robbond/pedwfrontend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added hardening on documents link

Browse Source
This commit is contained in:
robbond
2021-11-16 19:12:03 +00:00
parent c6d4743f73
commit 831f0497c5
6 changed files with 101 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.env.local
+2 -2
View File
@@ -37,6 +37,6 @@ BASIC_AUTH_CREDENTIALS,, = pinswg:password|pinswg2:password2
NEXT_PUBLIC_ISHARESECRETPHRASE = "Secret phrase" NEXT_PUBLIC_ISHARESECRETPHRASE = "Secret phrase"
HASHKEY = 028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c HASHKEY = "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c"
NEXT_PUBLIC_HASHKEY = 028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c NEXT_PUBLIC_HASHKEY = "028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c"
actions/index.js
+26 -68
View File
@@ -15,8 +15,7 @@ if (process.browser) {
} else { } else {
BASE_URL = process.env.API_ROOT || `http://localhost:${port}`; BASE_URL = process.env.API_ROOT || `http://localhost:${port}`;
} }
const WORDKEY = const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
"028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c";
const API_PATH = "/api/data/v8.2/"; const API_PATH = "/api/data/v8.2/";
@@ -79,34 +78,6 @@ export const getSASToken = () => {
return token; return token;
}; };
const accessToken =
"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IlVXelVaa0U3OEx0NVBGRkJ0LV9seVdoMjdjTSIsImtpZCI6IlVXelVaa0U3OEx0NVBGRkJ0LV9seVdoMjdjTSJ9.eyJhdWQiOiJodHRwczovL2RldmNybTIwMTYubGxjZHQuZ292LndhbGVzLyIsImlzcyI6Imh0dHA6Ly9mcy50ZXN0Lmdvdi53YWxlcy9hZGZzL3NlcnZpY2VzL3RydXN0IiwiaWF0IjoxNjMyMTIxMjkxLCJuYmYiOjE2MzIxMjEyOTEsImV4cCI6MTYzMjE1MDA5MSwidXBuIjpbIlJvYmVydC5Cb25kQHRlc3QuZ292LndhbGVzIiwicm9iZXJ0LmJvbmRAdGVzdC5nb3Yud2FsZXMiXSwicHJpbWFyeXNpZCI6IlMtMS01LTIxLTE4MDA4NDIwNzYtMjQ1NTYwNjU5LTQyMTU3NzU0NjktMTY2MjgiLCJ1bmlxdWVfbmFtZSI6IlhNXFxCb25kUiIsImFwcHR5cGUiOiJQdWJsaWMiLCJhcHBpZCI6IjQyN2ZhNzljLWI1ZmMtNDJhZC04M2Q0LTQxMGIwMzk0OGFiNiIsImF1dGhtZXRob2QiOiJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dzLzIwMDgvMDYvaWRlbnRpdHkvYXV0aGVudGljYXRpb25tZXRob2Qvd2luZG93cyIsImF1dGhfdGltZSI6IjIwMjEtMDktMjBUMDc6MDE6MzEuNDYzWiIsInZlciI6IjEuMCJ9.W0ID2nCBYVxh8T1eQqWKk2Wh45kRbRzCICfzrZNAs-4u54yl0UJUcVihyI8EBmQeALCEc5eY99DjK0gaqzCdJqxbxol8yk5LrFvhV5UkCiZ7SO2Wq1cLReWHVsgz39qBtrZ8vlqqZsv7DsEaRJQbtj8Djnx26Wb_kcNu-tuXwUBF0uR5GLFFvJfM3PzkRCY-ZPOTbvPTb73oN_NKe6BrsVjyaR9xSXsRJjgHPmJgWgnvq-2X0Dj7LCwXSEygDDOGlF1yqqN0Lv6qplhQoH-heZlC1K6qe_92nHPswXag6uN5nxTmk1Qw6zJt_aHMnXdwa18ghh4hGx5R0Jz53X113Q";
//const SASToken = getSASToken();
const crmHeaders = {
withCredentials: true,
headers: {
"Content-Type": "application/json; charset=utf-8",
"OData-MaxVersion": "4.0",
"OData-Version": "4.0",
"Accept": "application/json",
"Prefer": 'odata.include-annotations="*",return=representation',
"Authorization": "Bearer " + accessToken,
},
};
const crmHeadersReturn = {
headers: {
"OData-MaxVersion": "4.0",
"OData-Version": "4.0",
"Accept": "application/json",
"Prefer": "return=representation",
"Content-Type": "application/json",
"Authorization": "Bearer " + accessToken,
},
};
const azureHeaders = (SASToken) => { const azureHeaders = (SASToken) => {
return { return {
headers: { headers: {
@@ -135,16 +106,11 @@ const azureHeadersPaged = (SASToken) => {
}; };
const hashProxyPath = (queryPath) => { const hashProxyPath = (queryPath) => {
//console.log(CryptoJS.enc.Hex.parse(wordKey));
//console.log("hasshing this: ", queryPath);
var hashlink = CryptoJS.HmacSHA256( var hashlink = CryptoJS.HmacSHA256(
queryPath, queryPath,
CryptoJS.enc.Hex.parse(WORDKEY) CryptoJS.enc.Hex.parse(WORDKEY)
); );
hashlink = hashlink.toString(); hashlink = hashlink.toString();
hashlink = encodeURI(hashlink);
console.log(hashlink);
return "&hash=" + hashlink; return "&hash=" + hashlink;
}; };
@@ -179,7 +145,7 @@ export const getBasicSearch = (token, searchString) => {
export const getBasicSearchPaged = (searchString, pageNumber) => { export const getBasicSearchPaged = (searchString, pageNumber) => {
//console.log("\n\n", token, searchString); //console.log("\n\n", token, searchString);
console.log(typeof pageNumber != "undefined"); //console.log(typeof pageNumber != "undefined");
var queryUrl = var queryUrl =
"/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=(contains(title, '" + "/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=(contains(title, '" +
@@ -188,10 +154,10 @@ export const getBasicSearchPaged = (searchString, pageNumber) => {
searchString + searchString +
"')) and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" + "')) and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + '<cookie pagenumber="' + pageNumber + '" />'
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
//console.log(queryUrl);
return axios return axios
.get(queryUrl + hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => { .then((res) => {
@@ -227,12 +193,11 @@ export const getBasicDNSSearchPaged = (pageNumber) => {
var queryUrl = var queryUrl =
"/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=pinswg_appealcasetype eq 846040011 and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" + "/api/proxy/incidents?$select=numberofchildincidents,_accountid_value,_customerid_value,_pinswg_associatedlpa_value,_ownerid_value,pinswg_appealcasetype,statuscode,ticketnumber,title, _primarycontactid_value&$expand=primarycontactid($select=fullname)&$filter=pinswg_appealcasetype eq 846040011 and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + '<cookie pagenumber="' + pageNumber + '" />'
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
return axios return axios
.get(hashProxyPath(queryUrl), azureHeadersPaged(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
return error.response; return error.response;
@@ -325,12 +290,11 @@ export const getAdvancedSearchPaged = (searchString, pageNumber) => {
queryString + queryString +
" and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" + " and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true&$orderby=createdon desc&$count=true" +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
return axios return axios
.get(hashProxyPath(queryUrl), azureHeadersPaged(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
let ErrResponse = { let ErrResponse = {
@@ -435,9 +399,8 @@ export const getSearchDocumentDetailsPaged = (incidentID, pageNumber) => {
encodeURI('<cookie pagenumber="' + pageNumber + '" />') encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
hashProxyPath(queryUrl);
return axios return axios
.get(hashProxyPath(queryUrl), azureHeadersPaged(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -451,11 +414,10 @@ export const getSearchDocumentHistoryPaged = (documentID, pageNumber) => {
"/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " + "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
documentID + documentID +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
return axios return axios
.get(hashProxyPath(queryUrl), azureHeadersPaged(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -470,7 +432,7 @@ export const getSearchDocumentDetails1 = (incidentID) => {
incidentID + incidentID +
"&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference"; "&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference";
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -485,11 +447,10 @@ export const getSearchDocumentDetails1Paged = (incidentID, pageNumber) => {
incidentID + incidentID +
"&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference" + "&$select=pinswg_isharedocumentlocations,_pinswg_documentids_value,pinswg_isharelabelcasetype,pinswg_isharelabellpaname,pinswg_publishtoweb,pinswg_uploadstatus,pinswg_isharedocumentclassification,pinswg_isharedocumentreference" +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -503,7 +464,7 @@ export const getSearchDocumentHistory1 = (documentID) => {
"/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " + "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
documentID; documentID;
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => { .then((res) => {
return res.data; return res.data;
}) })
@@ -519,11 +480,10 @@ export const getSearchDocumentHistory1Paged = (documentID, pageNumber) => {
"/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " + "/api/proxy/pinswg_documenthistories?$count=true&$select=_pinswg_documentid_value,pinswg_createddate,pinswg_state,pinswg_fileexists,statecode,pinswg_publisheddate&$filter=_pinswg_documentid_value eq " +
documentID + documentID +
(typeof pageNumber != "undefined" (typeof pageNumber != "undefined"
? "&$skiptoken=" + ? "&$skiptoken=" + ('<cookie pagenumber="' + pageNumber + '" />')
encodeURI('<cookie pagenumber="' + pageNumber + '" />')
: ""); : "");
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => { .then((res) => {
return res.data; return res.data;
}) })
@@ -556,7 +516,7 @@ export const getBasicDNSSearchDetailsPaged = (caseReference) => {
"'&$count=true"; "'&$count=true";
return axios return axios
.get(hashProxyPath(queryUrl), azureHeadersPaged(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -565,14 +525,12 @@ export const getBasicDNSSearchDetailsPaged = (caseReference) => {
export const getLinkedCases = (parentIncidentid) => { export const getLinkedCases = (parentIncidentid) => {
//console.log(parentIncidentid); //console.log(parentIncidentid);
var token = getSASToken();
var queryUrl = var queryUrl =
"/api/proxy/incidents?$count=true&$filter=_parentcaseid_value eq " + "/api/proxy/incidents?$count=true&$filter=_parentcaseid_value eq " +
parentIncidentid + parentIncidentid +
" and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true &$select=title, incidentid"; " and pinswg_appealcasetype ne null and pinswg_publishtoweb eq true &$select=title, incidentid";
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => { .then((res) => {
//console.log(" linked date", res.data); //console.log(" linked date", res.data);
return res.data; return res.data;
@@ -732,7 +690,7 @@ export const getLogin = (emailAddress, pwd) => {
"'&$count=true&$select=emailaddress1,%20contactid,pinswg_custom_password, yomifullname, firstname, lastname"; "'&$count=true&$select=emailaddress1,%20contactid,pinswg_custom_password, yomifullname, firstname, lastname";
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -855,7 +813,7 @@ export const getMyRepresentationsProxy = (token, loggedInUserId) => {
loggedInUserId + loggedInUserId +
"&$count=true&$orderby=createdon desc"; "&$count=true&$orderby=createdon desc";
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("this serror", error); console.log("this serror", error);
@@ -892,7 +850,7 @@ export const getRepresentations = (incidentID) => {
incidentID + incidentID +
" and pinswg_publishtoweb eq true&$count=true&$orderby=createdon desc"; " and pinswg_publishtoweb eq true&$count=true&$orderby=createdon desc";
return axios return axios
.get(hashProxyPath(queryUrl), azureHeaders(getSASToken())) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("this serror", error); console.log("this serror", error);
@@ -905,7 +863,7 @@ export const getRepresentationsProxy = (token, incidentID) => {
incidentID + incidentID +
"&$count=true&$orderby=createdon desc"; "&$count=true&$orderby=createdon desc";
return axios return axios
.get(hashProxyPath(queryUrl), azureHeaders(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("this serror", error); console.log("this serror", error);
@@ -933,7 +891,7 @@ export const getWatchedCasesProxy = (token, loggedInUserId) => {
loggedInUserId + loggedInUserId +
"&$count=true&$orderby=createdon desc"; "&$count=true&$orderby=createdon desc";
return axios return axios
.get(hashProxyPath(queryUrl), azureHeaders(token)) .get(queryUrl | +hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("this serror", error); console.log("this serror", error);
@@ -1030,7 +988,7 @@ export const getPortalModuleDetailsProxy = (
caseReference + caseReference +
"'&$count=true"; "'&$count=true";
return axios return axios
.get(hashProxyPath(queryUrl), azureHeaders(token)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
@@ -1044,7 +1002,7 @@ export const getEmailAccountCheck = (emailAddress) => {
emailAddress + emailAddress +
"'&$count=true&$select=emailaddress1, contactid"; "'&$count=true&$select=emailaddress1, contactid";
return axios return axios
.get(hashProxyPath(queryUrl)) .get(queryUrl + hashProxyPath(queryUrl))
.then((res) => res.data) .then((res) => res.data)
.catch((error) => { .catch((error) => {
console.log("thiserror", error); console.log("thiserror", error);
components/case/documents.js
+14 -14
View File
@@ -105,12 +105,9 @@ const DocumentDetails = (props) => {
> >
<dd className="govuk-summary-list__value govuk-!-font-size-16 "> <dd className="govuk-summary-list__value govuk-!-font-size-16 ">
<a <a
href={ href={encryptDocReference(
"/api/proxy/documents/download/" + detailsObj.pinswg_isharedocumentreference
encryptDocReference( )}
detailsObj.pinswg_isharedocumentreference
)
}
> >
<span className="results-visually-hidden"> <span className="results-visually-hidden">
{t( {t(
@@ -194,15 +191,18 @@ const DocumentDetails = (props) => {
); );
}; };
const encryptDocReference = (documentRef) => { const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
var encrypted = encodeURIComponent(
CryptoJS.AES.encrypt(
documentRef,
process.env.NEXT_PUBLIC_ISHARESECRETPHRASE
)
);
return encrypted; const encryptDocReference = (documentRef) => {
var hashlink = CryptoJS.HmacSHA256(
"/api/proxy/documents/download/" + documentRef,
CryptoJS.enc.Hex.parse(WORDKEY)
);
hashlink = hashlink.toString();
return (
"/api/proxy/documents/download/" + documentRef + "&hash=" + hashlink
);
}; };
useEffect(() => { useEffect(() => {
components/case/summaryTypes/pinswg_dnsid.js
+13 -1
View File
@@ -263,7 +263,19 @@ const Pinswg_dnsid = (props) => {
detailsObj.pinswg_webaddress + detailsObj.pinswg_webaddress +
'")].value_cy' '")].value_cy'
) )
: detailsObj.pinswg_webaddress || : (
<a
target="_blank"
rel="noopener"
href={
detailsObj.pinswg_webaddress
}
>
{
detailsObj.pinswg_webaddress
}
</a>
) ||
t( t(
"case:summary-no-date-entered-label" "case:summary-no-date-entered-label"
)} )}
components/search/dnssearchresults.js
+1 -1
View File
@@ -268,7 +268,7 @@ const DNSSearchResults = (props) => {
//console.log("getting details", data); //console.log("getting details", data);
return getSearchDetailsPaged(data).then((data) => { return getSearchDetailsPaged(data).then((data) => {
setSearchDetails(data); setSearchDetails(data);
setShowSpinnerState(false); //setShowSpinnerState(false);
}); });
}); });
}; };
pages/api/proxy/[...route].js
+45 -74
View File
@@ -50,34 +50,23 @@ const getSASToken = () => {
}; };
function checkProxyPath(queryPath) { function checkProxyPath(queryPath) {
var urlHasHash = queryPath.indexOf("&hash="); const WORDKEY = process.env.NEXT_PUBLIC_HASHKEY;
//console.log(queryPath); //, urlHasHash, queryPath.split("&hash="));
const WORDKEY =
"028ffbae928d7191c0017f298260995f901d78eabde1436c0af0423459cc3715832136d84f68818d3a96399467b52143e273d4f3bf4ae190848891535421cd6c";
const wordKey = WORDKEY; const wordKey = WORDKEY;
//console.log(CryptoJS.enc.Hex.parse(wordKey));
var hashlink = CryptoJS.HmacSHA256( var hashlink = CryptoJS.HmacSHA256(
queryPath, decodeURI(queryPath),
CryptoJS.enc.Hex.parse(wordKey) CryptoJS.enc.Hex.parse(wordKey)
); );
hashlink = hashlink.toString(); hashlink = hashlink.toString();
hashlink = encodeURI(hashlink);
return hashlink; return hashlink;
} }
export default async function ApiProxy(req, res) { export default async function ApiProxy(req, res) {
//console.log(req.method);
var data = JSON.stringify(req.body); var data = JSON.stringify(req.body);
const SASToken = getSASToken(); const SASToken = getSASToken();
//console.log("the request", req.query.route, req.url);
var configNoData = { var configNoData = {
method: req.method, method: req.method,
//url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")", //url: PROXY_RELAY_URL + updateFormCollection + "(" + incidentId + ")",
@@ -125,67 +114,49 @@ export default async function ApiProxy(req, res) {
responseType: "arraybuffer", responseType: "arraybuffer",
}; };
return new Promise((resolve, reject) => { let hashCheckPath = req.url.split("&hash=")[0];
let hashCheckPath = req.url.split("&hash=")[0]; let hashCheckValue = req.url.split("&hash=")[1];
let hashCheckValue = req.url.split("&hash=")[1]; let hashFromRequest = checkProxyPath(hashCheckPath);
let hashFromRequest = checkProxyPath(hashCheckPath);
let apiPath = "";
// console.log(req.url); if (hashCheckValue == hashFromRequest) {
console.log("Check:", hashCheckValue); return new Promise((resolve, reject) => {
let hasDocument =
hashCheckPath.indexOf("/download") > 0 ? true : false;
// if (hashCheckPath > 0) { axios(
// hashCheckValue = req.url.split("&hash=")[1]; req.method == "GET"
// apiPath = req.url.split("&hash=")[0].split("/api/proxy")[1]; ? hasDocument
// } else { ? configDocument
// apiPath = req.url.split("/api/proxy")[1]; : configNoData
// } : config
//console.log(hashCheckPath); )
console.log("Calculated:", hashFromRequest); .then((response) => {
res.statusCode = 200;
//console.log(req.url.split("&hash=")[0].split("/api/proxy/")[1]); if (hasDocument) {
//console.log(hashCheckPath); res.setHeader(
// console.log("from proxy :", hashCheckValue); "Content-disposition",
// // console.log(req.url); "attachment; filename=" +
// // console.log(apiPath); response.headers["content-disposition"].split(
// console.log("hashing path", hashFromRequest); "filename="
)[1]
let hasDocument = apiPath.indexOf("/download") > 0 ? true : false; );
res.end(response.data);
// hashCheckValue == hashFromRequest } else {
//? res.setHeader("Content-Type", "application/json");
axios( // res.setHeader("Cache-Control", "max-age=1800000");
req.method == "GET" res.end(JSON.stringify(response.data));
? hasDocument }
? configDocument resolve();
: configNoData })
: config .catch((error) => {
) console.log("proxy response error", error);
.then((response) => { // res.json(error);
res.statusCode = 200; res.status(405).end();
if (hasDocument) { return resolve();
res.setHeader( });
"Content-disposition", });
"attachment; filename=" + } else {
response.headers["content-disposition"].split( res.status(405).end();
"filename=" return resolve();
)[1] }
);
res.end(response.data);
} else {
res.setHeader("Content-Type", "application/json");
// res.setHeader("Cache-Control", "max-age=1800000");
res.end(JSON.stringify(response.data));
}
resolve();
})
.catch((error) => {
console.log("proxy response error", error);
// res.json(error);
res.status(405).end();
return resolve();
});
// : res.status(405).end();
// return resolve();
});
} }