Re: [mh] Command Authorization

Hi Steve,

  Wayne had some similar thoughts around this. In the latest MH, there is a ‘groups’ function where we could create users, groups, and authorized commands from the web UI. There is also an ‘authorize’ http endpoint where the username + MD5 hash (password + YYYYDDMM) can return an authorization response. Wayne’s been pretty busy as well, so some of the framework is in place, but needs some additional work to finalize. 

  To get an idea, look at sub main::Groups in handy_utilities.pl, and the security sections in json_server.pl  in the latest master.

  If this aligns with your ideas, be great to get some help to finish up this functionality as I think if this was more mature it would be a nice feature to add to the next release.

howard

> On Dec 22, 2018, at 11:58 PM, <[email protected]> <[email protected]> wrote:
> 
> Hi again!
>    I have recently been slowly working on enhancing the security of my voice_android.pl script that allows me to use autovoice and tasker to control MH. Basically, I say a command, google translates it to text, and tasker performs an HTTPS post to my MH server which then looks for a Voice_Cmd that matches, calling it if there’s a match.
>  
>    Over the past few months, I’ve slowly added code the recognizes which phone is sending the command and (more importantly) which user. This user is now compared against the results of $ref->get_authority and if it’s either ‘anyone’ or matches my username, the command is allowed. As a backup I created a “sudo” prefix that allows me to override this security until I get it right.
>  
>    What I’d love to do is expand the Generic_Item set_authority / get_authority combination to allow for multiple users, perhaps groups and be easy to implement into user code. The only place that I can see that’s using get_authority is things like telnet.pl, internet_im.pl menu_code.pl and http_server.pl. Is anyone using set/get outside of this codebase?
>  
>    I envision using routines like add_authority / rem_authority / clear_authority and something like a check_authority that can be used to pass a username to compare to the array of username allowed to execute the command, returning a true/false. If get_authority is called it’ll return one text result (first one), unless it’s called with a parameter that tells it to return the entire array. Come to think of it, maybe it should be a hash, so we can include group names?
>  
>    Has any work already been done on this since I last upgraded? It’s been quite a while! If so, how can I best integrate?
>  
> Thank you!
>  
> Steve
> ________________________________________________________
> To unsubscribe from this list, go to: https://lists.sourceforge.net/lists/listinfo/misterhouse-users <https://lists.sourceforge.net/lists/listinfo/misterhouse-users>

________________________________________________________
To unsubscribe from this list, go to: https://lists.sourceforge.net/lists/listinfo/misterhouse-users