121 lines
No EOL
4.1 KiB
C++
121 lines
No EOL
4.1 KiB
C++
#include <drogon/drogon.h>
|
|
#include <drogon/orm/DbClient.h>
|
|
#include <iostream>
|
|
#include <fstream>
|
|
#include <cstdlib>
|
|
#include <ctime>
|
|
#include <iomanip>
|
|
#include <sstream>
|
|
|
|
using namespace drogon;
|
|
using namespace drogon::orm;
|
|
|
|
// SECURITY FIX #32: Add audit logging for admin CLI operations
|
|
namespace {
|
|
void writeAuditLog(const std::string& action, const std::string& target,
|
|
const std::string& status, const std::string& details = "") {
|
|
// Get current timestamp
|
|
auto now = std::time(nullptr);
|
|
auto tm = *std::localtime(&now);
|
|
std::ostringstream timestamp;
|
|
timestamp << std::put_time(&tm, "%Y-%m-%d %H:%M:%S");
|
|
|
|
// Get hostname for audit trail
|
|
char hostname[256] = "unknown";
|
|
gethostname(hostname, sizeof(hostname));
|
|
|
|
// Build log entry
|
|
std::ostringstream logEntry;
|
|
logEntry << "[" << timestamp.str() << "] "
|
|
<< "HOST=" << hostname << " "
|
|
<< "ACTION=" << action << " "
|
|
<< "TARGET=" << target << " "
|
|
<< "STATUS=" << status;
|
|
if (!details.empty()) {
|
|
logEntry << " DETAILS=" << details;
|
|
}
|
|
logEntry << std::endl;
|
|
|
|
// Write to audit log file
|
|
std::string logPath = "/var/log/admin_tool_audit.log";
|
|
std::ofstream logFile(logPath, std::ios::app);
|
|
if (logFile.is_open()) {
|
|
logFile << logEntry.str();
|
|
logFile.close();
|
|
}
|
|
|
|
// Also output to stderr for immediate visibility
|
|
std::cerr << "[AUDIT] " << logEntry.str();
|
|
}
|
|
}
|
|
|
|
int main(int argc, char* argv[]) {
|
|
if (argc < 2) {
|
|
std::cerr << "Usage: " << argv[0] << " -promote-admin <username>" << std::endl;
|
|
return 1;
|
|
}
|
|
|
|
std::string command = argv[1];
|
|
|
|
if (command != "-promote-admin" || argc != 3) {
|
|
std::cerr << "Usage: " << argv[0] << " -promote-admin <username>" << std::endl;
|
|
return 1;
|
|
}
|
|
|
|
std::string username = argv[2];
|
|
|
|
// Get database config from environment or use defaults
|
|
std::string dbHost = std::getenv("DB_HOST") ? std::getenv("DB_HOST") : "postgres";
|
|
std::string dbName = std::getenv("DB_NAME") ? std::getenv("DB_NAME") : "streaming";
|
|
std::string dbUser = std::getenv("DB_USER") ? std::getenv("DB_USER") : "streamuser";
|
|
std::string dbPass = std::getenv("DB_PASS") ? std::getenv("DB_PASS") : "streampass";
|
|
|
|
// Create database client directly
|
|
auto dbClient = DbClient::newPgClient(
|
|
"host=" + dbHost + " port=5432 dbname=" + dbName +
|
|
" user=" + dbUser + " password=" + dbPass,
|
|
1 // connection number
|
|
);
|
|
|
|
writeAuditLog("PROMOTE_ADMIN_ATTEMPT", username, "STARTED");
|
|
|
|
try {
|
|
// Check if user exists
|
|
auto result = dbClient->execSqlSync(
|
|
"SELECT id, username, is_admin FROM users WHERE username = $1",
|
|
username
|
|
);
|
|
|
|
if (result.empty()) {
|
|
writeAuditLog("PROMOTE_ADMIN", username, "FAILED", "user_not_found");
|
|
std::cerr << "Error: User '" << username << "' not found." << std::endl;
|
|
return 1;
|
|
}
|
|
|
|
bool isAdmin = result[0]["is_admin"].as<bool>();
|
|
if (isAdmin) {
|
|
writeAuditLog("PROMOTE_ADMIN", username, "SKIPPED", "already_admin");
|
|
std::cout << "User '" << username << "' is already an admin." << std::endl;
|
|
return 0;
|
|
}
|
|
|
|
// Promote to admin
|
|
dbClient->execSqlSync(
|
|
"UPDATE users SET is_admin = true WHERE username = $1",
|
|
username
|
|
);
|
|
|
|
writeAuditLog("PROMOTE_ADMIN", username, "SUCCESS");
|
|
std::cout << "Successfully promoted '" << username << "' to admin." << std::endl;
|
|
return 0;
|
|
|
|
} catch (const DrogonDbException& e) {
|
|
writeAuditLog("PROMOTE_ADMIN", username, "ERROR", e.base().what());
|
|
std::cerr << "Database error: " << e.base().what() << std::endl;
|
|
return 1;
|
|
} catch (const std::exception& e) {
|
|
writeAuditLog("PROMOTE_ADMIN", username, "ERROR", e.what());
|
|
std::cerr << "Error: " << e.what() << std::endl;
|
|
return 1;
|
|
}
|
|
} |