82 Commits (e66c568efcfeacb6ac95fc8b5ca749ef42d73d46)

Author	SHA1	Message	Date
Kirill Solomko	60fa23cb68	MT#60585 add user ban support ... * users for admin/subscriber realms are now banned if failed to login X amount of times (UI/API). * rework Redis connection and it's now a Catalyst plugin NGCP::Redis accessed by $c->redis_get_connection({database => 19}), the connection per database, per worker process is established only once and then reused (with auto built-in reconnect support). * remove Utils::Redis.pm as it does not have any code/logic anymore. * ban values are taken from $config->{security}{login} as - ban_enable: 1 - ban_expire_time: 3600 ban expire time in seconds - max_attempts: 5 * if max_attempts set to 0, the ban functionality is disabled as it requires to be at least 1 to work. * upon successful login or ban, the failed attempts counter is removed * the failed attempts counter is also removed automatically with the expire time equals "ban_expire_time" or otherwise 3600 seconds. * user bans are logged into panel.log * banned user receives exactly the same return page/codes as per invalid logic. Change-Id: I05cc68c623ee289488fc64f1af50527004dcaae1	9 months ago
Kirill Solomko	9d021be65a	MT#59979 add license control ... * UI and API parts are now under license control * new Util::License::get_license($c, $name) - fetches license status by name (1 if enabled, and also if /proc/ngcp/check if 'ok') * add Catalyst::Plugins::NGCP::License with license($name) to fetch valid license by name from anywhere using $c->license('pbx') or from the templates using c.license('pbx'). It internally uses Util::License::get_license($c, $name) * License::get_license_status($c) now requires $c as first argument as well logs license status check errors. * new ActionRoles::License that enables usage of :Does(License) RequiresLicense('pbx') LicenseDetachTo('/denied_page') in the Controller chains * Add license control for UI elements and return 403 Forbidden if a resource is covered by licenses and the license is not active * Hide UI elements if a license is not active * API/Entities/Entities new $c->set_config key: - per endpoint: $c->set_config({ required_licenses => [qw/pbx device_provisioning/] } - or per method: $c->set_config({ required_licenses => { POST => [qw/pbx device_provisioning/] } } } * In case if an API endpoint does not have a license: 403 Forbidden "Invalid license" reply is returned. * Add license based restrictions to API endpoints * /api documentation: - completely hide endpoints that do not have an active license - hide only methods that does not have an active license Change-Id: Iba45fc5068b02306a617fed7b5405f2210574b61	9 months ago
Marco Capetta	a0b78678b8	MT#56895 Deprecate 'api_embedded_forcearray' and 'api_links_forcearray' params ... Both the parameters 'www_admin.api_embedded_forcearray' and 'www_admin.api_links_forcearray' were created long time ago to have API backward compatible. But the consistency of the returned values is a priority, so we have to get rid of this option and keep the behavior of the current default: * always return an array * always return lisk as an array Change-Id: I75dccbf3b641a7e3c7f948c020cf2ebeb8a59065	2 years ago
Kirill Solomko	c826fccb29	MT#58157 escape uri refs in body.tt ... * URI that comes from c.req.uri must be escaped as Catalyst provides c.req.uri unescaped. * new Catalyst::NGCP::Plugin::EscapeURI with escape_uri() function * new NGCP::Panel::Utils::Generic::escape_uri() that uses URI::Escape::uri::escape_utf8() * c.req.uri and c.req.path occurrences in layout/body.tt are now escaped with c.escape_uri() Change-Id: Id0483fa6e570a0ff8db84b1d470caf5405cc0886	2 years ago
Kirill Solomko	20e77c7b54	TT#129162 tighten user access checks ... * add additional centralised checks for inactive and read_only users. * use_userdata_from_session=0 now for all auth realms to cause the data re-fetched from the database, to avoid scenarios when a user is set as inactive or read_only and UI keeps using the cached data. the change only affects cookie and JWT subscriber based sessions as in all other cases, the auth data is fetched from the storage regardless. * add is_active=1 flag for the internal 'system' role, as otherwise access would be permanently denied for it. * default 403 error for denied api requests is changed to "Forbidden" instead of "Forbidden path". Change-Id: I1d6d3c765ca8e017e11845c1f5260243a3963c3b	4 years ago
Alexander Lutay	3ba08f45ac	TT#122202 Re-enable use_session for realm api_subscriber_jwt ... Otherwise v1 session (cookies-based) is not created and v2 CSC cannot load v1 "iframe" content. Also it was impossible to switch between v1 and v2 CSC. Change-Id: Iab3fac6e8da6e5a2e81a0626a3db6faa3e011396	4 years ago
Kirill Solomko	ac30d51f37	TT#127750 add uploadtmp config option ... * 'umploadtmp' option is now defined in Panel->config and taken from ngcp_panel.conf otherwise falls back to /tmp Change-Id: I836f2d7dd346bd1853c513dacd2ab5caffbcdf3e	4 years ago
Flaviu Mates	e09c478ee1	TT#124275 Add 'Login to CSC' button in subscriber page ... * upon pressing the button, a new session object with selected subscriber's details will be inserted in Redis, and also a new ngcp-panel_subscriber cookie will be created containing the session id of the previously created session object; then the user will be redirected to CSC v1 address where the selected subscriber will be authenticated based on the cookie and Redis info * the new button will be available for admin, reseller, ccare and ccareadmin roles Change-Id: I03952efe4abe18e61884859c466d700a7885ead4	4 years ago
Kirill Solomko	61fc16dec8	TT#122000 split session cookies per realm ... * new Plugin Catalyst/Plugin/NGCP/RealmCookie.pm that extends Catalyst::Plugin::Session::State::Cookie and overloads methods responsible for cookie_name creation. It uses NGCP_REALM fastcgi header to append it to the cookie name. Empty cookie with name "appprefix"_session is suppressed on Session pre-setup. * Base cookie_name is now set to 'ngcp-panel' Change-Id: I6b4c10c5e1728d0dd7a6398bf5191925d5b904f6	4 years ago
Kirill Solomko	ddd35a292e	TT#84401 store session cookies for jwt auth ... Change-Id: Ie4e2792d230434cacdc4ee810fa49f6d9b2b3255	5 years ago
Kirill Solomko	cf51166170	TT#80550 enable admin jwt token for the whole UI ... * add admin_jwt realm * admin JWT tokens are now used to access all non /api content Change-Id: I711d6419f0b624b02b53876a8c9171ab638b5d09 (cherry picked from commit dc4d9ec84b5b1199f17631e9e1f9a39ab1996807)	5 years ago
Kirill Solomko	2c8a11029a	TT#80305 add JWT authentication for admin users ... * /admin_login_jwt now returns a JWT token for admin users and also the JWT token is supported in the authorization process for the admin requests Change-Id: I987640d46bd8a339a959a6b2efb65b6dce06bf8c	5 years ago
Kirill Solomko	8facf0e419	TT#73752 use cookie_secure=1 for sessions ... If this attribute set to 1 (or true for backward compatibility) - the cookie send by the server to the client will got the secure flag that tells the browser to send this cookies back to the server only via HTTPS. Change-Id: Ia99bf2187965893d14f7fed7f7c11c0b016aea53	5 years ago
Guillem Jover	651a581812	TT#68012 Namespace NGCP-specific Catalyst plugins ... Ideally we'd not pollute the Catalyst namespace, and instead would use our base NGCP namespace, but at least for the EscapeJs module having it there makes loading it easier as it requires integration with the Template::Toolkit engine. Change-Id: Ide3f723fb3becbf49c405d9b34eb464fa7f8adbd	6 years ago
Rene Krenn	05958e4e68	TT#63402 escape localized strings used in js arguments ... Change-Id: I61f3c77e7bd1fd4ac9e9b952ceecfa233bdbdbf1	6 years ago
Rene Krenn	cae5270af5	TT#56340 panel logline obfuscation ... adds gdpr obfuscation quoting for: + subscriber numbers + subscriber ip addresses + subscriber usernames + any logmessage "DATA": query parameters, form data, response data + subscriber uuid's + call id's + callforward sip uri's the quoting is centralized by $c->qs() ("quote sensitive"), using catalyst plugin mechanism. escape symbols are set to « (\x{ab}) and » (\x{bb}). generate_logfile_data_inventory.pl was modified to mark loglines with "gdpr affected" status, if $c->qs() was used in a log message. Change-Id: I0f42d7992594232ae33e5666b0a64009211c5b76	6 years ago
Rene Krenn	e6a6799f1a	TT#56463 fix string concat in log msg ... Change-Id: I044992ec2e7d6c0d417c8ebe80fb1e4eb4b6aa29	6 years ago
Rene Krenn	76b88062a1	TT#56411 honor use_session => 0 for bcrypt auth ... Revert "Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP"" This reverts commit 1cfc524f80. Change-Id: I7eb0842bd61a4aaddbe50206fb974110ead8efb6	6 years ago
Rene Krenn	1cfc524f80	Revert "TT#56411 honor use_session => 0 for bcrypt auth WIP" ... This reverts commit 4789f6b61f. Change-Id: I6b514443afe9e2a8dbc1ae4a527a38fd3fc1d1c6	6 years ago
Rene Krenn	4789f6b61f	TT#56411 honor use_session => 0 for bcrypt auth WIP ... Change-Id: I549c4e6fc18b7cb738e99b3a6e254a47db3af0cf	6 years ago
Guillem Jover	363da116ad	TT#53701 Move config files under etc/ ... Change-Id: I3e1e01a6c669cf0506c0c3b1ada7f4144f254c1d	6 years ago
Rene Krenn	29a8ca6918	TT#43654 datatable rowcount clipping ... to prevent long-running count query in case of mio. of items, it is done on a limited set, ie. select count(1) from (select id from cdr where .. limit 1000) the method determines if there are more than eg. 1000 rows, in which case the UI datatable will simply render a "+" "Showing 1 to 5 of 1000+ records" it is only enabled for the topical call history datatable for now. Change-Id: I1ca6d22c69784f20ec39c74e3db989c43f1a6918	7 years ago
Irina Peshinskaya	c72c74b174	TT#37650 Force ngcp:collection entities to array ... Change-Id: I34955929871d7a8c0327ad2c252cddd68fcf16d7	7 years ago
Irina Peshinskaya	98f4f7b996	TT#35702 Fixed deprecated Catalyst::Plugin::Session config option "session" ... Catalyst::Plugin::Session stopped to use this "session" and stash_to_flash didn't work Change-Id: I03a127fde4fed13d862cb1acc883e5a22b06b5ea	7 years ago
Andreas Granig	bfdf68ea40	TT#35523 Persist sessions in redis ... This will allow to apply changes or fail-over without re-login on the panel. Change-Id: Ie3dca1ea4ecfac75b1ffa939c3bba92afcc90db7	7 years ago
Rene Krenn	f54c69ecfd	TT#34022 write READY=1 to notify socket ... Change-Id: I6d24a1f76ea150e069f7c6ea9c344dd37945b386	7 years ago
Gerhard Jungwirth	24de4232e6	TT#30507 remove DataHal workaround layer ... (NGCP::Panel was loaded every time this was used) Change-Id: I62861e0756aaaf548c9be42b4842e9a06127119c	7 years ago
Gerhard Jungwirth	ba3548d825	TT#16003 implement JWT auth ... - read key from specific config file - key is hex encoded + fix: add libcryptx-perl as dependency (actually dep of libcrypt-jwt-perl) + fix: typo in perl (comma instead of assignment) + fix: chomp any preceeding newlines from jwt_secret Change-Id: I6c6bd4dc0d7fa7fa43868afb13b4d8d838d90564	8 years ago
Rene Krenn	da6390d947	TT#5557 timeline views for billing mappings ... Change-Id: Ic4e116934bae0c94103b7f155a26931a62858f80	8 years ago
Irina Peshinskaya	a4a0d311e4	TT#9309 Use config for the DataHal forcearray ... Change-Id: Ic99f12cc784033370dc195502659eb21dfdd36bd	8 years ago
Andreas Granig	8ad683d5ae	TT#12601 Move admin pass to bcrypt and drop cert ... For the migration of the admin pwd, the logic is as follows: 1. If the admin has a bcrypt password already, use this 2. If not, perform auth via md5, then clear the md5 column and write a salted bcrypt hash instead. For dropping the ssl client cert, we simply not store anymore the client certificate in the DB. As a result, you cannot download the certs (pem, p12) after creation anymore, so we immediately download the two certs in a zip file after creation. A cost of 13 takes 500ms on an i7-5500U CPU @ 2.40GHz, which seems to be a reasonable value. Change-Id: I1ce21321c58d8c57d7ddce1541995f64821b0053	8 years ago
Gerhard Jungwirth	5f1ee2632d	TT#6831 decode utf-16 for incoming sms ... they may come in as utf-8 or utf-16. the latter causes catalyst to die per default, which we circumvent. then we manually decode the text in utf-16. + fix bug where last jumps out of subrouting causing an exception Change-Id: I9df15317f4438b4205f7f0f6af26df8f85ae0614	9 years ago
Gerhard Jungwirth	1c2c8cf4fd	MT#19765 add subscriberlogin for API ... in line with the web-login, a domain can be specified or defaults to the request host. because validating the format "username@domain" is not supported natively by the catalyst HTTP auth plugin, the domain is checked manually at the appropriate place. Change-Id: Ifcc86234bc27598244788d1b4b07c2611c2e593b	9 years ago
Rene Krenn	4438756017	MT#18395 lazy load dashboard values ... csc dashboard recent calls cover last 24h Change-Id: I19704643203795949c3e46b44fd136a59f83ac2b	9 years ago
Kirill Solomko	c2922071ef	MT#17801 added api_admin_system authentication method ... Change-Id: Id02d7d764bf69de0d39cd5cb75eda1ecd2f552cf	9 years ago
Gerhard Jungwirth	74c3b01d5b	MT#16355 show ngcp version and dpkg list ... Change-Id: Ia26f669c21f37e7263e806f32d1cb547549fd57f	10 years ago
Michael Prokop	b9ef451a62	MT#5599 Get rid of unused Catalyst::Plugin::EnableMiddleware ... This plugin is no longer in use, code dependencies were dropped in commit 6a9f4559 and the Debian package dependency was dropped in commit 0e1b9ef Change-Id: Ie674e8b2673b98732f9f09674fe8a642d16d9182	10 years ago
Rene Krenn	c378681a24	MT#13903 balance interval catchup and resize WIP ... + synchronized contract balance catchup + balance interval resizing upon profile package transitions + dynamic interval length, interval start, carry-over propagation, .. + end-of-month 'preserve' mode correction for strictly aligned month intervals for start_mode=customer "create" timestamp + new api/balanceintervals resource to inspect contracts' balance interval histories + updated affected panel UI controllers + test case with time warps using Time::Fake caveats: - creating an invoice for a given 'period' (month) has to be refactored to select a disitnct balance interval. right now it takes the last interval in the month specified. - generate_invoice.pl is broken and needs a major refactoring Change-Id: I7bb54a83b76e510b1baa573a986d05400a7fec1e	10 years ago
Rene Krenn	2914f7c77e	MT#11919 Use local logger.conf	10 years ago
Gerhard Jungwirth	1c7fb3a781	MT#5435 option to show table summaries ... showing any supported aggregation method Change-Id: If439731261cb148105f4c1fb9608839610935e75	10 years ago
Gerhard Jungwirth	12ee43f671	MT#8395 replace email plugin	11 years ago
Andreas Granig	e3da688ecb	MT#8395 Remove loading of old module.	11 years ago
Kirill Solomko	18e07b2950	MT#7705 change Panel.pm to use ngcp-panel/logging.conf, reworked Utils/Message.pm logging	11 years ago
Andreas Granig	3c1362176a	MT#5879 Remove obsolete SVG view.	11 years ago
Andreas Granig	02610faa68	MT#6789 Implement email template management. ... Basic functionality to create, edit and delete email templates.	11 years ago
Gerhard Jungwirth	741516634a	MT#6703 set static path correctly	11 years ago
Gerhard Jungwirth	c169414196	MT#6703 restore config paths to static and templates	11 years ago
Irka	fb891ee0ed	Save state with incorrect, but fast svg template apply	11 years ago
Gerhard Jungwirth	1bf73a7bb6	MT#3961 Prepare for localization	11 years ago
Andreas Granig	6a9f4559b7	MT#5599 API: remove middleware handling.	11 years ago