[HOW-TO] Move sensitive Info and Log to an Admin Only page

Tutorials, tips and tricks.

Moderator: moderators

[HOW-TO] Move sensitive Info and Log to an Admin Only page

Postby jaquense » Mon Apr 11, 2011 8:18 pm

Hey everyone. Can I just say what a wonderful program SS is. I LOVE it. I just thought I'd share one of the personal modifications i've made to my own server for the benefit of the community.

WARNING
I know this works because i have it running on mine, however I am writing this post modification so some of it is from memory and I haven't tested every aspect of the instructions. That being said this isn't going to blow anything up, and is easy to reverse if you (or I) screwed up, PROVIDED you back up each file before you edit it. This is admittedly very hackity, hack, hack.

Please follow the guidelines for making modifications to your SS server: http://forum.subsonic.org/forum/viewtopic.php?t=5852

THE PREMISE
I wasn't really happy with users having access to my server log or even the basic server info But I also didn't want to completely remove the "about" Page because it has other useful info and Donation info which I do want all of my users to see. Plus having log right there is really handy. Here is the basic idea of this mod. Split the About page into two pages: one with the server info/log that only admins have access to, and one with the basic subsonic info and donate link that everyone sees.

STEP 1:

We are primarily working with one folder, depending on what install you have that is:
Code: Select all
subsonic/jetty/<num>/webapp/WEB-INF/jsp

or
Code: Select all
subsonic/WEB-INF/jsp


First lets create a new Server Details page. This page will contain all of the sensitive info we do not want our users seeing. All I did was delete non sensitive info from the help.jsp and save-as serverDetailSettings.jsp. You can do the same, or just copy my edited page code below in any text editor and save it as serverDetailSettings.jsp into your ../jsp folder
Code: Select all
%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="iso-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html><head>
    <%@ include file="head.jsp" %>
    <script type="text/javascript" src="<c:url value="/script/scripts.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/interface/transferService.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/engine.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/util.js"/>"></script>
</head>
<body class="mainframe bgcolor1">

<c:if test="${model.newVersionAvailable}">
    <p class="warning"><fmt:message key="help.upgrade"><fmt:param value="${model.brand}"/><fmt:param value="${model.latestVersion}"/></fmt:message></p>
</c:if>

<c:choose>
    <c:when test="${empty model.buildDate}">
        <fmt:message key="common.unknown" var="buildDateString"/>
    </c:when>
    <c:otherwise>
        <fmt:formatDate value="${model.buildDate}" dateStyle="long" var="buildDateString"/>
    </c:otherwise>
</c:choose>

<c:choose>
    <c:when test="${empty model.localVersion}">
        <fmt:message key="common.unknown" var="versionString"/>
    </c:when>
    <c:otherwise>
        <c:set var="versionString" value="${model.localVersion} (build ${model.buildNumber})"/>
    </c:otherwise>
</c:choose>

<table width="75%" class="ruleTable indent">
    <tr><td class="ruleTableHeader"><fmt:message key="help.version.title"/></td><td class="ruleTableCell">${versionString} &ndash; ${buildDateString}</td></tr>
    <tr><td class="ruleTableHeader"><fmt:message key="help.server.title"/></td>
            <td class="ruleTableCell">${model.serverInfo} (<sub:formatBytes bytes="${model.usedMemory}"/> / <sub:formatBytes bytes="${model.totalMemory}"/>)</td></tr>
</table>

    <h2><img src="<spring:theme code="logImage"/>" alt="">&nbsp;<fmt:message key="help.log"/></h2>

    <table cellpadding="2" class="log indent">
                    <c:forEach items="${model.logEntries}" var="entry">
                        <tr>
                            <td>[<fmt:formatDate value="${entry.date}" dateStyle="short" timeStyle="long" type="both"/>]</td>
                            <td>${entry.level}</td><td>${entry.category}</td><td>${entry.message}</td>
                        </tr>
                    </c:forEach>
    </table>

    <p><fmt:message key="help.logfile"><fmt:param value="${model.logFile}"/></fmt:message> </p>

    <div class="forward"><a href="help.view?"><fmt:message key="common.refresh"/></a></div>
</body></html>


STEP 2
Now we need to remove server related info (which we just move to a new page) from the original About page. you can either open up help.jsp and remove the relevant info yourself if you are comfortable with editing html. Or you can let me do it and create a new help.jsp file with the following in it. After you are done save it, replacing the exisiting help.jsp with our new one.
Code: Select all
<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="iso-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html><head>
    <%@ include file="head.jsp" %>
    <script type="text/javascript" src="<c:url value="/script/scripts.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/interface/transferService.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/engine.js"/>"></script>
    <script type="text/javascript" src="<c:url value="/dwr/util.js"/>"></script>
</head>
<body class="mainframe bgcolor1">
<h1>
    <img src="<spring:theme code="helpImage"/>" alt="">
    <fmt:message key="help.title"><fmt:param value="${model.brand}"/></fmt:message>
</h1>

<table width="75%"><tr>
    <td><a href="<c:url value="/donate.view"/>"><img src="<spring:theme code="paypalImage"/>" alt=""></a></td>
    <td><fmt:message key="help.donate"><fmt:param value="${model.brand}"/></fmt:message></td>
</tr></table>

<table width="75%" class="ruleTable indent">
    <tr><td class="ruleTableHeader"><fmt:message key="help.license.title"/></td><td class="ruleTableCell">
        <a href="http://www.gnu.org/copyleft/gpl.html" target="_blank"><img style="float:right;margin-left: 10px" alt="GPL 3.0" src="<c:url value="/icons/gpl.png"/>"></a>
        <fmt:message key="help.license.text"><fmt:param value="${model.brand}"/></fmt:message></td></tr>
    <tr><td class="ruleTableHeader"><fmt:message key="help.homepage.title"/></td><td class="ruleTableCell"><a target="_blank" href="http://www.subsonic.org/">subsonic.org</a></td></tr>
    <tr><td class="ruleTableHeader"><fmt:message key="help.forum.title"/></td><td class="ruleTableCell"><a target="_blank" href="http://forum.subsonic.org/">forum.subsonic.org</a></td></tr>
    <tr><td class="ruleTableHeader"><fmt:message key="help.contact.title"/></td><td class="ruleTableCell"><fmt:message key="help.contact.text"><fmt:param value="${model.brand}"/></fmt:message></td></tr>
</table>

</body></html>


Recap Time
In our ../WEB-INF/jsp folder we have should have one new file serverDetailSettings.jsp and a new version of the help.jsp file. If you restart your server now and click About you should see a simplified version of the original about page; this one featuring just basic Subsonic info, sans any server info or the log

STEP 3
OK back to work. Next is to add the new Server Detail page back into SS so only admins can see it!

to do this we open up subsonic-servlet.xml in the ../WEB-INF folder
scroll down until you find
Code: Select all
    <bean id="helpController" class="net.sourceforge.subsonic.controller.HelpController">
        <property name="viewName" value="help"/>
        <property name="versionService" ref="versionService"/>
        <property name="settingsService" ref="settingsService"/>
    </bean>

right underneath that paste:
Code: Select all
    <bean id="serverDetailController" class="net.sourceforge.subsonic.controller.HelpController">
        <property name="viewName" value="serverDetailSettings"/>
        <property name="versionService" ref="versionService"/>
        <property name="settingsService" ref="settingsService"/>
    </bean>

Now, in the same file, find:
Code: Select all
<prop key="/help.view">helpController</prop>

and underneath it paste:
Code: Select all
<prop key="/serverDetailSettings.view">serverDetailController</prop>


STEP 4
Now we have a functioning serverDetailSettings.view which we can theoretically navigate to. The problem is we have no link to it on any of our existing server pages. We have a few options to remedy that. The first is to add a new icon to the top frame: simple and elegant (also boring). Or for people who want to get really hacky (like myself) you can add a new admin only "Server Details" link under Settings

Here is instruction for both of those options; for simplicities sake I only recommend using one...

OPTION 1:

in WEB-INF/jsp open top.jsp.
find
Code: Select all
  <td style="min-width:4em;padding-right:1.5em">
      <a href="help.view?" target="main"><img src="<spring:theme code="helpImage"/>" title="${help}" alt="${help}"></a><br>
      <a href="help.view?" target="main">${help}</a>
  </td>

and underneath that paste:
Code: Select all
<c:if test="${model.user.adminRole}">
    <td style="min-width:4em;padding-right:1.5em">
        <a href="serverDetailSettings.view?" target="main"><img src="<spring:theme code="helpImage"/>" title="Server" alt="Server"></a><br>
        <a href="serverDetailSettings.view?" target="main">$Server</a>
    </td>
</c:if>


Proceed to the end unless you also want to add a link in your settings as well



OPTION 2:
To add a new settings entry replace or edit settingsHeader.jsp in ../WEB-INF/jsp/ with the following:

Code: Select all
<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="iso-8859-1" %>
<%@ include file="include.jsp" %>

<c:set var="categories" value="${param.restricted ? 'personal password player' : 'musicFolder general advanced personal user player network transcoding internetRadio podcast search serverDetail'}"/>
<h1>
    <img src="<spring:theme code="settingsImage"/>" alt=""/>
    <fmt:message key="settingsheader.title"/>
</h1>

<h2>
<c:forTokens items="${categories}" delims=" " var="cat" varStatus="loopStatus">
    <c:choose>
        <c:when test="${loopStatus.count > 1 and  (loopStatus.count - 1) % 6 != 0}">&nbsp;|&nbsp;</c:when>
        <c:otherwise></h2><h2></c:otherwise>
    </c:choose>

    <c:url var="url" value="${cat}Settings.view?"/>

    <c:choose>
        <c:when test="${param.cat eq cat}">
                  <c:choose>
                        <c:when test="${cat=='serverDetail'}">
                              <span class="headerSelected">Server Details</span>
                    </c:when>
                      <c:otherwise>
                        <span class="headerSelected"><fmt:message key="settingsheader.${cat}"/></span>
                      </c:otherwise>
                  </c:choose>
        </c:when>

        <c:otherwise>
                  <c:choose>
                        <c:when test="${cat=='serverDetail'}">
                              <a href="${url}">Server Details</a>
                    </c:when>
                      <c:otherwise>
                        <a href="${url}"><fmt:message key="settingsheader.${cat}"/></a>
                      </c:otherwise>
                  </c:choose>
        </c:otherwise>

    </c:choose>

</c:forTokens>
</h2>

<p></p>


Almost there. Open up serverDetailSettings.jsp again, and right underneath
Code: Select all
<body class="mainframe bgcolor1">

paste
Code: Select all
<c:import url="settingsHeader.jsp">
    <c:param name="cat" value="serverDetail"/>
</c:import>


save. clear cache. restart. you should now see (depending on the route you took) either a new Server icon up top or under Settings have a new Server Details option
jaquense
 
Posts: 47
Joined: Tue Dec 28, 2010 7:06 pm

Move users from "Playing" and "Home" Sec

Postby jboy71 » Sun May 29, 2011 4:10 pm

Hi, Great post, that worked perfectly for server details and I was able to use this idea to make the status options admin only also. I was wondering if you knew of a way to get the user chart under the "Home" and "Playing" section to be avalable only for admins. I have tried finding the files related to this but cannot. Any help would be greatly appreciated. :D
jboy71
 
Posts: 12
Joined: Sat May 28, 2011 12:58 am

Postby jaquense » Mon May 30, 2011 3:33 pm

So I haven't tried it but you can try opening up the home.jsp and alter the loop that creates the string of links up top, maybe you can make two loops, one that checks for user admin status and one that doesn't. Obviously you keep everything the same except you remove the token item "users" for the non admin loops.

I would try using the <c if test="${model.user.adminRole}"> test
jaquense
 
Posts: 47
Joined: Tue Dec 28, 2010 7:06 pm

Postby jboy71 » Mon May 30, 2011 9:27 pm

I am stuck on how to make two loops here. I was successfull getting the users link to not appear on the webpage by removing it from the tokens items, but cannot figure out how to setup the admin account to be the only one to see the "users" link.
jboy71
 
Posts: 12
Joined: Sat May 28, 2011 12:58 am

Re: [HOW-TO] Move sensitive Info and Log to an Admin Only pa

Postby Digitaldreamer7 » Wed Sep 14, 2011 7:54 am

Not to open a necro thread or anything but I Did this and it worked great! so thanks for that. I also want to move everything under the "status" button to the new "Server Details" area you helped me create. So i opened up the "serverDetailSettings.jsp and added..

Code: Select all
<table width="100%" class="ruleTable indent">
    <tr>
        <th class="ruleTableHeader"><fmt:message key="status.type"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.player"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.user"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.current"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.transmitted"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.bitrate"/></th>
    </tr>

    <c:forEach items="${model.transferStatuses}" var="status">

        <c:choose>
            <c:when test="${empty status.playerType}">
                <fmt:message key="common.unknown" var="type"/>
            </c:when>
            <c:otherwise>
                <c:set var="type" value="(${status.playerType})"/>
            </c:otherwise>
        </c:choose>

        <c:choose>
            <c:when test="${status.stream}">
                <fmt:message key="status.stream" var="transferType"/>
            </c:when>
            <c:when test="${status.download}">
                <fmt:message key="status.download" var="transferType"/>
            </c:when>
            <c:when test="${status.upload}">
                <fmt:message key="status.upload" var="transferType"/>
            </c:when>
        </c:choose>

        <c:choose>
            <c:when test="${empty status.username}">
                <fmt:message key="common.unknown" var="user"/>
            </c:when>
            <c:otherwise>
                <c:set var="user" value="${status.username}"/>
            </c:otherwise>
        </c:choose>

        <c:choose>
            <c:when test="${empty status.path}">
                <fmt:message key="common.unknown" var="current"/>
            </c:when>
            <c:otherwise>
                <c:set var="current" value="${status.path}"/>
            </c:otherwise>
        </c:choose>

        <sub:url value="/statusChart.view" var="chartUrl">
            <c:if test="${status.stream}">
                <sub:param name="type" value="stream"/>
            </c:if>
            <c:if test="${status.download}">
                <sub:param name="type" value="download"/>
            </c:if>
            <c:if test="${status.upload}">
                <sub:param name="type" value="upload"/>
            </c:if>
            <sub:param name="index" value="${status.index}"/>
        </sub:url>

        <tr>
            <td class="ruleTableCell">${transferType}</td>
            <td class="ruleTableCell">${status.player}<br>${type}</td>
            <td class="ruleTableCell">${user}</td>
            <td class="ruleTableCell">${current}</td>
            <td class="ruleTableCell">${status.bytes}</td>
            <td class="ruleTableCell" width="${model.chartWidth}"><img width="${model.chartWidth}" height="${model.chartHeight}" src="${chartUrl}" alt=""></td>
        </tr>
    </c:forEach>
</table>

<div class="forward"><a href="serverDetailSettings.view?"><fmt:message key="common.refresh"/></a></div>



But all i get is the headers for all the stats but no actual stats. What did I do wrong?
Digitaldreamer7
 
Posts: 8
Joined: Wed Sep 14, 2011 1:30 am

Re: [HOW-TO] Move sensitive Info and Log to an Admin Only pa

Postby tamarin » Mon Sep 19, 2011 11:25 pm

Great Mod !
Thank.
tamarin
 
Posts: 11
Joined: Mon Sep 19, 2011 11:19 pm

Re: [HOW-TO] Move sensitive Info and Log to an Admin Only pa

Postby califrag » Mon Oct 03, 2011 9:24 am

Digitaldreamer7 wrote:Not to open a necro thread or anything but I Did this and it worked great! so thanks for that. I also want to move everything under the "status" button to the new "Server Details" area you helped me create. So i opened up the "serverDetailSettings.jsp and added..

Code: Select all
<table width="100%" class="ruleTable indent">
    <tr>
        <th class="ruleTableHeader"><fmt:message key="status.type"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.player"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.user"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.current"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.transmitted"/></th>
        <th class="ruleTableHeader"><fmt:message key="status.bitrate"/></th>
    </tr>

    <c:forEach items="${model.transferStatuses}" var="status">

        <c:choose>
            <c:when test="${empty status.playerType}">
                <fmt:message key="common.unknown" var="type"/>
            </c:when>
            <c:otherwise>
                <c:set var="type" value="(${status.playerType})"/>
            </c:otherwise>
        </c:choose>

        <c:choose>
            <c:when test="${status.stream}">
                <fmt:message key="status.stream" var="transferType"/>
            </c:when>
            <c:when test="${status.download}">
                <fmt:message key="status.download" var="transferType"/>
            </c:when>
            <c:when test="${status.upload}">
                <fmt:message key="status.upload" var="transferType"/>
            </c:when>
        </c:choose>

        <c:choose>
            <c:when test="${empty status.username}">
                <fmt:message key="common.unknown" var="user"/>
            </c:when>
            <c:otherwise>
                <c:set var="user" value="${status.username}"/>
            </c:otherwise>
        </c:choose>

        <c:choose>
            <c:when test="${empty status.path}">
                <fmt:message key="common.unknown" var="current"/>
            </c:when>
            <c:otherwise>
                <c:set var="current" value="${status.path}"/>
            </c:otherwise>
        </c:choose>

        <sub:url value="/statusChart.view" var="chartUrl">
            <c:if test="${status.stream}">
                <sub:param name="type" value="stream"/>
            </c:if>
            <c:if test="${status.download}">
                <sub:param name="type" value="download"/>
            </c:if>
            <c:if test="${status.upload}">
                <sub:param name="type" value="upload"/>
            </c:if>
            <sub:param name="index" value="${status.index}"/>
        </sub:url>

        <tr>
            <td class="ruleTableCell">${transferType}</td>
            <td class="ruleTableCell">${status.player}<br>${type}</td>
            <td class="ruleTableCell">${user}</td>
            <td class="ruleTableCell">${current}</td>
            <td class="ruleTableCell">${status.bytes}</td>
            <td class="ruleTableCell" width="${model.chartWidth}"><img width="${model.chartWidth}" height="${model.chartHeight}" src="${chartUrl}" alt=""></td>
        </tr>
    </c:forEach>
</table>

<div class="forward"><a href="serverDetailSettings.view?"><fmt:message key="common.refresh"/></a></div>



But all i get is the headers for all the stats but no actual stats. What did I do wrong?



Hello, I think the problem lies somewhere in the servlet stuff..
I think that because status is defined as a "net.sourceforge.subsonic.controller.StatusController" it is allowed to have all the status info.
When you make the serverDetails you set it as "net.sourceforge.subsonic.controller.HelpController".. So it doesn't have access to status functions...
likewise, if you change the serverDetails to a 'StatusController', your status stuff should work, but the logfile and any other 'HelpController' stuff will break..

At least.. that was my experience with it :)
califrag
 
Posts: 72
Joined: Mon Sep 26, 2011 3:43 am


Return to Tutorials

Who is online

Users browsing this forum: No registered users and 14 guests