETE request handler. """ self._handle_request('DELETE') - def _verify_api_password(self, api_password): - """ Helper method to verify the API password - and take action if incorrect. """ - if api_password == self.server.api_password: - return True - - elif self.use_json: - self._message( - "API password missing or incorrect.", HTTP_UNAUTHORIZED) - - else: - self.send_response(HTTP_OK) - self.send_header('Content-type', 'text/html') - self.end_headers() - - self.wfile.write(( - "" - "Home Assistant" - "" - "" - "" - "" - "
" - "" - "
" - "").format(self.path).encode("UTF-8")) - - return False - # pylint: disable=unused-argument def _handle_get_root(self, path_match, data): """ Renders the debug interface. """ @@ -382,7 +346,7 @@ class RequestHandler(SimpleHTTPRequestHandler): self.end_headers() if self.server.development: - app_url = "polymer/home-assistant-main.html" + app_url = "polymer/splash-login.html" else: app_url = "frontend-{}.html".format(frontend.VERSION) @@ -400,8 +364,8 @@ class RequestHandler(SimpleHTTPRequestHandler): " minimum-scale=1.0, maximum-scale=1.0' />" "" "" - "" - "").format(app_url, self.server.api_password)) + "" + "").format(app_url, data.get('api_password', ''))) # pylint: disable=unused-argument def _handle_get_api(self, path_match, data): diff --git a/homeassistant/components/http/frontend.py b/homeassistant/components/http/frontend.py index 81ff2bb81de..c7afd7e46cc 100644 --- a/homeassistant/components/http/frontend.py +++ b/homeassistant/components/http/frontend.py @@ -1,2 +1,2 @@ """ DO NOT MODIFY. Auto-generated by build_polymer script """ -VERSION = "2242f67744e2c8bb92362bbd1489319f" +VERSION = "460fa7f075841b858b102678f13fb070" diff --git a/homeassistant/components/http/www_static/frontend.html b/homeassistant/components/http/www_static/frontend.html index 824cc5831d4..06411ab9744 100644 --- a/homeassistant/components/http/www_static/frontend.html +++ b/homeassistant/components/http/www_static/frontend.html @@ -674,8 +674,8 @@ mode: cover - -