Skip to content

Commit 50be600

Browse files
author
root
committed
Seperated AJAX and API calls for security purposes
1 parent 62c1717 commit 50be600

File tree

4 files changed

+132
-28
lines changed

4 files changed

+132
-28
lines changed

‎appinfo/routes.php‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,17 +23,27 @@
2323

2424
$application->registerRoutes($this, array('routes' => array(
2525
array('name' => 'page#index', 'url' => '/', 'verb' => 'GET'),
26-
array('name' => 'ownnote_api#setval', 'url' => '/setval', 'verb' => 'POST'),
26+
array('name' => 'ownnote_api#ajaxsetval', 'url' => '/api/v0.2/ajaxsetval', 'verb' => 'POST'),
2727
array('name' => 'ownnote_api#index', 'url' => '/api/v0.2/ownnote', 'verb' => 'GET'),
28+
array('name' => 'ownnote_api#ajaxindex', 'url' => '/api/v0.2/ownnote/ajaxindex', 'verb' => 'GET'),
2829
array('name' => 'ownnote_api#remoteindex', 'url' => '/api/v0.2/ownnote/remoteindex', 'verb' => 'GET'),
2930
array('name' => 'ownnote_api#announcement', 'url' => '/api/v0.2/ownnote/announcement', 'verb' => 'GET'),
31+
array('name' => 'ownnote_api#ajaxannouncement', 'url' => '/api/v0.2/ownnote/ajaxannouncement', 'verb' => 'GET'),
3032
array('name' => 'ownnote_api#version', 'url' => '/api/v0.2/ownnote/version', 'verb' => 'GET'),
33+
array('name' => 'ownnote_api#ajaxversion', 'url' => '/api/v0.2/ownnote/ajaxversion', 'verb' => 'GET'),
3134
array('name' => 'ownnote_api#ren', 'url' => '/api/v0.2/ownnote/ren', 'verb' => 'POST'),
35+
array('name' => 'ownnote_api#ajaxren', 'url' => '/api/v0.2/ownnote/ajaxren', 'verb' => 'POST'),
3236
array('name' => 'ownnote_api#edit', 'url' => '/api/v0.2/ownnote/edit', 'verb' => 'POST'),
37+
array('name' => 'ownnote_api#ajaxedit', 'url' => '/api/v0.2/ownnote/ajaxedit', 'verb' => 'POST'),
3338
array('name' => 'ownnote_api#del', 'url' => '/api/v0.2/ownnote/del', 'verb' => 'POST'),
39+
array('name' => 'ownnote_api#ajaxdel', 'url' => '/api/v0.2/ownnote/ajaxdel', 'verb' => 'POST'),
3440
array('name' => 'ownnote_api#save', 'url' => '/api/v0.2/ownnote/save', 'verb' => 'POST'),
41+
array('name' => 'ownnote_api#ajaxsave', 'url' => '/api/v0.2/ownnote/ajaxsave', 'verb' => 'POST'),
3542
array('name' => 'ownnote_api#create', 'url' => '/api/v0.2/ownnote/create', 'verb' => 'POST'),
43+
array('name' => 'ownnote_api#ajaxcreate', 'url' => '/api/v0.2/ownnote/ajaxcreate', 'verb' => 'POST'),
3644
array('name' => 'ownnote_api#delgroup', 'url' => '/api/v0.2/ownnote/delgroup', 'verb' => 'POST'),
45+
array('name' => 'ownnote_api#ajaxdelgroup', 'url' => '/api/v0.2/ownnote/ajaxdelgroup', 'verb' => 'POST'),
3746
array('name' => 'ownnote_api#rengroup', 'url' => '/api/v0.2/ownnote/rengroup', 'verb' => 'POST'),
47+
array('name' => 'ownnote_api#ajaxrengroup', 'url' => '/api/v0.2/ownnote/ajaxrengroup', 'verb' => 'POST'),
3848
array('name' => 'ownnote_api#preflighted_cors', 'url' => '/api/v0.2/{path}', 'verb' => 'OPTIONS', 'requirements' => array('path' => '.+')),
3949
)));

‎controller/ownnoteapicontroller.php‎

Lines changed: 108 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,38 +26,140 @@ class OwnnoteApiController extends ApiController {
2626

2727
private $backend;
2828

29+
2930
public function __construct($appName, IRequest $request){
3031
parent::__construct($appName, $request);
3132
$this->backend = new Backend();
3233
}
3334

35+
/**
36+
* AJAX FUNCTIONS
37+
*/
38+
3439
/**
3540
* @NoAdminRequired
3641
* @CORS
37-
* @NoCSRFRequired
3842
*/
39-
public function index() {
43+
public function ajaxindex() {
4044
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
4145
return json_encode($this->backend->getListing($FOLDER, false));
4246
}
4347

48+
/**
49+
* @NoAdminRequired
50+
* @CORS
51+
*/
52+
public function ajaxannouncement() {
53+
return $this->backend->getAnnouncement();
54+
}
55+
56+
/**
57+
* @NoAdminRequired
58+
* @CORS
59+
*/
60+
public function ajaxcreate($name, $group) {
61+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
62+
if (isset($name) && isset($group))
63+
return $this->backend->createNote($FOLDER, $name, $group);
64+
}
65+
66+
/**
67+
* @NoAdminRequired
68+
* @CORS
69+
*/
70+
public function ajaxdel($name, $group) {
71+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
72+
if (isset($name) && isset($group))
73+
return $this->backend->deleteNote($FOLDER, $name, $group);
74+
}
75+
76+
/**
77+
* @NoAdminRequired
78+
* @CORS
79+
*/
80+
public function ajaxedit($name, $group) {
81+
if (isset($name) && isset($group))
82+
return $this->backend->editNote($name, $group);
83+
}
84+
85+
/**
86+
* @NoAdminRequired
87+
* @CORS
88+
*/
89+
public function ajaxsave($name, $group, $content) {
90+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
91+
if (isset($name) && isset($group) && isset($content))
92+
return $this->backend->saveNote($FOLDER, $name, $group, $content, 0);
93+
}
94+
95+
/**
96+
* @NoAdminRequired
97+
* @CORS
98+
*/
99+
public function ajaxren($name, $group, $newname, $newgroup) {
100+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
101+
if (isset($name) && isset($newname) && isset($group) && isset($newgroup))
102+
return $this->backend->renameNote($FOLDER, $name, $group, $newname, $newgroup);
103+
}
104+
105+
/**
106+
* @NoAdminRequired
107+
* @CORS
108+
*/
109+
public function ajaxdelgroup($group) {
110+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
111+
if (isset($group))
112+
return $this->backend->deleteGroup($FOLDER, $group);
113+
}
114+
115+
/**
116+
* @NoAdminRequired
117+
* @CORS
118+
*/
119+
public function ajaxrengroup($group, $newgroup) {
120+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
121+
if (isset($group) && isset($newgroup))
122+
return $this->backend->renameGroup($FOLDER, $group, $newgroup);
123+
}
124+
125+
/**
126+
* @NoAdminRequired
127+
* @CORS
128+
*/
129+
public function ajaxversion() {
130+
return $this->backend->getVersion();
131+
}
132+
133+
/**
134+
* @CORS
135+
*/
136+
public function ajaxsetval($field, $value) {
137+
return $this->backend->setAdminVal($field, $value);
138+
}
139+
140+
141+
/**
142+
* MOBILE FUNCTIONS
143+
*/
144+
44145
/**
45146
* @NoAdminRequired
46147
* @CORS
47148
* @NoCSRFRequired
48149
*/
49-
public function remoteindex() {
150+
public function index() {
50151
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
51-
return json_encode($this->backend->getListing($FOLDER, true));
152+
return json_encode($this->backend->getListing($FOLDER, false));
52153
}
53154

54155
/**
55156
* @NoAdminRequired
56157
* @CORS
57158
* @NoCSRFRequired
58159
*/
59-
public function announcement() {
60-
return $this->backend->getAnnouncement();
160+
public function remoteindex() {
161+
$FOLDER = \OCP\Config::getAppValue('ownnote', 'folder', 'Notes');
162+
return json_encode($this->backend->getListing($FOLDER, true));
61163
}
62164

63165
/**
@@ -144,12 +246,4 @@ public function rengroup($group, $newgroup) {
144246
public function version() {
145247
return $this->backend->getVersion();
146248
}
147-
148-
/**
149-
* @CORS
150-
* @NoCSRFRequired
151-
*/
152-
public function setval($field, $value) {
153-
return $this->backend->setAdminVal($field, $value);
154-
}
155249
}

‎js/admin.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ function ocOwnnoteUrl(url) {
66
$(document).ready(function() {
77
$('#ownnote-folder').change(function() {
88
var val = $(this).val();
9-
$.post(ocOwnnoteUrl("setval"), { field: 'folder', value: val }, function (data) {
9+
$.post(ocOwnnoteUrl("api/v0.2/ajaxsetval"), { field: 'folder', value: val }, function (data) {
1010
console.log('response', data);
1111
});
1212
});
@@ -15,7 +15,7 @@ $(document).ready(function() {
1515
if (val == "") {
1616
$('#ownnote-folder').val('');
1717
$('#shorten-folder-settings').css('display', 'none');
18-
$.post(ocOwnnoteUrl("setval"), { field: 'folder', value: '' }, function (data) {
18+
$.post(ocOwnnoteUrl("api/v0.2/ajaxsetval"), { field: 'folder', value: '' }, function (data) {
1919
console.log('response', data);
2020
});
2121
} else
@@ -26,7 +26,7 @@ $(document).ready(function() {
2626
var c = $(this).is(':checked');
2727
if (c)
2828
da = "checked";
29-
$.post(ocOwnnoteUrl("setval"), { field: 'disableAnnouncement', val: da }, function (data) {
29+
$.post(ocOwnnoteUrl("api/v0.2/ajaxsetval"), { field: 'disableAnnouncement', val: da }, function (data) {
3030
console.log('response', data);
3131
});
3232
});

‎js/script.js‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,15 @@
3636
function deleteNote(id) {
3737
var n = $(this).attr('n');
3838
var g = $(this).attr('g');
39-
$.post(ocUrl("api/v0.2/ownnote/del"), { name: n, group: g }, function (data) {
39+
$.post(ocUrl("api/v0.2/ownnote/ajaxdel"), { name: n, group: g }, function (data) {
4040
loadListing();
4141
});
4242
}
4343

4444
function editNote(id) {
4545
var n = $(this).attr('n');
4646
var g = $(this).attr('g');
47-
$.post(ocUrl("api/v0.2/ownnote/edit"), { name: n, group: g }, function (data) {
47+
$.post(ocUrl("api/v0.2/ownnote/ajaxedit"), { name: n, group: g }, function (data) {
4848
buildEdit(n, g, data);
4949
});
5050
}
@@ -177,9 +177,9 @@
177177
if (exists) {
178178
alert("Filename/group already exists.");
179179
} else
180-
$.post(ocUrl("api/v0.2/ownnote/ren"), { name: originalfilename, group: originalgroup, newname: editfilename, newgroup: editgroup }, function (data) {
180+
$.post(ocUrl("api/v0.2/ownnote/ajaxren"), { name: originalfilename, group: originalgroup, newname: editfilename, newgroup: editgroup }, function (data) {
181181
if (data == "DONE") {
182-
$.post(ocUrl("api/v0.2/ownnote/save"), { name: editfilename, group: editgroup, content: content }, function (data) {
182+
$.post(ocUrl("api/v0.2/ownnote/ajaxsave"), { name: editfilename, group: editgroup, content: content }, function (data) {
183183
if (!stayinnote)
184184
loadListing();
185185
else {
@@ -190,7 +190,7 @@
190190
}
191191
});
192192
} else {
193-
$.post(ocUrl("api/v0.2/ownnote/save"), { name: editfilename, group: editgroup, content: content }, function (data) {
193+
$.post(ocUrl("api/v0.2/ownnote/ajaxsave"), { name: editfilename, group: editgroup, content: content }, function (data) {
194194
if (!stayinnote)
195195
loadListing();
196196
else {
@@ -223,7 +223,7 @@
223223
}
224224

225225
function loadListing() {
226-
var url = ocUrl("api/v0.2/ownnote");
226+
var url = ocUrl("api/v0.2/ownnote/ajaxindex");
227227
$.get(url, function(data) {
228228
filelist = data;
229229
listing = jQuery.parseJSON(filelist);
@@ -389,7 +389,7 @@
389389
group = $('#newgroupname').val();
390390
}
391391
cancelNote();
392-
$.post(ocUrl("api/v0.2/ownnote/create"), { name: name, group: group }, function (data) {
392+
$.post(ocUrl("api/v0.2/ownnote/ajaxcreate"), { name: name, group: group }, function (data) {
393393
loadListing();
394394
});
395395
return false;
@@ -516,7 +516,7 @@
516516
$('#announcement-container').html(html);
517517
}
518518
} else {
519-
var url = ocUrl("api/v0.2/ownnote/announcement");
519+
var url = ocUrl("api/v0.2/ownnote/ajaxannouncement");
520520
$.ajax({
521521
url: url,
522522
success: function(data) {
@@ -599,7 +599,7 @@
599599
if (exists)
600600
alert('An ungrouped file has the same name as a file in this group.');
601601
else
602-
$.post(ocUrl("api/v0.2/ownnote/delgroup"), { group: g }, function (data) {
602+
$.post(ocUrl("api/v0.2/ownnote/ajaxdelgroup"), { group: g }, function (data) {
603603
switchgroup = "All";
604604
loadListing();
605605
});
@@ -630,7 +630,7 @@
630630
if (exists)
631631
alert("Group already exists.");
632632
else
633-
$.post(ocUrl("api/v0.2/ownnote/rengroup"), { group: cg, newgroup: v }, function (data) {
633+
$.post(ocUrl("api/v0.2/ownnote/ajaxrengroup"), { group: cg, newgroup: v }, function (data) {
634634
switchgroup = v;
635635
cg = "";
636636
loadListing();

0 commit comments

Comments
 (0)