Ejemplo n.º 1
0
 private bool ValidateRetrieveRequest(CompanyListRetrieveRequest req)
 {
     if (req.LoginToken == null)
     {
         return(false);
     }
     if (req.UserId <= 0)
     {
         return(false);
     }
     if (req.NamePortion == null || req.NamePortion.Equals(""))
     {
         return(false);
     }
     return(true);
 }
Ejemplo n.º 2
0
        private void HandlePutRequest(HttpListenerContext ctx)
        {
            try
            {
                #region Input Validation
                if (!ctx.Request.HasEntityBody)
                {
                    WriteBodyResponse(ctx, 400, "Invalid Format", "Request did not contain a body");
                    return;
                }
                CompanyListRetrieveRequest entry = JsonDataObjectUtil <CompanyListRetrieveRequest> .ParseObject(ctx);

                if (entry == null)
                {
                    WriteBodylessResponse(ctx, 400, "Invalid Format");
                    return;
                }
                if (!ValidateRetrieveRequest(entry))
                {
                    WriteBodyResponse(ctx, 400, "Invalid Format", "One or more fields contained an invalid value or were missing");
                    return;
                }
                #endregion

                MySqlDataManipulator connection = new MySqlDataManipulator();
                using (connection)
                {
                    bool res = connection.Connect(MySqlDataManipulator.GlobalConfiguration.GetConnectionString());
                    if (!res)
                    {
                        WriteBodyResponse(ctx, 500, "Unexpected Server Error", "Connection to database failed");
                        return;
                    }
                    #region User Validation
                    OverallUser mappedUser = connection.GetUserById(entry.UserId);
                    if (mappedUser == null)
                    {
                        WriteBodyResponse(ctx, 404, "Not Found", "User was not found on on the server");
                        return;
                    }
                    if (!UserVerificationUtil.LoginTokenValid(mappedUser, entry.LoginToken))
                    {
                        WriteBodyResponse(ctx, 401, "Not Authorized", "Login token was incorrect.");
                        return;
                    }
                    #endregion

                    #region Input sanitation
                    if (entry.NamePortion.Contains('`'))
                    {
                        WriteBodyResponse(ctx, 400, "Bad Request", "Request contained a backtick character(`)." +
                                          "This character is disallowed due to SQL injection attacks.");
                        return;
                    }
                    #endregion

                    List <CompanyId> companies = connection.GetCompaniesWithNamePortion(entry.NamePortion);
                    if (companies == null)
                    {
                        WriteBodyResponse(ctx, 500, "Internal Server Error", "Error occured while retrieving companies: " + connection.LastException.Message);
                        return;
                    }
                    JsonListStringConstructor retConstructor = new JsonListStringConstructor();
                    companies.ForEach(req => retConstructor.AddElement(WriteCompanyIdToOutput(req)));

                    WriteBodyResponse(ctx, 200, "OK", retConstructor.ToString());
                }
            }
            catch (HttpListenerException)
            {
                //HttpListeners dispose themselves when an exception occurs, so we can do no more.
            }
            catch (Exception e)
            {
                WriteBodyResponse(ctx, 500, "Internal Server Error", e.Message);
            }
        }