Skip to content
Merged
Changes from 8 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 49 additions & 1 deletion src/murfey/server/api/session_info.py
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,10 @@
from logging import getLogger
from pathlib import Path
from typing import Dict, List, Optional
import requests

from fastapi import APIRouter, Depends, Request
from fastapi.responses import FileResponse
from fastapi.responses import FileResponse, JSONResponse
from pydantic import BaseModel
from sqlmodel import select

Expand Down Expand Up @@ -470,3 +471,50 @@
visit_name=visit_name, session_id=session_id, tiff_path=tiff_path, db=db
)
return FileResponse(path=tiff_file) if isinstance(tiff_file, Path) else tiff_file

#Methods for turning alerts on and off
alertmanager_url = "https://murfey-alertmanager.diamond.ac.uk"
alertmanager_url = sanitise(alertmanager_url)

@router.get("/silences/{microscope}")
def get_silences(microscope: str):
microscope_sanitised = sanitise(microscope)
silences = requests.get(f"{alertmanager_url}/api/v2/silences?filter=microscope={microscope_sanitised}")

Check failure

Code scanning / CodeQL

Partial server-side request forgery Critical

Part of the URL of this request depends on a
user-provided value
.
Part of the URL of this request depends on a
user-provided value
.
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
active_silences = []
for silence in silences.json():
if silence['status']['state'] == 'active':
active_silences.append(silence)
return (active_silences)

@router.post("/silences/{microscope}")
def create_silence(microscope: str, end_time: datetime ):
microscope = sanitise(microscope)
start_time = datetime.now().astimezone().isoformat()
end_time = end_time.astimezone().isoformat()
silence_json = {
"matchers":[
{
"name": "microscope",
"value": microscope,
"isRegex": False
}],
"createdBy": "murfey",
"annotations":{"description": "Test"},
"comment": "silence created from murfey",
"status": {"state": "active"},
"startsAt": str(start_time),
"endsAt": str(end_time)
}
response = requests.post(f"{alertmanager_url}/api/v2/silences", json=silence_json)
return JSONResponse(status_code=response.status_code, content=response.json()) #return a response with same data and code as from alertmanager

@router.delete("/silences/{microscope}") #delete all silences for given microscope
def delete_silences(microscope: str):
microscope_sanitised = sanitise(microscope)
silences = get_silences(microscope_sanitised)
if len(silences) == 0:
return None
for silence in silences:
id = silence['id']
response = requests.delete(f"{alertmanager_url}/api/v2/silence/{id}")

Check failure

Code scanning / CodeQL

Partial server-side request forgery Critical

Part of the URL of this request depends on a
user-provided value
.
Part of the URL of this request depends on a
user-provided value
.
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
return response #returns final response in loop
Loading