diff --git a/lib/core/common.py b/lib/core/common.py index fc91fff44..78a64892b 100755 --- a/lib/core/common.py +++ b/lib/core/common.py @@ -3979,7 +3979,7 @@ def pollProcess(process, suppress_errors=False): break -def getSafeExString(ex): +def getSafeExString(ex, encoding=None): """ Safe way how to get the proper exception represtation as a string (Note: errors to be avoided: 1) "%s" % Exception(u'\u0161') and 2) "%s" % str(Exception(u'\u0161')) @@ -3992,4 +3992,4 @@ def getSafeExString(ex): elif getattr(ex, "msg", None): retVal = ex.msg - return getUnicode(retVal) + return getUnicode(retVal, encoding=encoding) diff --git a/lib/core/replication.py b/lib/core/replication.py index c5bbd24cc..476604598 100644 --- a/lib/core/replication.py +++ b/lib/core/replication.py @@ -8,9 +8,11 @@ See the file 'doc/COPYING' for copying permission import sqlite3 from extra.safe2bin.safe2bin import safechardecode +from lib.core.common import getSafeExString from lib.core.common import unsafeSQLIdentificatorNaming from lib.core.exception import SqlmapGenericException from lib.core.exception import SqlmapValueException +from lib.core.settings import UNICODE_ENCODING class Replication(object): """ @@ -49,11 +51,16 @@ class Replication(object): self.name = unsafeSQLIdentificatorNaming(name) self.columns = columns if create: - self.execute('DROP TABLE IF EXISTS "%s"' % self.name) - if not typeless: - self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) - else: - self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) + try: + self.execute('DROP TABLE IF EXISTS "%s"' % self.name) + if not typeless: + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s" %s' % (unsafeSQLIdentificatorNaming(colname), coltype) for colname, coltype in self.columns))) + else: + self.execute('CREATE TABLE "%s" (%s)' % (self.name, ','.join('"%s"' % unsafeSQLIdentificatorNaming(colname) for colname in self.columns))) + except Exception, ex: + errMsg = "problem occurred ('%s') while initializing the sqlite database " % getSafeExString(ex, UNICODE_ENCODING) + errMsg += "located at '%s'" % self.parent.dbpath + raise SqlmapGenericException(errMsg) def insert(self, values): """ @@ -70,7 +77,7 @@ class Replication(object): try: self.parent.cursor.execute(sql, parameters) except sqlite3.OperationalError, ex: - errMsg = "problem occurred ('%s') while accessing sqlite database " % unicode(ex) + errMsg = "problem occurred ('%s') while accessing sqlite database " % getSafeExString(ex, UNICODE_ENCODING) errMsg += "located at '%s'. Please make sure that " % self.parent.dbpath errMsg += "it's not used by some other program" raise SqlmapGenericException(errMsg) diff --git a/lib/request/connect.py b/lib/request/connect.py index b1ecf8f23..19ae69301 100644 --- a/lib/request/connect.py +++ b/lib/request/connect.py @@ -630,7 +630,7 @@ class Connect(object): raise SqlmapConnectionException(warnMsg) finally: - if not isinstance(page, unicode): + if isinstance(page, basestring) and not isinstance(page, unicode): if HTTP_HEADER.CONTENT_TYPE in (responseHeaders or {}) and not re.search(TEXT_CONTENT_TYPE_REGEX, responseHeaders[HTTP_HEADER.CONTENT_TYPE]): page = unicode(page, errors="ignore") else: diff --git a/lib/utils/api.py b/lib/utils/api.py index d66097261..7a73905a8 100644 --- a/lib/utils/api.py +++ b/lib/utils/api.py @@ -116,7 +116,8 @@ class Database(object): class Task(object): - def __init__(self, taskid): + def __init__(self, taskid, remote_addr): + self.remote_addr = remote_addr self.process = None self.output_directory = None self.options = None @@ -343,7 +344,9 @@ def task_new(): Create new task ID """ taskid = hexencode(os.urandom(8)) - DataStore.tasks[taskid] = Task(taskid) + remote_addr = request.remote_addr + + DataStore.tasks[taskid] = Task(taskid, remote_addr) logger.debug("Created new task: '%s'" % taskid) return jsonize({"success": True, "taskid": taskid}) @@ -368,21 +371,23 @@ def task_delete(taskid): ################### -@get("/admin/list") @get("/admin//list") def task_list(taskid=None): """ List task pull """ - logger.debug("[%s] Listed task pool") - if taskid is not None: + if is_admin(taskid): tasks = list(DataStore.tasks) else: - tasks = {x: dejsonize(scan_status(x))['status'] - for x in list(DataStore.tasks)} + tasks = [] + for key in DataStore.tasks: + if DataStore.tasks[key].remote_addr == request.remote_addr: + tasks.append(key) + tasks = {x: dejsonize(scan_status(x))['status'] + for x in list(DataStore.tasks)} + logger.debug("[%s] Listed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr)) return jsonize({"success": True, "tasks": tasks, "tasks_num": len(tasks)}) - @get("/admin//flush") def task_flush(taskid): """ @@ -390,11 +395,13 @@ def task_flush(taskid): """ if is_admin(taskid): DataStore.tasks = dict() - logger.debug("[%s] Flushed task pool" % taskid) - return jsonize({"success": True}) else: - logger.warning("[%s] Unauthorized call to task_flush()" % taskid) - return jsonize({"success": False, "message": "Unauthorized"}) + for key in list(DataStore.tasks): + if DataStore.tasks[key].remote_addr == request.remote_addr: + del DataStore.tasks[key] + + logger.debug("[%s] Flushed task pool (%s)" % (taskid, "admin" if is_admin(taskid) else request.remote_addr)) + return jsonize({"success": True}) ################################## # sqlmap core interact functions # @@ -719,7 +726,9 @@ def client(host=RESTAPI_SERVER_HOST, port=RESTAPI_SERVER_PORT): taskid = None continue - cmdLineOptions = { k: v for k, v in cmdLineOptions.iteritems() if v is not None } + for key in list(cmdLineOptions): + if cmdLineOptions[key] is None: + del cmdLineOptions[key] raw = _client(addr + "/task/new") res = dejsonize(raw) @@ -749,7 +758,7 @@ def client(host=RESTAPI_SERVER_HOST, port=RESTAPI_SERVER_PORT): logger.info("Switching to task ID '%s' " % taskid) elif command.lower() == "list": - raw = _client(addr + "/admin/list") + raw = _client(addr + "/admin/0/list") res = dejsonize(raw) if not res["success"]: logger.error("Failed to execute command " + command)