37 lines
635 B
Go
37 lines
635 B
Go
package httpapi
|
|
|
|
import (
|
|
"net"
|
|
"net/http"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func loopbackAdminOnly() gin.HandlerFunc {
|
|
return func(ctx *gin.Context) {
|
|
host, _, err := net.SplitHostPort(ctx.Request.RemoteAddr)
|
|
if err != nil {
|
|
denyNonLocalAdmin(ctx)
|
|
return
|
|
}
|
|
address := net.ParseIP(host)
|
|
if address == nil || !address.IsLoopback() {
|
|
denyNonLocalAdmin(ctx)
|
|
return
|
|
}
|
|
ctx.Next()
|
|
}
|
|
}
|
|
|
|
func denyNonLocalAdmin(ctx *gin.Context) {
|
|
ctx.Header("Cache-Control", "no-store")
|
|
ctx.AbortWithStatusJSON(
|
|
http.StatusForbidden,
|
|
errorResponse(
|
|
ctx,
|
|
"ADMIN_SESSION_REQUIRED",
|
|
"admin session required",
|
|
),
|
|
)
|
|
}
|