diff --git a/main.py b/main.py index 1520448..b5437b5 100644 --- a/main.py +++ b/main.py @@ -38,6 +38,12 @@ cors = CORS(app, resources={r"/foo": {"origins": "*"}}) app.config['CORS_HEADERS'] = 'Content-Type' app.config['UPLOAD_FOLDER'] = upload_folder +@app.before_request +def before_request(): + + if mycommon.check_source_ipv4(str(request.remote_addr)) is False: + return "Security check : '" + request.remote_addr + "' is not autorized", 404 + def crossdomain(origin=None, methods=None, headers=None, max_age=21600, attach_to_all=True, automatic_options=True): @@ -434,6 +440,9 @@ def get_class_global_search(search_string): @app.route('/myclass/api/get_all_class/', methods=['GET','POST']) @crossdomain(origin='*') def get_all_class(): + if mycommon.check_source_ipv4(str(request.remote_addr)) is False : + return jsonify(status="False", message="Security check : "+request.remote_addr+"' is not autorized") + payload = request.form.to_dict() status, result = wp.get_all_class(payload) print(" ### payload = ", payload) @@ -834,16 +843,8 @@ def partner_login(): if __name__ == '__main__': print(" debut api") - #ls.init_ch() - - #pc.similaire() - #pc.textdist() - #pc.test() context = SSL.Context(SSL.SSLv23_METHOD) - #context.use_privatekey_file('./ssl2/key.pem') - #context.use_certificate_file('./ssl2/cert.pem') - context = ('./ssl2/key.pem', './ssl2/cert.pem') app.run(host='localhost', port=5000, debug=True, threaded=True) #app.run(host='192.168.1.21', port=5000, debug=True) diff --git a/prj_common.py b/prj_common.py index d25ee42..a49b8f8 100644 --- a/prj_common.py +++ b/prj_common.py @@ -20,6 +20,9 @@ CONNECTION_STRING = "mongodb://localhost/cherifdb" client = MongoClient(CONNECTION_STRING) dbname = client['cherifdb'] +AUTORIZED_SOURCE_IPV4=["127.0.0.1", "localhost", "88.170.110.220", "192.168.1.21", "192.168.1.48"] + + def myprint(message = ""): logging.info(str(datetime.now()) + " : "+str(message) ) print(str(datetime.now()) + " : " + str(message)) @@ -346,3 +349,23 @@ def recherche_check_word_in_fr_dict(mot=None): exc_type, exc_obj, exc_tb = sys.exc_info() myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno)) return False + + +''' +Securité : Ip source requester +Cette fonction verifie si l'adresse IP de la source +est autorisé ou pas. +''' +def check_source_ipv4(source_ip=None): + try: + if source_ip in AUTORIZED_SOURCE_IPV4: + myprint(" Security check : IP adresse '"+str(source_ip)+"' connected") + return True + else: + myprint(" Security check : IP adresse '" + str(source_ip) + "' is not autorized") + return False + + except Exception as e: + exc_type, exc_obj, exc_tb = sys.exc_info() + myprint(str(inspect.stack()[0][3]) + " -" + str(e) + " - Line : " + str(exc_tb.tb_lineno)) + return False