public override bool IsAuthorized(AuthFilterContext context)
{
if (DomainUtility.IsTestEnvironment)
{
return(true);
}
using (APIAccessService apiAccessService = new APIAccessService())
{
//when a client is calling main api ,they have to put token,which is password, in header named token
if (context.ActionContext.Request.Headers.Contains("token"))
{
return(apiAccessService.HasAccess(ApiUtility.GetIPAddress(), context.ActionContext.Request.Headers.GetValues("token").FirstOrDefault()));
}
else
{
if (AccessUtility.CalledByLocalSA(HttpContext.Current.Request))
{
//it is called from single action module in same server with same ip.
return(true);
}
else
{
//when bpms user panel is calling engine api,every request should have formToken in its parameters.
string formToken = context.ActionContext.RequestContext.Url.Request.GetHttpContext().Request.QueryString[FormTokenUtility.FormToken];
return(FormTokenUtility.ValidateFormToken(formToken, HttpContext.Current.Session.SessionID));
}
}
}
}
public override bool IsAuthorized(AuthFilterContext context)
{
using (APIAccessService apiAccessService = new APIAccessService())
{
return(DomainUtility.IsTestEnvironment ? true :
FormTokenUtility.ValidateFormToken(context.ActionContext.RequestContext.Url.Request.GetHttpContext().Request.QueryString[FormTokenUtility.FormToken], HttpContext.Current.Session.SessionID));
}
}
public System.Net.Http.HttpResponseMessage PostData(string controller, string action, string formToken = "")
{
if (FormTokenUtility.ValidateFormToken(formToken, HttpContext.Current.Session.SessionID))
{
SingleActionSettingDTO setting = new SingleActionSettingDTO(new HttpRequestWrapper(HttpContext.Current.Request), base.PortalSettings.PortalId);
//when calling main api from client application, there is no need to pass formToken to main bpms api.
string url = UrlUtility.GetApiUrl(setting.WebApiAddress, action, controller, "", this.GetParameters().ToArray());
return(ApiUtility.PostData(url, QueryModel.GetFormDataList(this.MyRequest).ToList(), setting.WebServicePass, base.UserInfo.Username, ApiUtility.GetIPAddress(), HttpContext.Current.Session.SessionID, FormTokenUtility.GetIsEncrypted(formToken, HttpContext.Current.Session.SessionID)));
}
else
{
throw new System.Web.Http.HttpResponseException(System.Net.HttpStatusCode.Unauthorized);
}
}
public System.Net.Http.HttpResponseMessage GetData(string controller, string action, string formToken = "")
{
if (FormTokenUtility.ValidateFormToken(formToken, HttpContext.Current.Session.SessionID))
{
SingleActionSettingDTO setting = new SingleActionSettingDTO(new HttpRequestWrapper(HttpContext.Current.Request), base.PortalSettings.PortalId);
//when calling main bpms api from client application, there is no need to pass formToken to main bpms api.
string url = UrlUtility.GetApiUrl(setting.WebApiAddress, action, controller, "", this.GetParameters().ToArray());
var result = ApiUtility.GetData(url, setting.WebServicePass, base.UserInfo.Username, ApiUtility.GetIPAddress(), HttpContext.Current.Session.SessionID, FormTokenUtility.GetIsEncrypted(formToken, HttpContext.Current.Session.SessionID));
/*
* In ReportEngine.cs response would be flushed and as a result sessionID will be rewrite with server
* session ID which is different with singleAction sessionID because it sends data using api to server
* and therefore it must rewrite sessionid there in case user call report or download a file.
*/
SessionIDManager Manager = new SessionIDManager();
Manager.SaveSessionID(HttpContext.Current, HttpContext.Current.Session.SessionID, out bool redirected, out bool IsAdded);
return(result);
}
else
{
throw new System.Web.Http.HttpResponseException(System.Net.HttpStatusCode.Unauthorized);
}
}