WebApplication Class Reference

#include <webapplication.h>

Inheritance diagram for WebApplication:

Collaboration diagram for WebApplication:

Classes
struct	TranslatedFile

Public Member Functions
	WebApplication (QObject *parent=nullptr)
	~WebApplication () override
Http::Response	processRequest (const Http::Request &request, const Http::Environment &env) override
QString	clientId () const override
WebSession *	session () override
void	sessionStart () override
void	sessionEnd () override
const Http::Request &	request () const
const Http::Environment &	env () const
Public Member Functions inherited from Http::IRequestHandler
virtual	~IRequestHandler ()
Public Member Functions inherited from ISessionManager
virtual	~ISessionManager ()=default

Private Member Functions
void	doProcessRequest ()
void	configure ()
void	registerAPIController (const QString &scope, APIController *controller)
void	declarePublicAPI (const QString &apiPath)
void	sendFile (const QString &path)
void	sendWebUIFile ()
void	translateDocument (QString &data) const
QString	generateSid () const
void	sessionInitialize ()
bool	isAuthNeeded ()
bool	isPublicAPI (const QString &scope, const QString &action) const
bool	isCrossSiteRequest (const Http::Request &request) const
bool	validateHostHeader (const QStringList &domains) const
QHostAddress	resolveClientAddress () const
Private Member Functions inherited from Http::ResponseBuilder
void	status (uint code=200, const QString &text=QLatin1String("OK"))
void	setHeader (const Header &header)
void	print (const QString &text, const QString &type=CONTENT_TYPE_HTML)
void	print (const QByteArray &data, const QString &type=CONTENT_TYPE_HTML)
void	clear ()
Response	response () const

Private Attributes
QHash< QString, WebSession * >	m_sessions
WebSession *	m_currentSession = nullptr
Http::Request	m_request
Http::Environment	m_env
QHash< QString, QString >	m_params
const QString	m_cacheID
const QRegularExpression	m_apiPathPattern {QLatin1String("^/api/v2/(?<scope>[A-Za-z_][A-Za-z_0-9]*)/(?<action>[A-Za-z_][A-Za-z_0-9]*)$")}
QHash< QString, APIController * >	m_apiControllers
QSet< QString >	m_publicAPIs
bool	m_isAltUIUsed = false
QString	m_rootFolder
QHash< QString, TranslatedFile >	m_translatedFiles
QString	m_currentLocale
QTranslator	m_translator
bool	m_translationFileLoaded = false
bool	m_isLocalAuthEnabled
bool	m_isAuthSubnetWhitelistEnabled
QVector< Utils::Net::Subnet >	m_authSubnetWhitelist
int	m_sessionTimeout
QStringList	m_domainList
bool	m_isCSRFProtectionEnabled
bool	m_isSecureCookieEnabled
bool	m_isHostHeaderValidationEnabled
bool	m_isHttpsEnabled
bool	m_isReverseProxySupportEnabled
QVector< QHostAddress >	m_trustedReverseProxyList
QHostAddress	m_clientAddress
QVector< Http::Header >	m_prebuiltHeaders

Detailed Description

Definition at line 70 of file webapplication.h.

Constructor & Destructor Documentation

WebApplication()

WebApplication::WebApplication ( QObject *  parent = nullptr )

explicit

Definition at line 119 of file webapplication.cpp.

    : QObject(parent)
    , m_cacheID {QString::number(Utils::Random::rand(), 36)}
{
    registerAPIController(QLatin1String("app"), new AppController(this, this));
    registerAPIController(QLatin1String("auth"), new AuthController(this, this));
    registerAPIController(QLatin1String("log"), new LogController(this, this));
    registerAPIController(QLatin1String("rss"), new RSSController(this, this));
    registerAPIController(QLatin1String("search"), new SearchController(this, this));
    registerAPIController(QLatin1String("sync"), new SyncController(this, this));
    registerAPIController(QLatin1String("torrents"), new TorrentsController(this, this));
    registerAPIController(QLatin1String("transfer"), new TransferController(this, this));
 
    declarePublicAPI(QLatin1String("auth/login"));
 
    configure();
    connect(Preferences::instance(), &Preferences::changed, this, &WebApplication::configure);
}

References Preferences::changed(), configure(), declarePublicAPI(), Preferences::instance(), and registerAPIController().

Here is the call graph for this function:

~WebApplication()

WebApplication::~WebApplication ( )

override

Definition at line 138 of file webapplication.cpp.

{
    // cleanup sessions data
    qDeleteAll(m_sessions);
}

References m_sessions.

Member Function Documentation

clientId()

QString WebApplication::clientId ( ) const

overridevirtual

Implements ISessionManager.

Definition at line 534 of file webapplication.cpp.

{
    return m_clientAddress.toString();
}

References m_clientAddress.

configure()

void WebApplication::configure ( )

private

Definition at line 318 of file webapplication.cpp.

{
    const auto *pref = Preferences::instance();
 
    const bool isAltUIUsed = pref->isAltWebUiEnabled();
    const QString rootFolder = Utils::Fs::expandPathAbs(
                !isAltUIUsed ? WWW_FOLDER : pref->getWebUiRootFolder());
    if ((isAltUIUsed != m_isAltUIUsed) || (rootFolder != m_rootFolder))
    {
        m_isAltUIUsed = isAltUIUsed;
        m_rootFolder = rootFolder;
        m_translatedFiles.clear();
        if (!m_isAltUIUsed)
            LogMsg(tr("Using built-in Web UI."));
        else
            LogMsg(tr("Using custom Web UI. Location: \"%1\".").arg(m_rootFolder));
    }
 
    const QString newLocale = pref->getLocale();
    if (m_currentLocale != newLocale)
    {
        m_currentLocale = newLocale;
        m_translatedFiles.clear();
 
        m_translationFileLoaded = m_translator.load(m_rootFolder + QLatin1String("/translations/webui_") + newLocale);
        if (m_translationFileLoaded)
        {
            LogMsg(tr("Web UI translation for selected locale (%1) has been successfully loaded.")
                   .arg(newLocale));
        }
        else
        {
            LogMsg(tr("Couldn't load Web UI translation for selected locale (%1).").arg(newLocale), Log::WARNING);
        }
    }
 
    m_isLocalAuthEnabled = pref->isWebUiLocalAuthEnabled();
    m_isAuthSubnetWhitelistEnabled = pref->isWebUiAuthSubnetWhitelistEnabled();
    m_authSubnetWhitelist = pref->getWebUiAuthSubnetWhitelist();
    m_sessionTimeout = pref->getWebUISessionTimeout();
 
    m_domainList = pref->getServerDomains().split(';', Qt::SkipEmptyParts);
    std::for_each(m_domainList.begin(), m_domainList.end(), [](QString &entry) { entry = entry.trimmed(); });
 
    m_isCSRFProtectionEnabled = pref->isWebUiCSRFProtectionEnabled();
    m_isSecureCookieEnabled = pref->isWebUiSecureCookieEnabled();
    m_isHostHeaderValidationEnabled = pref->isWebUIHostHeaderValidationEnabled();
    m_isHttpsEnabled = pref->isWebUiHttpsEnabled();
 
    m_prebuiltHeaders.clear();
    m_prebuiltHeaders.push_back({QLatin1String(Http::HEADER_X_XSS_PROTECTION), QLatin1String("1; mode=block")});
    m_prebuiltHeaders.push_back({QLatin1String(Http::HEADER_X_CONTENT_TYPE_OPTIONS), QLatin1String("nosniff")});
 
    if (!m_isAltUIUsed)
        m_prebuiltHeaders.push_back({QLatin1String(Http::HEADER_REFERRER_POLICY), QLatin1String("same-origin")});
 
    const bool isClickjackingProtectionEnabled = pref->isWebUiClickjackingProtectionEnabled();
    if (isClickjackingProtectionEnabled)
        m_prebuiltHeaders.push_back({QLatin1String(Http::HEADER_X_FRAME_OPTIONS), QLatin1String("SAMEORIGIN")});
 
    const QString contentSecurityPolicy =
        (m_isAltUIUsed
            ? QLatin1String("")
            : QLatin1String("default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none'; form-action 'self';"))
        + (isClickjackingProtectionEnabled ? QLatin1String(" frame-ancestors 'self';") : QLatin1String(""))
        + (m_isHttpsEnabled ? QLatin1String(" upgrade-insecure-requests;") : QLatin1String(""));
    if (!contentSecurityPolicy.isEmpty())
        m_prebuiltHeaders.push_back({QLatin1String(Http::HEADER_CONTENT_SECURITY_POLICY), contentSecurityPolicy});
 
    if (pref->isWebUICustomHTTPHeadersEnabled())
    {
        const QString customHeaders = pref->getWebUICustomHTTPHeaders();
        const QList<QStringView> customHeaderLines = QStringView(customHeaders).trimmed().split(u'\n', Qt::SkipEmptyParts);
 
        for (const QStringView line : customHeaderLines)
        {
            const int idx = line.indexOf(':');
            if (idx < 0)
            {
                // require separator `:` to be present even if `value` field can be empty
                LogMsg(tr("Missing ':' separator in WebUI custom HTTP header: \"%1\"").arg(line.toString()), Log::WARNING);
                continue;
            }
 
            const QString header = line.left(idx).trimmed().toString();
            const QString value = line.mid(idx + 1).trimmed().toString();
            m_prebuiltHeaders.push_back({header, value});
        }
    }
 
    m_isReverseProxySupportEnabled = pref->isWebUIReverseProxySupportEnabled();
    if (m_isReverseProxySupportEnabled)
    {
        m_trustedReverseProxyList.clear();
 
        const QStringList proxyList = pref->getWebUITrustedReverseProxiesList().split(';', Qt::SkipEmptyParts);
 
        for (const QString &proxy : proxyList)
        {
            QHostAddress ip;
            if (ip.setAddress(proxy))
                m_trustedReverseProxyList.push_back(ip);
        }
 
        if (m_trustedReverseProxyList.isEmpty())
            m_isReverseProxySupportEnabled = false;
    }
}

References Utils::Fs::expandPathAbs(), Http::HEADER_CONTENT_SECURITY_POLICY, Http::HEADER_REFERRER_POLICY, Http::HEADER_X_CONTENT_TYPE_OPTIONS, Http::HEADER_X_FRAME_OPTIONS, Http::HEADER_X_XSS_PROTECTION, Preferences::instance(), LogMsg(), m_authSubnetWhitelist, m_currentLocale, m_domainList, m_isAltUIUsed, m_isAuthSubnetWhitelistEnabled, m_isCSRFProtectionEnabled, m_isHostHeaderValidationEnabled, m_isHttpsEnabled, m_isLocalAuthEnabled, m_isSecureCookieEnabled, m_prebuiltHeaders, m_rootFolder, m_sessionTimeout, m_translatedFiles, m_translationFileLoaded, m_translator, Log::WARNING, and WWW_FOLDER.

Referenced by WebApplication().

Here is the call graph for this function:

Here is the caller graph for this function:

declarePublicAPI()

void WebApplication::declarePublicAPI ( const QString &  apiPath )

private

Definition at line 435 of file webapplication.cpp.

{
    m_publicAPIs << apiPath;
}

References m_publicAPIs.

Referenced by WebApplication().

Here is the caller graph for this function:

doProcessRequest()

void WebApplication::doProcessRequest ( )

private

Definition at line 260 of file webapplication.cpp.

{
    const QRegularExpressionMatch match = m_apiPathPattern.match(request().path);
    if (!match.hasMatch())
    {
        sendWebUIFile();
        return;
    }
 
    const QString action = match.captured(QLatin1String("action"));
    const QString scope = match.captured(QLatin1String("scope"));
 
    APIController *controller = m_apiControllers.value(scope);
    if (!controller)
        throw NotFoundHTTPError();
 
    if (!session() && !isPublicAPI(scope, action))
        throw ForbiddenHTTPError();
 
    DataMap data;
    for (const Http::UploadedFile &torrent : request().files)
        data[torrent.filename] = torrent.data;
 
    try
    {
        const QVariant result = controller->run(action, m_params, data);
        switch (result.userType())
        {
        case QMetaType::QJsonDocument:
            print(result.toJsonDocument().toJson(QJsonDocument::Compact), Http::CONTENT_TYPE_JSON);
            break;
        case QMetaType::QString:
        default:
            print(result.toString(), Http::CONTENT_TYPE_TXT);
            break;
        }
    }
    catch (const APIError &error)
    {
        // re-throw as HTTPError
        switch (error.type())
        {
        case APIErrorType::AccessDenied:
            throw ForbiddenHTTPError(error.message());
        case APIErrorType::BadData:
            throw UnsupportedMediaTypeHTTPError(error.message());
        case APIErrorType::BadParams:
            throw BadRequestHTTPError(error.message());
        case APIErrorType::Conflict:
            throw ConflictHTTPError(error.message());
        case APIErrorType::NotFound:
            throw NotFoundHTTPError(error.message());
        default:
            Q_ASSERT(false);
        }
    }
}

References AccessDenied, tstool::action, BadData, BadParams, Conflict, Http::CONTENT_TYPE_JSON, Http::CONTENT_TYPE_TXT, files(), isPublicAPI(), m_apiControllers, m_apiPathPattern, m_params, Exception::message(), NotFound, Http::ResponseBuilder::print(), request(), APIController::run(), sendWebUIFile(), session(), and APIError::type().

Referenced by processRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

env()

const Http::Environment & WebApplication::env

(

)

const

Definition at line 255 of file webapplication.cpp.

{
    return m_env;
}

References m_env.

Referenced by processRequest().

Here is the caller graph for this function:

generateSid()

QString WebApplication::generateSid ( ) const

private

Definition at line 573 of file webapplication.cpp.

{
    QString sid;
 
    do
    {
        const quint32 tmp[] =
        {Utils::Random::rand(), Utils::Random::rand(), Utils::Random::rand()
                , Utils::Random::rand(), Utils::Random::rand(), Utils::Random::rand()};
        sid = QByteArray::fromRawData(reinterpret_cast<const char *>(tmp), sizeof(tmp)).toBase64();
    }
    while (m_sessions.contains(sid));
 
    return sid;
}

References m_sessions, and Utils::Random::rand().

Referenced by sessionStart().

Here is the call graph for this function:

Here is the caller graph for this function:

isAuthNeeded()

bool WebApplication::isAuthNeeded ( )

private

Definition at line 589 of file webapplication.cpp.

{
    if (!m_isLocalAuthEnabled && Utils::Net::isLoopbackAddress(m_clientAddress))
        return false;
    if (m_isAuthSubnetWhitelistEnabled && Utils::Net::isIPInRange(m_clientAddress, m_authSubnetWhitelist))
        return false;
    return true;
}

References Utils::Net::isIPInRange(), Utils::Net::isLoopbackAddress(), m_authSubnetWhitelist, m_clientAddress, m_isAuthSubnetWhitelistEnabled, and m_isLocalAuthEnabled.

Referenced by sessionInitialize().

Here is the call graph for this function:

Here is the caller graph for this function:

isCrossSiteRequest()

bool WebApplication::isCrossSiteRequest ( const Http::Request &  request ) const

private

Definition at line 646 of file webapplication.cpp.

{
    // https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#Verifying_Same_Origin_with_Standard_Headers
 
    const auto isSameOrigin = [](const QUrl &left, const QUrl &right) -> bool
    {
        // [rfc6454] 5. Comparing Origins
        return ((left.port() == right.port())
                // && (left.scheme() == right.scheme())  // not present in this context
                && (left.host() == right.host()));
    };
 
    const QString targetOrigin = request.headers.value(Http::HEADER_X_FORWARDED_HOST, request.headers.value(Http::HEADER_HOST));
    const QString originValue = request.headers.value(Http::HEADER_ORIGIN);
    const QString refererValue = request.headers.value(Http::HEADER_REFERER);
 
    if (originValue.isEmpty() && refererValue.isEmpty())
    {
        // owasp.org recommends to block this request, but doing so will inevitably lead Web API users to spoof headers
        // so lets be permissive here
        return false;
    }
 
    // sent with CORS requests, as well as with POST requests
    if (!originValue.isEmpty())
    {
        const bool isInvalid = !isSameOrigin(urlFromHostHeader(targetOrigin), originValue);
        if (isInvalid)
            LogMsg(tr("WebUI: Origin header & Target origin mismatch! Source IP: '%1'. Origin header: '%2'. Target origin: '%3'")
                   .arg(m_env.clientAddress.toString(), originValue, targetOrigin)
                   , Log::WARNING);
        return isInvalid;
    }
 
    if (!refererValue.isEmpty())
    {
        const bool isInvalid = !isSameOrigin(urlFromHostHeader(targetOrigin), refererValue);
        if (isInvalid)
            LogMsg(tr("WebUI: Referer header & Target origin mismatch! Source IP: '%1'. Referer header: '%2'. Target origin: '%3'")
                   .arg(m_env.clientAddress.toString(), refererValue, targetOrigin)
                   , Log::WARNING);
        return isInvalid;
    }
 
    return true;
}

References Http::Environment::clientAddress, Http::HEADER_HOST, Http::HEADER_ORIGIN, Http::HEADER_REFERER, Http::HEADER_X_FORWARDED_HOST, Http::Request::headers, LogMsg(), m_env, request(), anonymous_namespace{webapplication.cpp}::urlFromHostHeader(), and Log::WARNING.

Referenced by processRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

isPublicAPI()

bool WebApplication::isPublicAPI ( const QString &  scope, const QString &  action  ) const

private

Definition at line 598 of file webapplication.cpp.

{
    return m_publicAPIs.contains(QString::fromLatin1("%1/%2").arg(scope, action));
}

References tstool::action, and m_publicAPIs.

Referenced by doProcessRequest().

Here is the caller graph for this function:

processRequest()

Http::Response WebApplication::processRequest ( const Http::Request &  request, const Http::Environment &  env  )

overridevirtual

Implements Http::IRequestHandler.

Definition at line 487 of file webapplication.cpp.

{
    m_currentSession = nullptr;
    m_request = request;
    m_env = env;
    m_params.clear();
 
    if (m_request.method == Http::METHOD_GET)
    {
        for (auto iter = m_request.query.cbegin(); iter != m_request.query.cend(); ++iter)
            m_params[iter.key()] = QString::fromUtf8(iter.value());
    }
    else
    {
        m_params = m_request.posts;
    }
 
    // clear response
    clear();
 
    try
    {
        // block suspicious requests
        if ((m_isCSRFProtectionEnabled && isCrossSiteRequest(m_request))
            || (m_isHostHeaderValidationEnabled && !validateHostHeader(m_domainList)))
            {
            throw UnauthorizedHTTPError();
        }
 
        // reverse proxy resolve client address
        m_clientAddress = resolveClientAddress();
 
        sessionInitialize();
        doProcessRequest();
    }
    catch (const HTTPError &error)
    {
        status(error.statusCode(), error.statusText());
        print((!error.message().isEmpty() ? error.message() : error.statusText()), Http::CONTENT_TYPE_TXT);
    }
 
    for (const Http::Header &prebuiltHeader : asConst(m_prebuiltHeaders))
        setHeader(prebuiltHeader);
 
    return response();
}

References asConst(), Http::ResponseBuilder::clear(), Http::CONTENT_TYPE_TXT, doProcessRequest(), env(), isCrossSiteRequest(), m_clientAddress, m_currentSession, m_domainList, m_env, m_isCSRFProtectionEnabled, m_isHostHeaderValidationEnabled, m_params, m_prebuiltHeaders, m_request, Exception::message(), Http::Request::method, Http::METHOD_GET, Http::Request::posts, Http::ResponseBuilder::print(), Http::Request::query, request(), resolveClientAddress(), Http::ResponseBuilder::response(), sessionInitialize(), Http::ResponseBuilder::setHeader(), Http::ResponseBuilder::status(), HTTPError::statusCode(), HTTPError::statusText(), and validateHostHeader().

Here is the call graph for this function:

registerAPIController()

void WebApplication::registerAPIController ( const QString &  scope, APIController *  controller  )

private

Definition at line 427 of file webapplication.cpp.

{
    Q_ASSERT(controller);
    Q_ASSERT(!m_apiControllers.value(scope));
 
    m_apiControllers[scope] = controller;
}

References m_apiControllers.

Referenced by WebApplication().

Here is the caller graph for this function:

request()

const Http::Request & WebApplication::request

(

)

const

Definition at line 250 of file webapplication.cpp.

{
    return m_request;
}

References m_request.

Referenced by doProcessRequest(), isCrossSiteRequest(), processRequest(), and sendWebUIFile().

Here is the caller graph for this function:

resolveClientAddress()

QHostAddress WebApplication::resolveClientAddress ( ) const

private

Definition at line 729 of file webapplication.cpp.

{
    if (!m_isReverseProxySupportEnabled)
        return m_env.clientAddress;
 
    // Only reverse proxy can overwrite client address
    if (!m_trustedReverseProxyList.contains(m_env.clientAddress))
        return m_env.clientAddress;
 
    const QString forwardedFor = m_request.headers.value(Http::HEADER_X_FORWARDED_FOR);
 
    if (!forwardedFor.isEmpty())
    {
        // client address is the 1st global IP in X-Forwarded-For or, if none available, the 1st IP in the list
        const QStringList remoteIpList = forwardedFor.split(',', Qt::SkipEmptyParts);
 
        if (!remoteIpList.isEmpty())
        {
            QHostAddress clientAddress;
 
            for (const QString &remoteIp : remoteIpList)
            {
                if (clientAddress.setAddress(remoteIp) && clientAddress.isGlobal())
                    return clientAddress;
            }
 
            if (clientAddress.setAddress(remoteIpList[0]))
                return clientAddress;
        }
    }
 
    return m_env.clientAddress;
}

References Http::Environment::clientAddress, Http::HEADER_X_FORWARDED_FOR, Http::Request::headers, m_env, m_isReverseProxySupportEnabled, m_request, and m_trustedReverseProxyList.

Referenced by processRequest().

Here is the caller graph for this function:

sendFile()

void WebApplication::sendFile ( const QString &  path )

private

Definition at line 440 of file webapplication.cpp.

{
    const QDateTime lastModified {QFileInfo(path).lastModified()};
 
    // find translated file in cache
    const auto it = m_translatedFiles.constFind(path);
    if ((it != m_translatedFiles.constEnd()) && (lastModified <= it->lastModified))
    {
        print(it->data, it->mimeType);
        setHeader({Http::HEADER_CACHE_CONTROL, getCachingInterval(it->mimeType)});
        return;
    }
 
    QFile file {path};
    if (!file.open(QIODevice::ReadOnly))
    {
        qDebug("File %s was not found!", qUtf8Printable(path));
        throw NotFoundHTTPError();
    }
 
    if (file.size() > MAX_ALLOWED_FILESIZE)
    {
        qWarning("%s: exceeded the maximum allowed file size!", qUtf8Printable(path));
        throw InternalServerErrorHTTPError(tr("Exceeded the maximum allowed file size (%1)!")
                                           .arg(Utils::Misc::friendlyUnit(MAX_ALLOWED_FILESIZE)));
    }
 
    QByteArray data {file.readAll()};
    file.close();
 
    const QMimeType mimeType {QMimeDatabase().mimeTypeForFileNameAndData(path, data)};
    const bool isTranslatable {mimeType.inherits(QLatin1String("text/plain"))};
 
    // Translate the file
    if (isTranslatable)
    {
        QString dataStr {data};
        translateDocument(dataStr);
        data = dataStr.toUtf8();
 
        m_translatedFiles[path] = {data, mimeType.name(), lastModified}; // caching translated file
    }
 
    print(data, mimeType.name());
    setHeader({Http::HEADER_CACHE_CONTROL, getCachingInterval(mimeType.name())});
}

References file(), Utils::Misc::friendlyUnit(), anonymous_namespace{webapplication.cpp}::getCachingInterval(), Http::HEADER_CACHE_CONTROL, m_translatedFiles, MAX_ALLOWED_FILESIZE, Http::ResponseBuilder::print(), Http::ResponseBuilder::setHeader(), and translateDocument().

Referenced by sendWebUIFile().

Here is the call graph for this function:

Here is the caller graph for this function:

sendWebUIFile()

void WebApplication::sendWebUIFile ( )

private

Definition at line 144 of file webapplication.cpp.

{
    const QStringList pathItems {request().path.split('/', Qt::SkipEmptyParts)};
    if (pathItems.contains(".") || pathItems.contains(".."))
        throw InternalServerErrorHTTPError();
 
    if (!m_isAltUIUsed)
    {
        if (request().path.startsWith(PATH_PREFIX_ICONS))
        {
            const QString imageFilename {request().path.mid(PATH_PREFIX_ICONS.size())};
            sendFile(QLatin1String(":/icons/") + imageFilename);
            return;
        }
    }
 
    const QString path
    {
        (request().path != QLatin1String("/")
                ? request().path
                : QLatin1String("/index.html"))
    };
 
    QString localPath
    {
        m_rootFolder
                + (session() ? PRIVATE_FOLDER : PUBLIC_FOLDER)
                + path
    };
 
    QFileInfo fileInfo {localPath};
 
    if (!fileInfo.exists() && session())
    {
        // try to send public file if there is no private one
        localPath = m_rootFolder + PUBLIC_FOLDER + path;
        fileInfo.setFile(localPath);
    }
 
    if (m_isAltUIUsed)
    {
#ifdef Q_OS_UNIX
        if (!Utils::Fs::isRegularFile(localPath))
        {
            status(500, "Internal Server Error");
            print(tr("Unacceptable file type, only regular file is allowed."), Http::CONTENT_TYPE_TXT);
            return;
        }
#endif
 
        while (fileInfo.filePath() != m_rootFolder)
        {
            if (fileInfo.isSymLink())
                throw InternalServerErrorHTTPError(tr("Symlinks inside alternative UI folder are forbidden."));
 
            fileInfo.setFile(fileInfo.path());
        }
    }
 
    sendFile(localPath);
}

References Http::CONTENT_TYPE_TXT, Utils::Fs::isRegularFile(), m_isAltUIUsed, m_rootFolder, Http::Request::path, PATH_PREFIX_ICONS, Http::ResponseBuilder::print(), PRIVATE_FOLDER, PUBLIC_FOLDER, request(), sendFile(), session(), and Http::ResponseBuilder::status().

Referenced by doProcessRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

session()

WebSession * WebApplication::session ( )

overridevirtual

Implements ISessionManager.

Definition at line 245 of file webapplication.cpp.

{
    return m_currentSession;
}

References m_currentSession.

Referenced by doProcessRequest(), sendWebUIFile(), and sessionStart().

Here is the caller graph for this function:

sessionEnd()

void WebApplication::sessionEnd ( )

overridevirtual

Implements ISessionManager.

Definition at line 632 of file webapplication.cpp.

{
    Q_ASSERT(m_currentSession);
 
    QNetworkCookie cookie(C_SID);
    cookie.setPath(QLatin1String("/"));
    cookie.setExpirationDate(QDateTime::currentDateTime().addDays(-1));
 
    delete m_sessions.take(m_currentSession->id());
    m_currentSession = nullptr;
 
    setHeader({Http::HEADER_SET_COOKIE, cookie.toRawForm()});
}

References C_SID, Http::HEADER_SET_COOKIE, WebSession::id(), m_currentSession, m_sessions, and Http::ResponseBuilder::setHeader().

Here is the call graph for this function:

sessionInitialize()

void WebApplication::sessionInitialize ( )

private

Definition at line 539 of file webapplication.cpp.

{
    Q_ASSERT(!m_currentSession);
 
    const QString sessionId {parseCookie(m_request.headers.value(QLatin1String("cookie"))).value(C_SID)};
 
    // TODO: Additional session check
 
    if (!sessionId.isEmpty())
    {
        m_currentSession = m_sessions.value(sessionId);
        if (m_currentSession)
        {
            if (m_currentSession->hasExpired(m_sessionTimeout))
            {
                // session is outdated - removing it
                delete m_sessions.take(sessionId);
                m_currentSession = nullptr;
            }
            else
            {
                m_currentSession->updateTimestamp();
            }
        }
        else
        {
            qDebug() << Q_FUNC_INFO << "session does not exist!";
        }
    }
 
    if (!m_currentSession && !isAuthNeeded())
        sessionStart();
}

References C_SID, WebSession::hasExpired(), Http::Request::headers, isAuthNeeded(), m_currentSession, m_request, m_sessions, m_sessionTimeout, anonymous_namespace{webapplication.cpp}::parseCookie(), sessionStart(), and WebSession::updateTimestamp().

Referenced by processRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

sessionStart()

void WebApplication::sessionStart ( )

overridevirtual

Implements ISessionManager.

Definition at line 603 of file webapplication.cpp.

{
    Q_ASSERT(!m_currentSession);
 
    // remove outdated sessions
    Algorithm::removeIf(m_sessions, [this](const QString &, const WebSession *session)
    {
        if (session->hasExpired(m_sessionTimeout))
        {
            delete session;
            return true;
        }
 
        return false;
    });
 
    m_currentSession = new WebSession(generateSid());
    m_sessions[m_currentSession->id()] = m_currentSession;
 
    QNetworkCookie cookie(C_SID, m_currentSession->id().toUtf8());
    cookie.setHttpOnly(true);
    cookie.setSecure(m_isSecureCookieEnabled && m_isHttpsEnabled);
    cookie.setPath(QLatin1String("/"));
    QByteArray cookieRawForm = cookie.toRawForm();
    if (m_isCSRFProtectionEnabled)
        cookieRawForm.append("; SameSite=Strict");
    setHeader({Http::HEADER_SET_COOKIE, cookieRawForm});
}

References C_SID, generateSid(), WebSession::hasExpired(), Http::HEADER_SET_COOKIE, WebSession::id(), m_currentSession, m_isCSRFProtectionEnabled, m_isHttpsEnabled, m_isSecureCookieEnabled, m_sessions, m_sessionTimeout, Algorithm::removeIf(), session(), and Http::ResponseBuilder::setHeader().

Referenced by sessionInitialize().

Here is the call graph for this function:

Here is the caller graph for this function:

translateDocument()

void WebApplication::translateDocument ( QString &  data ) const

private

Definition at line 206 of file webapplication.cpp.

{
    const QRegularExpression regex("QBT_TR\\((([^\\)]|\\)(?!QBT_TR))+)\\)QBT_TR\\[CONTEXT=([a-zA-Z_][a-zA-Z0-9_]*)\\]");
 
    int i = 0;
    bool found = true;
    while (i < data.size() && found)
    {
        QRegularExpressionMatch regexMatch;
        i = data.indexOf(regex, i, &regexMatch);
        if (i >= 0)
        {
            const QString sourceText = regexMatch.captured(1);
            const QString context = regexMatch.captured(3);
 
            const QString loadedText = m_translationFileLoaded
                ? m_translator.translate(context.toUtf8().constData(), sourceText.toUtf8().constData())
                : QString();
            // `loadedText` is empty when translation is not provided
            // it should fallback to `sourceText`
            QString translation = loadedText.isEmpty() ? sourceText : loadedText;
 
            // Use HTML code for quotes to prevent issues with JS
            translation.replace('\'', "&#39;");
            translation.replace('\"', "&#34;");
 
            data.replace(i, regexMatch.capturedLength(), translation);
            i += translation.length();
        }
        else
        {
            found = false; // no more translatable strings
        }
 
        data.replace(QLatin1String("${LANG}"), m_currentLocale.left(2));
        data.replace(QLatin1String("${CACHEID}"), m_cacheID);
    }
}

References m_cacheID, m_currentLocale, m_translationFileLoaded, and m_translator.

Referenced by sendFile().

Here is the caller graph for this function:

validateHostHeader()

bool WebApplication::validateHostHeader ( const QStringList &  domains ) const

private

Definition at line 693 of file webapplication.cpp.

{
    const QUrl hostHeader = urlFromHostHeader(m_request.headers[Http::HEADER_HOST]);
    const QString requestHost = hostHeader.host();
 
    // (if present) try matching host header's port with local port
    const int requestPort = hostHeader.port();
    if ((requestPort != -1) && (m_env.localPort != requestPort))
    {
        LogMsg(tr("WebUI: Invalid Host header, port mismatch. Request source IP: '%1'. Server port: '%2'. Received Host header: '%3'")
               .arg(m_env.clientAddress.toString()).arg(m_env.localPort)
               .arg(m_request.headers[Http::HEADER_HOST])
                , Log::WARNING);
        return false;
    }
 
    // try matching host header with local address
    const bool sameAddr = m_env.localAddress.isEqual(QHostAddress(requestHost));
 
    if (sameAddr)
        return true;
 
    // try matching host header with domain list
    for (const auto &domain : domains)
    {
        const QRegularExpression domainRegex {Utils::String::wildcardToRegexPattern(domain), QRegularExpression::CaseInsensitiveOption};
        if (requestHost.contains(domainRegex))
            return true;
    }
 
    LogMsg(tr("WebUI: Invalid Host header. Request source IP: '%1'. Received Host header: '%2'")
           .arg(m_env.clientAddress.toString(), m_request.headers[Http::HEADER_HOST])
            , Log::WARNING);
    return false;
}

References Http::Environment::clientAddress, Http::HEADER_HOST, Http::Request::headers, Http::Environment::localAddress, Http::Environment::localPort, LogMsg(), m_env, m_request, anonymous_namespace{webapplication.cpp}::urlFromHostHeader(), Log::WARNING, and Utils::String::wildcardToRegexPattern().

Referenced by processRequest().

Here is the call graph for this function:

Here is the caller graph for this function:

Member Data Documentation

m_apiControllers

QHash<QString, APIController *> WebApplication::m_apiControllers

private

Definition at line 131 of file webapplication.h.

Referenced by doProcessRequest(), and registerAPIController().

m_apiPathPattern

const QRegularExpression WebApplication::m_apiPathPattern {QLatin1String("^/api/v2/(?<scope>[A-Za-z_][A-Za-z_0-9]*)/(?<action>[A-Za-z_][A-Za-z_0-9]*)$")}

private

Definition at line 129 of file webapplication.h.

Referenced by doProcessRequest().

m_authSubnetWhitelist

QVector<Utils::Net::Subnet> WebApplication::m_authSubnetWhitelist

private

Definition at line 149 of file webapplication.h.

Referenced by configure(), and isAuthNeeded().

m_cacheID

const QString WebApplication::m_cacheID

private

Definition at line 127 of file webapplication.h.

Referenced by translateDocument().

m_clientAddress

QHostAddress WebApplication::m_clientAddress

private

Definition at line 162 of file webapplication.h.

Referenced by clientId(), isAuthNeeded(), and processRequest().

m_currentLocale

QString WebApplication::m_currentLocale

private

Definition at line 143 of file webapplication.h.

Referenced by configure(), and translateDocument().

m_currentSession

WebSession* WebApplication::m_currentSession = nullptr

private

Definition at line 123 of file webapplication.h.

Referenced by processRequest(), session(), sessionEnd(), sessionInitialize(), and sessionStart().

m_domainList

QStringList WebApplication::m_domainList

private

Definition at line 153 of file webapplication.h.

Referenced by configure(), and processRequest().

m_env

Http::Environment WebApplication::m_env

private

Definition at line 125 of file webapplication.h.

Referenced by env(), isCrossSiteRequest(), processRequest(), resolveClientAddress(), and validateHostHeader().

m_isAltUIUsed

bool WebApplication::m_isAltUIUsed = false

private

Definition at line 133 of file webapplication.h.

Referenced by configure(), and sendWebUIFile().

m_isAuthSubnetWhitelistEnabled

bool WebApplication::m_isAuthSubnetWhitelistEnabled

private

Definition at line 148 of file webapplication.h.

Referenced by configure(), and isAuthNeeded().

m_isCSRFProtectionEnabled

bool WebApplication::m_isCSRFProtectionEnabled

private

Definition at line 154 of file webapplication.h.

Referenced by configure(), processRequest(), and sessionStart().

m_isHostHeaderValidationEnabled

bool WebApplication::m_isHostHeaderValidationEnabled

private

Definition at line 156 of file webapplication.h.

Referenced by configure(), and processRequest().

m_isHttpsEnabled

bool WebApplication::m_isHttpsEnabled

private

Definition at line 157 of file webapplication.h.

Referenced by configure(), and sessionStart().

m_isLocalAuthEnabled

bool WebApplication::m_isLocalAuthEnabled

private

Definition at line 147 of file webapplication.h.

Referenced by configure(), and isAuthNeeded().

m_isReverseProxySupportEnabled

bool WebApplication::m_isReverseProxySupportEnabled

private

Definition at line 160 of file webapplication.h.

Referenced by resolveClientAddress().

m_isSecureCookieEnabled

bool WebApplication::m_isSecureCookieEnabled

private

Definition at line 155 of file webapplication.h.

Referenced by configure(), and sessionStart().

m_params

QHash<QString, QString> WebApplication::m_params

private

Definition at line 126 of file webapplication.h.

Referenced by doProcessRequest(), and processRequest().

m_prebuiltHeaders

QVector<Http::Header> WebApplication::m_prebuiltHeaders

private

Definition at line 164 of file webapplication.h.

Referenced by configure(), and processRequest().

m_publicAPIs

QSet<QString> WebApplication::m_publicAPIs

private

Definition at line 132 of file webapplication.h.

Referenced by declarePublicAPI(), and isPublicAPI().

m_request

Http::Request WebApplication::m_request

private

Definition at line 124 of file webapplication.h.

Referenced by processRequest(), request(), resolveClientAddress(), sessionInitialize(), and validateHostHeader().

m_rootFolder

QString WebApplication::m_rootFolder

private

Definition at line 134 of file webapplication.h.

Referenced by configure(), and sendWebUIFile().

m_sessions

QHash<QString, WebSession *> WebApplication::m_sessions

private

Definition at line 120 of file webapplication.h.

Referenced by generateSid(), sessionEnd(), sessionInitialize(), sessionStart(), and ~WebApplication().

m_sessionTimeout

int WebApplication::m_sessionTimeout

private

Definition at line 150 of file webapplication.h.

Referenced by configure(), sessionInitialize(), and sessionStart().

m_translatedFiles

QHash<QString, TranslatedFile> WebApplication::m_translatedFiles

private

Definition at line 142 of file webapplication.h.

Referenced by configure(), and sendFile().

m_translationFileLoaded

bool WebApplication::m_translationFileLoaded = false

private

Definition at line 145 of file webapplication.h.

Referenced by configure(), and translateDocument().

m_translator

QTranslator WebApplication::m_translator

private

Definition at line 144 of file webapplication.h.

Referenced by configure(), and translateDocument().

m_trustedReverseProxyList

QVector<QHostAddress> WebApplication::m_trustedReverseProxyList

private

Definition at line 161 of file webapplication.h.

Referenced by resolveClientAddress().

---

The documentation for this class was generated from the following files:

• src/webui/webapplication.h
• src/webui/webapplication.cpp