Skip to content

Commit 5dfd4e9

Browse files
author
jmccormick2001
committed
add regexp to check usernames passed into create user command to prevent special chars from being passed in
1 parent 6279f18 commit 5dfd4e9

File tree

1 file changed

+43
-31
lines changed

1 file changed

+43
-31
lines changed

‎apiserver/userservice/userimpl.go‎

Lines changed: 43 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ import (
2020
"database/sql"
2121
"errors"
2222
"fmt"
23+
"regexp"
2324
"strconv"
2425
"strings"
2526
"time"
@@ -61,7 +62,7 @@ var defaultPasswordLength = 8
6162
// pgo user --change-password=bob --db=userdb
6263
// --expired=7 --selector=env=research --update-passwords=true
6364
// --valid-days=30
64-
func User(request *msgs.UserRequest) msgs.UserResponse {
65+
func User(request *msgs.UserRequest, ns string) msgs.UserResponse {
6566
var err error
6667
resp := msgs.UserResponse{}
6768
resp.Status.Code = msgs.Ok
@@ -93,7 +94,7 @@ func User(request *msgs.UserRequest) msgs.UserResponse {
9394
//get the clusters list
9495
clusterList := crv1.PgclusterList{}
9596
err = kubeapi.GetpgclustersBySelector(apiserver.RESTClient,
96-
&clusterList, sel, apiserver.Namespace)
97+
&clusterList, sel, ns)
9798
if err != nil {
9899
resp.Status.Code = msgs.Error
99100
resp.Status.Msg = err.Error()
@@ -109,15 +110,15 @@ func User(request *msgs.UserRequest) msgs.UserResponse {
109110
for _, cluster := range clusterList.Items {
110111
//selector := util.LABEL_PG_CLUSTER + "=" + cluster.Spec.Name + "," + util.LABEL_PRIMARY + "=true"
111112
selector := util.LABEL_PG_CLUSTER + "=" + cluster.Spec.Name + "," + util.LABEL_SERVICE_NAME + "=" + cluster.Spec.Name
112-
deployments, err := kubeapi.GetDeployments(apiserver.Clientset, selector, apiserver.Namespace)
113+
deployments, err := kubeapi.GetDeployments(apiserver.Clientset, selector, ns)
113114
if err != nil {
114115
resp.Status.Code = msgs.Error
115116
resp.Status.Msg = err.Error()
116117
return resp
117118
}
118119

119120
for _, d := range deployments.Items {
120-
info := getPostgresUserInfo(apiserver.Namespace, d.ObjectMeta.Name)
121+
info := getPostgresUserInfo(ns, d.ObjectMeta.Name)
121122

122123
if request.ChangePasswordForUser != "" {
123124
msg := "changing password of user " + request.ChangePasswordForUser + " on " + d.ObjectMeta.Name
@@ -137,7 +138,7 @@ func User(request *msgs.UserRequest) msgs.UserResponse {
137138
pgbouncer := cluster.Spec.UserLabels[util.LABEL_PGBOUNCER] == "true"
138139
pgpool := cluster.Spec.UserLabels[util.LABEL_PGPOOL] == "true"
139140

140-
err = updatePassword(cluster.Spec.Name, info, request.ChangePasswordForUser, newPassword, newExpireDate, apiserver.Namespace, pgpool, pgbouncer, request.PasswordLength)
141+
err = updatePassword(cluster.Spec.Name, info, request.ChangePasswordForUser, newPassword, newExpireDate, ns, pgpool, pgbouncer, request.PasswordLength)
141142
if err != nil {
142143
log.Error(err.Error())
143144
resp.Status.Code = msgs.Error
@@ -158,7 +159,7 @@ func User(request *msgs.UserRequest) msgs.UserResponse {
158159
newExpireDate := GeneratePasswordExpireDate(request.PasswordAgeDays)
159160
pgbouncer := cluster.Spec.UserLabels[util.LABEL_PGBOUNCER] == "true"
160161
pgpool := cluster.Spec.UserLabels[util.LABEL_PGPOOL] == "true"
161-
err = updatePassword(cluster.Spec.Name, v.ConnDetails, v.Rolname, newPassword, newExpireDate, apiserver.Namespace, pgpool, pgbouncer, request.PasswordLength)
162+
err = updatePassword(cluster.Spec.Name, v.ConnDetails, v.Rolname, newPassword, newExpireDate, ns, pgpool, pgbouncer, request.PasswordLength)
162163
if err != nil {
163164
log.Error("error in updating password")
164165
}
@@ -275,15 +276,15 @@ func updatePassword(clusterName string, p connInfo, username, newPassword, passw
275276
}
276277

277278
if pgbouncer {
278-
err := reconfigurePgbouncer(clusterName)
279+
err := reconfigurePgbouncer(clusterName, namespace)
279280
if err != nil {
280281
log.Error(err)
281282
return err
282283
}
283284
}
284285

285286
if pgpool {
286-
err := reconfigurePgpool(clusterName)
287+
err := reconfigurePgpool(clusterName, namespace)
287288
if err != nil {
288289
log.Error(err)
289290
return err
@@ -508,7 +509,7 @@ func deleteUser(namespace, clusterName string, info connInfo, user string, manag
508509

509510
// CreateUser ...
510511
// pgo create user user1
511-
func CreateUser(request *msgs.CreateUserRequest) msgs.CreateUserResponse {
512+
func CreateUser(request *msgs.CreateUserRequest, ns string) msgs.CreateUserResponse {
512513
var err error
513514
resp := msgs.CreateUserResponse{}
514515
resp.Status.Code = msgs.Ok
@@ -529,7 +530,7 @@ func CreateUser(request *msgs.CreateUserRequest) msgs.CreateUserResponse {
529530

530531
//get a list of all clusters
531532
err = kubeapi.GetpgclustersBySelector(apiserver.RESTClient,
532-
&clusterList, request.Selector, apiserver.Namespace)
533+
&clusterList, request.Selector, ns)
533534
if err != nil {
534535
resp.Status.Code = msgs.Error
535536
resp.Status.Msg = err.Error()
@@ -544,10 +545,17 @@ func CreateUser(request *msgs.CreateUserRequest) msgs.CreateUserResponse {
544545

545546
log.Debugf("createUser clusters found len is %d", len(clusterList.Items))
546547

548+
re := regexp.MustCompile("^[a-z0-9.-]*$")
549+
if !re.MatchString(request.Name) {
550+
resp.Status.Code = msgs.Error
551+
resp.Status.Msg = "user name is required to be lowercase letters and numbers only."
552+
return resp
553+
}
554+
547555
for _, c := range clusterList.Items {
548-
info := getPostgresUserInfo(apiserver.Namespace, c.Name)
556+
info := getPostgresUserInfo(ns, c.Name)
549557

550-
err = addUser(request, apiserver.Namespace, c.Name, info)
558+
err = addUser(request, ns, c.Name, info)
551559
if err != nil {
552560
resp.Status.Code = msgs.Error
553561
resp.Status.Msg = err.Error()
@@ -570,7 +578,7 @@ func CreateUser(request *msgs.CreateUserRequest) msgs.CreateUserResponse {
570578

571579
pgbouncer := c.Spec.UserLabels[util.LABEL_PGBOUNCER] == "true"
572580
pgpool := c.Spec.UserLabels[util.LABEL_PGPOOL] == "true"
573-
err = updatePassword(c.Name, info, request.Name, newPassword, newExpireDate, apiserver.Namespace, pgpool, pgbouncer, request.PasswordLength)
581+
err = updatePassword(c.Name, info, request.Name, newPassword, newExpireDate, ns, pgpool, pgbouncer, request.PasswordLength)
574582
if err != nil {
575583
log.Error(err.Error())
576584
resp.Status.Code = msgs.Error
@@ -584,18 +592,19 @@ func CreateUser(request *msgs.CreateUserRequest) msgs.CreateUserResponse {
584592
}
585593

586594
// DeleteUser ...
587-
func DeleteUser(name, selector string) msgs.DeleteUserResponse {
595+
func DeleteUser(name, selector, ns string) msgs.DeleteUserResponse {
588596
var err error
589597

590598
response := msgs.DeleteUserResponse{}
591599
response.Status = msgs.Status{Code: msgs.Ok, Msg: ""}
592600
response.Results = make([]string, 0)
593601

602+
log.Debugf("DeleteUser called name=%s", name)
594603
clusterList := crv1.PgclusterList{}
595604

596605
//get the clusters list
597606
err = kubeapi.GetpgclustersBySelector(apiserver.RESTClient,
598-
&clusterList, selector, apiserver.Namespace)
607+
&clusterList, selector, ns)
599608
if err != nil {
600609
response.Status.Code = msgs.Error
601610
response.Status.Msg = err.Error()
@@ -614,18 +623,20 @@ func DeleteUser(name, selector string) msgs.DeleteUserResponse {
614623

615624
for _, cluster := range clusterList.Items {
616625
clusterName = cluster.Spec.Name
617-
info := getPostgresUserInfo(apiserver.Namespace, clusterName)
626+
info := getPostgresUserInfo(ns, clusterName)
618627

619628
secretName := clusterName + "-" + name + "-secret"
620629

621-
managed, err = isManaged(secretName)
630+
managed, err = isManaged(secretName, ns)
622631
if err != nil {
623632
response.Status.Code = msgs.Error
624633
response.Status.Msg = err.Error()
625634
return response
626635
}
627636

628-
err = deleteUser(apiserver.Namespace, clusterName, info, name, managed)
637+
log.Debugf("DeleteUser %s managed %t", name, managed)
638+
639+
err = deleteUser(ns, clusterName, info, name, managed)
629640
if err != nil {
630641
log.Error(err)
631642
response.Status.Code = msgs.Error
@@ -640,7 +651,7 @@ func DeleteUser(name, selector string) msgs.DeleteUserResponse {
640651
//see if any pooler needs to be reconfigured
641652
if managed {
642653
if cluster.Spec.UserLabels[util.LABEL_PGBOUNCER] == "true" {
643-
err := reconfigurePgbouncer(clusterName)
654+
err := reconfigurePgbouncer(clusterName, ns)
644655
if err != nil {
645656
log.Error(err)
646657
response.Status.Code = msgs.Error
@@ -649,7 +660,7 @@ func DeleteUser(name, selector string) msgs.DeleteUserResponse {
649660
}
650661
}
651662
if cluster.Spec.UserLabels[util.LABEL_PGPOOL] == "true" {
652-
err := reconfigurePgpool(clusterName)
663+
err := reconfigurePgpool(clusterName, ns)
653664
if err != nil {
654665
log.Error(err)
655666
response.Status.Code = msgs.Error
@@ -665,8 +676,8 @@ func DeleteUser(name, selector string) msgs.DeleteUserResponse {
665676

666677
}
667678

668-
func isManaged(secretName string) (bool, error) {
669-
_, found, err := kubeapi.GetSecret(apiserver.Clientset, secretName, apiserver.Namespace)
679+
func isManaged(secretName, ns string) (bool, error) {
680+
_, found, err := kubeapi.GetSecret(apiserver.Clientset, secretName, ns)
670681
if !found {
671682
return false, nil
672683
}
@@ -682,7 +693,7 @@ func isManaged(secretName string) (bool, error) {
682693
}
683694

684695
// ShowUser ...
685-
func ShowUser(name, selector, expired string) msgs.ShowUserResponse {
696+
func ShowUser(name, selector, expired, ns string) msgs.ShowUserResponse {
686697
var err error
687698

688699
response := msgs.ShowUserResponse{}
@@ -700,7 +711,7 @@ func ShowUser(name, selector, expired string) msgs.ShowUserResponse {
700711

701712
//get a list of all clusters
702713
err = kubeapi.GetpgclustersBySelector(apiserver.RESTClient,
703-
&clusterList, selector, apiserver.Namespace)
714+
&clusterList, selector, ns)
704715
if err != nil {
705716
response.Status.Code = msgs.Error
706717
response.Status.Msg = err.Error()
@@ -732,15 +743,15 @@ func ShowUser(name, selector, expired string) msgs.ShowUserResponse {
732743
if expired != "" {
733744
//selector := util.LABEL_PG_CLUSTER + "=" + c.Spec.Name + "," + util.LABEL_PRIMARY + "=true"
734745
selector := util.LABEL_PG_CLUSTER + "=" + c.Spec.Name + "," + util.LABEL_SERVICE_NAME + "=" + c.Spec.Name
735-
deployments, err := kubeapi.GetDeployments(apiserver.Clientset, selector, apiserver.Namespace)
746+
deployments, err := kubeapi.GetDeployments(apiserver.Clientset, selector, ns)
736747
if err != nil {
737748
response.Status.Code = msgs.Error
738749
response.Status.Msg = err.Error()
739750
return response
740751
}
741752

742753
for _, d := range deployments.Items {
743-
info := getPostgresUserInfo(apiserver.Namespace, d.ObjectMeta.Name)
754+
info := getPostgresUserInfo(ns, d.ObjectMeta.Name)
744755
if expired != "" {
745756
results := callDB(info, d.ObjectMeta.Name, expired)
746757
if len(results) > 0 {
@@ -777,9 +788,10 @@ func deleteUserSecret(clientset *kubernetes.Clientset, clustername, username, na
777788
return err
778789
}
779790

780-
func reconfigurePgbouncer(clusterName string) error {
791+
func reconfigurePgbouncer(clusterName, ns string) error {
781792
var err error
782793
spec := crv1.PgtaskSpec{}
794+
spec.Namespace = ns
783795
spec.Name = util.LABEL_PGBOUNCER_TASK_RECONFIGURE + "-" + clusterName
784796
spec.TaskType = crv1.PgtaskReconfigurePgbouncer
785797
spec.StorageSpec = crv1.PgStorageSpec{}
@@ -797,18 +809,18 @@ func reconfigurePgbouncer(clusterName string) error {
797809
newInstance.ObjectMeta.Labels[util.LABEL_PG_CLUSTER] = clusterName
798810
newInstance.ObjectMeta.Labels[util.LABEL_PGBOUNCER_TASK_RECONFIGURE] = "true"
799811

800-
err = kubeapi.Createpgtask(apiserver.RESTClient,
801-
newInstance, apiserver.Namespace)
812+
err = kubeapi.Createpgtask(apiserver.RESTClient, newInstance, ns)
802813
if err != nil {
803814
log.Error(err)
804815
return err
805816
}
806817
return err
807818
}
808819

809-
func reconfigurePgpool(clusterName string) error {
820+
func reconfigurePgpool(clusterName, ns string) error {
810821
var err error
811822
spec := crv1.PgtaskSpec{}
823+
spec.Namespace = ns
812824
spec.Name = util.LABEL_PGPOOL_TASK_RECONFIGURE + "-" + clusterName
813825
spec.TaskType = crv1.PgtaskReconfigurePgpool
814826
spec.StorageSpec = crv1.PgStorageSpec{}
@@ -827,7 +839,7 @@ func reconfigurePgpool(clusterName string) error {
827839
newInstance.ObjectMeta.Labels[util.LABEL_PGPOOL_TASK_RECONFIGURE] = "true"
828840

829841
err = kubeapi.Createpgtask(apiserver.RESTClient,
830-
newInstance, apiserver.Namespace)
842+
newInstance, ns)
831843
if err != nil {
832844
log.Error(err)
833845
return err

0 commit comments

Comments
 (0)