periscope_rails 0.0.1 → 0.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/app/periscope/periscope_controller.rb +59 -59
- data/config/routes.rb +3 -3
- data/lib/periscope_rails/config.rb +10 -10
- data/lib/periscope_rails/engine.rb +3 -3
- data/lib/periscope_rails/version.rb +2 -2
- data/periscope_rails.gemspec +6 -6
- metadata +22 -10
@@ -1,60 +1,60 @@
|
|
1
|
-
class PeriscopeController < ApplicationController
|
2
|
-
before_filter :authenticate
|
3
|
-
protect_from_forgery :except => [:look, :login]
|
4
|
-
|
5
|
-
def look
|
6
|
-
if !params[:sql].nil?
|
7
|
-
render :json => run_sql(params[:sql])
|
8
|
-
else
|
9
|
-
render :json => {:error => "Command not understood"}
|
10
|
-
end
|
11
|
-
end
|
12
|
-
|
13
|
-
def login
|
14
|
-
render :json => get_info()
|
15
|
-
end
|
16
|
-
|
17
|
-
private
|
18
|
-
|
19
|
-
def authenticate
|
20
|
-
unless PeriscopeRails::Config.check_password(params[:password].to_s)
|
21
|
-
render :json => {:error => "Password invalid."}
|
22
|
-
end
|
23
|
-
end
|
24
|
-
|
25
|
-
def run_sql(sql_command)
|
26
|
-
#TODO: protect based on CFG, not blacklist
|
27
|
-
bad_words = %W{drop delete update into insert index add remove grant revoke create createdb}
|
28
|
-
bad_words += %W{createuser createrole destroy disconnect exec execute dropdb primary key rollback ; --}
|
29
|
-
|
30
|
-
rows = nil
|
31
|
-
error_message = nil
|
32
|
-
command = sql_command.to_s.strip
|
33
|
-
command_words = command.downcase.gsub(/[^a-zA-Z0-9]/, " ").gsub(/\s+/, " ").split(" ")
|
34
|
-
if command == ""
|
35
|
-
#nothing
|
36
|
-
elsif (command_words & bad_words).size > 0
|
37
|
-
error_message = "Potentially harmful keyword found, blocking script."
|
38
|
-
else
|
39
|
-
begin
|
40
|
-
ActiveRecord::Base.transaction do
|
41
|
-
rows = ActiveRecord::Base.connection.select_all(command)
|
42
|
-
p rows
|
43
|
-
raise "OK" #abort all transactions for extra protection
|
44
|
-
end
|
45
|
-
rescue Exception => e
|
46
|
-
error_message = e.message unless e.message == "OK"
|
47
|
-
end
|
48
|
-
end
|
49
|
-
return {:error => error_message, :data => rows}
|
50
|
-
end
|
51
|
-
|
52
|
-
def get_info
|
53
|
-
tables = []
|
54
|
-
table_names = ActiveRecord::Base.connection.tables.sort
|
55
|
-
table_names.each do |table_name|
|
56
|
-
tables << {:name => table_name, :columns => ActiveRecord::Base.connection.columns(table_name)}
|
57
|
-
end
|
58
|
-
return {:tables => tables, :error => nil}
|
59
|
-
end
|
1
|
+
class PeriscopeController < ApplicationController
|
2
|
+
before_filter :authenticate
|
3
|
+
protect_from_forgery :except => [:look, :login]
|
4
|
+
|
5
|
+
def look
|
6
|
+
if !params[:sql].nil?
|
7
|
+
render :json => run_sql(params[:sql])
|
8
|
+
else
|
9
|
+
render :json => {:error => "Command not understood"}
|
10
|
+
end
|
11
|
+
end
|
12
|
+
|
13
|
+
def login
|
14
|
+
render :json => get_info()
|
15
|
+
end
|
16
|
+
|
17
|
+
private
|
18
|
+
|
19
|
+
def authenticate
|
20
|
+
unless PeriscopeRails::Config.check_password(params[:password].to_s)
|
21
|
+
render :json => {:error => "Password invalid."}
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
def run_sql(sql_command)
|
26
|
+
#TODO: protect based on CFG, not blacklist
|
27
|
+
bad_words = %W{drop delete update into insert index add remove grant revoke create createdb}
|
28
|
+
bad_words += %W{createuser createrole destroy disconnect exec execute dropdb primary key rollback ; --}
|
29
|
+
|
30
|
+
rows = nil
|
31
|
+
error_message = nil
|
32
|
+
command = sql_command.to_s.strip
|
33
|
+
command_words = command.downcase.gsub(/[^a-zA-Z0-9]/, " ").gsub(/\s+/, " ").split(" ")
|
34
|
+
if command == ""
|
35
|
+
#nothing
|
36
|
+
elsif (command_words & bad_words).size > 0
|
37
|
+
error_message = "Potentially harmful keyword found, blocking script."
|
38
|
+
else
|
39
|
+
begin
|
40
|
+
ActiveRecord::Base.transaction do
|
41
|
+
rows = ActiveRecord::Base.connection.select_all(command)
|
42
|
+
p rows
|
43
|
+
raise "OK" #abort all transactions for extra protection
|
44
|
+
end
|
45
|
+
rescue Exception => e
|
46
|
+
error_message = e.message unless e.message == "OK"
|
47
|
+
end
|
48
|
+
end
|
49
|
+
return {:error => error_message, :data => rows}
|
50
|
+
end
|
51
|
+
|
52
|
+
def get_info
|
53
|
+
tables = []
|
54
|
+
table_names = ActiveRecord::Base.connection.tables.sort
|
55
|
+
table_names.each do |table_name|
|
56
|
+
tables << {:name => table_name, :columns => ActiveRecord::Base.connection.columns(table_name)}
|
57
|
+
end
|
58
|
+
return {:tables => tables, :error => nil}
|
59
|
+
end
|
60
60
|
end
|
data/config/routes.rb
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
Rails.application.routes.draw do
|
2
|
-
post "periscope/login" => "periscope#login"
|
3
|
-
post "periscope/look" => "periscope#look"
|
1
|
+
Rails.application.routes.draw do
|
2
|
+
post "periscope/login" => "periscope#login"
|
3
|
+
post "periscope/look" => "periscope#look"
|
4
4
|
end
|
@@ -1,11 +1,11 @@
|
|
1
|
-
module PeriscopeRails
|
2
|
-
class Config
|
3
|
-
@@password = nil
|
4
|
-
def self.set_password(password)
|
5
|
-
@@password = password
|
6
|
-
end
|
7
|
-
def self.check_password(password)
|
8
|
-
return @@password == password
|
9
|
-
end
|
10
|
-
end
|
1
|
+
module PeriscopeRails
|
2
|
+
class Config
|
3
|
+
@@password = nil
|
4
|
+
def self.set_password(password)
|
5
|
+
@@password = password
|
6
|
+
end
|
7
|
+
def self.check_password(password)
|
8
|
+
return @@password == password
|
9
|
+
end
|
10
|
+
end
|
11
11
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
module PeriscopeRails
|
2
|
-
class Engine < Rails::Engine
|
3
|
-
end
|
1
|
+
module PeriscopeRails
|
2
|
+
class Engine < Rails::Engine
|
3
|
+
end
|
4
4
|
end
|
@@ -1,3 +1,3 @@
|
|
1
|
-
module PeriscopeRails
|
2
|
-
VERSION = "0.0.1"
|
1
|
+
module PeriscopeRails
|
2
|
+
VERSION = "0.0.1"
|
3
3
|
end
|
data/periscope_rails.gemspec
CHANGED
@@ -5,18 +5,18 @@ require File.expand_path("../lib/periscope_rails/version", __FILE__)
|
|
5
5
|
Gem::Specification.new do |s|
|
6
6
|
s.name = "periscope_rails"
|
7
7
|
s.homepage = "http://periscopeapp.herokuapp.com/"
|
8
|
-
s.authors = [ "Tom O'Neill
|
9
|
-
s.email = [ "tom.oneill@live.com" ]
|
8
|
+
s.authors = [ "Tom O'Neill", "Harry Glaser" ]
|
9
|
+
s.email = [ "tom.oneill@live.com", "harry.glaser@gmail.com" ]
|
10
10
|
|
11
11
|
s.summary = "Rails API for Periscope Database Viewer"
|
12
12
|
s.description = "Periscope allows you to query your production database. The gem provides the API for Periscope to communicate with your Rails app."
|
13
13
|
s.files = Dir["{app,lib,config}/**/*"] + ["MIT-LICENSE", "Rakefile", "Gemfile", "README.rdoc"]
|
14
|
-
s.version = "0.0.
|
14
|
+
s.version = "0.0.2"
|
15
15
|
|
16
|
-
s.add_dependency "activesupport" , "~> 3.
|
17
|
-
s.add_dependency "rails" , "~> 3.
|
16
|
+
s.add_dependency "activesupport" , "~> 3.0"
|
17
|
+
s.add_dependency "rails" , "~> 3.0"
|
18
18
|
|
19
19
|
s.files = `git ls-files`.split("\n")
|
20
20
|
s.executables = `git ls-files`.split("\n").map{|f| f =~ /^bin\/(.*)/ ? $1 : nil}.compact
|
21
21
|
s.require_path = 'lib'
|
22
|
-
end
|
22
|
+
end
|
metadata
CHANGED
@@ -1,42 +1,54 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: periscope_rails
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 0.0.
|
4
|
+
version: 0.0.2
|
5
5
|
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
8
|
-
- Tom O'Neill
|
8
|
+
- Tom O'Neill
|
9
|
+
- Harry Glaser
|
9
10
|
autorequire:
|
10
11
|
bindir: bin
|
11
12
|
cert_chain: []
|
12
|
-
date: 2012-
|
13
|
+
date: 2012-04-12 00:00:00.000000000 Z
|
13
14
|
dependencies:
|
14
15
|
- !ruby/object:Gem::Dependency
|
15
16
|
name: activesupport
|
16
|
-
requirement:
|
17
|
+
requirement: !ruby/object:Gem::Requirement
|
17
18
|
none: false
|
18
19
|
requirements:
|
19
20
|
- - ~>
|
20
21
|
- !ruby/object:Gem::Version
|
21
|
-
version: 3.
|
22
|
+
version: '3.0'
|
22
23
|
type: :runtime
|
23
24
|
prerelease: false
|
24
|
-
version_requirements:
|
25
|
+
version_requirements: !ruby/object:Gem::Requirement
|
26
|
+
none: false
|
27
|
+
requirements:
|
28
|
+
- - ~>
|
29
|
+
- !ruby/object:Gem::Version
|
30
|
+
version: '3.0'
|
25
31
|
- !ruby/object:Gem::Dependency
|
26
32
|
name: rails
|
27
|
-
requirement:
|
33
|
+
requirement: !ruby/object:Gem::Requirement
|
28
34
|
none: false
|
29
35
|
requirements:
|
30
36
|
- - ~>
|
31
37
|
- !ruby/object:Gem::Version
|
32
|
-
version: 3.
|
38
|
+
version: '3.0'
|
33
39
|
type: :runtime
|
34
40
|
prerelease: false
|
35
|
-
version_requirements:
|
41
|
+
version_requirements: !ruby/object:Gem::Requirement
|
42
|
+
none: false
|
43
|
+
requirements:
|
44
|
+
- - ~>
|
45
|
+
- !ruby/object:Gem::Version
|
46
|
+
version: '3.0'
|
36
47
|
description: Periscope allows you to query your production database. The gem provides
|
37
48
|
the API for Periscope to communicate with your Rails app.
|
38
49
|
email:
|
39
50
|
- tom.oneill@live.com
|
51
|
+
- harry.glaser@gmail.com
|
40
52
|
executables: []
|
41
53
|
extensions: []
|
42
54
|
extra_rdoc_files: []
|
@@ -109,7 +121,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
109
121
|
version: '0'
|
110
122
|
requirements: []
|
111
123
|
rubyforge_project:
|
112
|
-
rubygems_version: 1.8.
|
124
|
+
rubygems_version: 1.8.21
|
113
125
|
signing_key:
|
114
126
|
specification_version: 3
|
115
127
|
summary: Rails API for Periscope Database Viewer
|