update from RIFT as of 696b75d2fe9fb046261b08c616f1bcf6c0b54a9b third try

[osm/UI.git] / skyquake / framework / core / modules / routes / navigation.js

diff --git a/skyquake/framework/core/modules/routes/navigation.js b/skyquake/framework/core/modules/routes/navigation.js
index 82c7ec5..37e86e4 100644 (file)
--- a/skyquake/framework/core/modules/routes/navigation.js
+++ b/skyquake/framework/core/modules/routes/navigation.js
@@ -1,6 +1,6 @@
 
 /*
- * 
+ *
  *   Copyright 2016 RIFT.IO Inc
  *
  *   Licensed under the Apache License, Version 2.0 (the "License");
@@ -30,6 +30,7 @@ var navAPI = require('../api/navigation');
 var Router = require('express').Router();
 var utils = require('../../api_utils/utils');
 var configurationAPI = require('../api/configuration');
+var csrfCheck = require('../../api_utils/csrf').csrfCheck;
 
 Router.use(bodyParser.json());
 Router.use(cors());
@@ -37,48 +38,64 @@ Router.use(bodyParser.urlencoded({
     extended: true
 }));
 
-Router.get('/', cors(), function(req, res, next) {
-       res.redirect('/launchpad/?api_server=' + req.protocol + '://' + configurationAPI.globalConfiguration.get().api_server + '&upload_server=' + req.protocol + '://' + (configurationAPI.globalConfiguration.get().upload_server || req.hostname));
+//Should have a way of adding excluded routes to this via plugin registry, instead of hard coding
+Router.use(/^(?!.*(login\/idp|session|composer\/upload|composer\/update)).*/, function(req, res, next) {
+    var api_server = req.query['api_server'] || (req.protocol + '://' + configurationAPI.globalConfiguration.get().api_server);
+    if (req.session && req.session.loggedIn) {
+        switch (req.method) {
+            case 'POST':
+            case 'PUT':
+                csrfCheck(req, res, next);
+                break;
+            default:
+                next();
+                break;
+        }
+    } else {
+        console.log('Redirect to login.html');
+        res.redirect(utils.buildRedirectURL(req, configurationAPI.globalConfiguration, 'login', '&referer=' + encodeURIComponent(req.headers.referer)));
+    }
 });
 
+
 Router.get('/nav', cors(), function(req, res) {
-       navAPI.get(req).then(function(data) {
-               utils.sendSuccessResponse(data, res);
-       }, function(error) {
-               utils.sendErrorResponse(error, res);
-       });
+    navAPI.get(req).then(function(data) {
+        utils.sendSuccessResponse(data, res);
+    }, function(error) {
+        utils.sendErrorResponse(error, res);
+    });
 });
 
 Router.get('/nav/:plugin_id', cors(), function(req, res) {
-       navAPI.get(req).then(function(data) {
-               utils.sendSuccessResponse(data, res);
-       }, function(error) {
-               utils.sendErrorResponse(error, res);
-       });
+    navAPI.get(req).then(function(data) {
+        utils.sendSuccessResponse(data, res);
+    }, function(error) {
+        utils.sendErrorResponse(error, res);
+    });
 });
 
 Router.post('/nav/:plugin_id', cors(), function(req, res) {
-       navAPI.create(req).then(function(data) {
-               utils.sendSuccessResponse(data, res);
-       }, function(error) {
-               utils.sendErrorResponse(error, res);
-       });
+    navAPI.create(req).then(function(data) {
+        utils.sendSuccessResponse(data, res);
+    }, function(error) {
+        utils.sendErrorResponse(error, res);
+    });
 });
 
 Router.put('/nav/:plugin_id/:route_id', cors(), function(req, res) {
-       navAPI.update(req).then(function(data) {
-               utils.sendSuccessResponse(data, res);
-       }, function(error) {
-               utils.sendErrorResponse(error, res);
-       });
+    navAPI.update(req).then(function(data) {
+        utils.sendSuccessResponse(data, res);
+    }, function(error) {
+        utils.sendErrorResponse(error, res);
+    });
 });
 
 Router.delete('/nav/:plugin_id/:route_id', cors(), function(req, res) {
-       navAPI.delete(req).then(function(data) {
-               utils.sendSuccessResponse(data, res);
-       }, function(error) {
-               utils.sendErrorResponse(error, res);
-       });
+    navAPI.delete(req).then(function(data) {
+        utils.sendSuccessResponse(data, res);
+    }, function(error) {
+        utils.sendErrorResponse(error, res);
+    });
 });