RED-1930 mitigations

omf/models/forecastTool.html

@@ -216,7 +216,7 @@
         <p class="reportTitle" style="page-break-before:always">Note</p>
         <div id="effectiveness" class="content detailsContainer" style="margin-top:0px">
             <p>
-                To see the model's effectiveness over the course of an entire year, consider viewing <a href="{{pathPrefix}}/newModel/storagePeakShave/fromForecastTool">storagePeakShave.py</a>.
+                To see the model's effectiveness over the course of an entire year, consider viewing <a href="javascript:post_to_url('{{pathPrefix}}/newModel/storagePeakShave/fromForecastTool')">storagePeakShave.py</a>.
             </p>
         </div>
         <!-- <p class="reportTitle" style="page-break-before:always">Download Output Data</p>   

omf/solvers/gridlabd/__init__.py

@@ -145,7 +145,7 @@ def runInFilesystem(feederTree, attachments=[], keepFiles=False, workDir=None, g
 		# Write attachments and glm.
 		for attach in attachments:
 			with open (pJoin(workDir,attach),'w') as attachFile:
-				attachFile.write(attachments[attach])
+				attachFile.write(str(attachments[attach]))
 		glmString = omf.feeder.sortedWrite(localTree)
 		if not glmName:
 			glmName = "main." + datetime.datetime.now().strftime('%Y-%m-%d-%H-%M-%S') + ".glm"

omf/static/geoJsonMap/v3/featureController.js

@@ -263,6 +263,7 @@ class FeatureController { // implements ControllerInterface
                 data: formData,
                 processData: false,
                 contentType: false,
+                headers: {'X-CSRFToken': document.cookie.match('(^|;)\\s*_csrf_token=([^;]+)')?.pop() || ''},
             });
         } catch {
             loadingSpan.update({text: 'The server raised an internal exception during the operation. Please save before trying again.', showGif: false});

omf/static/geoJsonMap/v3/modalFeatures.js

@@ -337,7 +337,7 @@ function getAnonymizationButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisFeederName}/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -542,11 +542,11 @@ function _getRenameTable(observable, controller) {
     const input = _getNameInput(observable, function(newName) {
         const fileExistsUrl = {
             method: 'GET',
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}`
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}`
         }
         observable.setProperty('fileExistsUrl', fileExistsUrl, 'urlProps');
         const submitUrl = {
-            method: 'GET',
+            method: 'POST',
             url: `/renameFeeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}/${newName}/${gThisFeederNum}`
         }
         observable.setProperty('submitUrl', submitUrl, 'urlProps');
@@ -601,10 +601,10 @@ function getRenameButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/Default Name/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/Default Name`
                 },
                 submitUrl: {
-                    method: 'GET',
+                    method: 'POST',
                     url: `/renameFeeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}/Default Name/${gThisFeederNum}`
                 }
             }
@@ -660,7 +660,7 @@ function _getLoadFeederTable(observable, controller) {
             modalInsert.removeEventListener('click', hideModalInsert);
             observable.setProperty('fileExistsUrl', {
                 method: 'GET', 
-                url: `/uniqObjName/Feeder/public/${obj.name}/${obj.model}`
+                url: `/uniqObjName/Feeder/public/${obj.model}/${obj.name}`
             }, 'urlProps');
             observable.setProperty('submitUrl', {
                 method: 'POST',
@@ -699,7 +699,7 @@ function _getLoadFeederTable(observable, controller) {
                 //   admin's feeders. Therefore, to see if the admin's feeders exist in order to load them, I need /uniqObjName to check the current
                 //   user's feeders, NOT the owner's feeders. Usually, gThisOwner === gCurrentUser, but this one special case is why this url is
                 //   different
-                url: `/uniqObjName/Feeder/${gCurrentUser}/${obj.name}/${obj.model}`
+                url: `/uniqObjName/Feeder/${gCurrentUser}/${obj.model}/${obj.name}`
             }, 'urlProps');
             observable.setProperty('submitUrl', {
                 method: 'POST',
@@ -847,7 +847,7 @@ function _getWindmilTable(observable, controller) {
         observable.setProperty('feederNameM', newName, 'formProps');
         const fileExistsUrl = {
             method: 'GET',
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}`
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}`
         }
         observable.setProperty('fileExistsUrl', fileExistsUrl, 'urlProps');
     });
@@ -926,7 +926,7 @@ function getWindmilButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/Default Name/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/Default Name`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -975,7 +975,7 @@ function _getGridlabdTable(observable, controller) {
         observable.setProperty('feederNameG', newName, 'formProps');
         const fileExistsUrl = {
             method: 'GET',
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}`
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}`
         }
         observable.setProperty('fileExistsUrl', fileExistsUrl, 'urlProps');
     });
@@ -1040,7 +1040,7 @@ function getGridlabdButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/Default Name/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/Default Name`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -1088,7 +1088,7 @@ function _getCymdistTable(observable, controller) {
         observable.setProperty('feederNameC', newName, 'formProps');
         const fileExistsUrl = {
             method: 'GET',
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}`
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}`
         }
         observable.setProperty('fileExistsUrl', fileExistsUrl, 'urlProps');
     });
@@ -1152,7 +1152,7 @@ function getCymdistButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/Default Name/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/Default Name`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -1201,7 +1201,7 @@ function _getOpendssTable(observable, controller) {
         observable.setProperty('feederNameOpendss', newName, 'formProps');
         const fileExistsUrl = {
             method: 'GET',
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}`
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}`
         }
         observable.setProperty('fileExistsUrl', fileExistsUrl, 'urlProps');
     });
@@ -1265,7 +1265,7 @@ function getOpendssButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/Default Name/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/Default Name`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -1370,7 +1370,7 @@ function getAmiButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisFeederName}/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -1692,7 +1692,7 @@ function getClimateButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisFeederName}/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}`
                 },
                 pollUrl: {
                     method: 'GET',
@@ -1798,7 +1798,7 @@ function getScadaButton(controller) {
             urlProps: {
                 fileExistsUrl: {
                     method: 'GET',
-                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisFeederName}/${gThisModelName}`
+                    url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${gThisFeederName}`
                 },
                 pollUrl: {
                     method: 'GET',

omf/static/testFiles/test_accessControl.py

@@ -28,12 +28,12 @@ def client():
     # Create two test models that belong to the 'test' user
     with client as c:
         model_name = 'test_voltageDrop'
-        rv = c.get('/newModel/voltageDrop/' + model_name)
+        rv = c.post('/newModel/voltageDrop/' + model_name)
         assert rv.status_code == 302
         assert rv.headers.get("Location") == "http://localhost" + url_for('showModel', owner="test", modelName=model_name)
     with client as c:
         model_name = 'test_cvrDyn'
-        rv = c.get('/newModel/cvrDynamic/' + model_name)
+        rv = c.post('/newModel/cvrDynamic/' + model_name)
         assert rv.status_code == 302
         assert rv.headers.get("Location") == "http://localhost" + url_for('showModel', owner="test", modelName=model_name)
     # Create two new test users

omf/templates/clusterLogin.html

@@ -23,6 +23,7 @@
 		a {text-decoration:none;}
 	</style>
 	<link rel='shortcut icon' href='/static/favicon.ico'>
+	<script type='text/javascript' src='/static/omf.js'></script>
 	<script type='text/javascript'>
 		function validateEmail(email) {
 			var re = /^(([^<>()[\]\\.,;:\s@\"]+(\.[^<>()[\]\\.,;:\s@\"]+)*)|(\".+\"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
@@ -35,7 +36,7 @@
 				return
 			}
 			else if (validateEmail(email)) {
-				window.location.href = '/forgotPassword/' + email
+				post_to_url('/forgotPassword/' + email)
 			} else {
 				alert("Sorry, but that is not a valid email address.")
 			}

omf/templates/distNetViz.html

@@ -3231,7 +3231,7 @@ <h3>Color Circuit</h3>
     }
     let submitForm = false;
     await $.ajax({ // I need to check if a user's feeder still exists.
-        url: `/uniqObjName/Feeder/${owner}/${serverFeederName}/${serverModelName}`// good
+        url: `/uniqObjName/Feeder/${owner}/${serverModelName}/${serverFeederName}`// good
     }).done(function(data) {
         if (data.exists) { 
             submitForm = true;
@@ -3343,7 +3343,7 @@ <h3>Color Circuit</h3>
         submitForm = false;
         const fileName = document.getElementById(inputId).value;
         await $.ajax({ // Check if the file exists, using the user-provided fileName
-            url: `/uniqObjName/Feeder/${gThisOwner}/${fileName}/${gThisModelName}` // good
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${fileName}` // good
         }).done(function(data) {
             if (data.exists === true) {
                 modal.clearAndAddMessage(`You already have a feeder named "${fileName}". Please choose a different name.`);
@@ -3469,7 +3469,7 @@ <h3>Color Circuit</h3>
     }
     if (newName != null) {
         await $.ajax({
-            url: `/uniqObjName/Feeder/${gThisOwner}/${newName}/${gThisModelName}` // good because of course I am renaming THIS feeder file
+            url: `/uniqObjName/Feeder/${gThisOwner}/${gThisModelName}/${newName}` // good because of course I am renaming THIS feeder file
         }).done(function(data) {
             if (data.exists) {
                 modal.clearAndAddMessage(`You already have a feeder named "${newName}". Please choose a different name.`);
@@ -3506,6 +3506,7 @@ <h3>Color Circuit</h3>
         }
     }
     await $.ajax({
+        type: 'POST',
         url: `/renameFeeder/${gThisOwner}/${gThisModelName}/${oldServerName}/${newName}/${gThisFeederNum}`
     }).done(function(data) {
         if (showModal === true) {

omf/templates/distText.html

@@ -989,7 +989,7 @@ <h3>My Circuit Files</h3>
     }
     let submitForm = false;
     await $.ajax({ // I need to check if a user's file still exists.
-        url: `/uniqObjName/circuitFile/${owner}/${serverFileName}/${serverModelName}`// good
+        url: `/uniqObjName/circuitFile/${owner}/${serverModelName}/${serverFileName}`// good
     }).done(function(data) {
         if (data.exists) { 
             submitForm = true;
@@ -1076,7 +1076,7 @@ <h3>My Circuit Files</h3>
         submitForm = false;
         const fileName = document.getElementById(inputId).value;
         await $.ajax({ // Check if the file exists, using the user-provided fileName
-            url: `/uniqObjName/circuitFile/${gThisOwner}/${fileName}/${gThisModelName}` // good
+            url: `/uniqObjName/circuitFile/${gThisOwner}/${gThisModelName}/${fileName}` // good
         }).done(function(data) {
             if (data.exists === true) {
                 modal.clearAndAddMessage(`You already have a file named "${fileName}". Please choose a different name.`);

omf/templates/gridEdit.html

@@ -1238,7 +1238,7 @@
 	if (true) {
 		var modelName = "{{ modelName }}"
 		$.ajax({
-			url: "/uniqObjName/Feeder/" + "{{ owner }}" + "/" + newName + "/" + modelName
+			url: "/uniqObjName/Feeder/" + "{{ owner }}" + "/" + modelName + "/" + newName
 		}).done(function (data) {
 			if (data.exists) {
 				alert("You already have a Feeder named '" + newName + "', please choose a different name.")
@@ -1262,7 +1262,7 @@
 	if (true) {
 		var modelName = "{{ modelName }}"
 		$.ajax({
-			url: "/uniqObjName/Feeder/" + "{{ owner }}" + "/" + newName + "/" + modelName
+			url: "/uniqObjName/Feeder/" + "{{ owner }}" + "/" + modelName + "/" + newName
 		}).done(function (data) {
 			if (data.exists) {
 				alert("You already have a Feeder named '" + newName + "', please choose a different name.")
@@ -1301,7 +1301,7 @@
 function loadFeeder(fromfeederName, frommodelName, fromuser){
 	var modelName = "{{ modelName }}"
 	$.ajax({
-		url: "/uniqObjName/Feeder/" + fromuser + "/" + fromfeederName + "/" + frommodelName
+		url: "/uniqObjName/Feeder/" + fromuser + "/" + frommodelName + "/" + fromfeederName
 	}).done(function (data) {
 		if (data.exists) {
 			post_to_url("/loadFeeder/" + fromfeederName + "/" + frommodelName + "/" + "{{ modelName }}" + "/" + "{{ feederNum }}" + "/" + fromuser + "/" + "{{ owner }}")

omf/templates/transEdit.html

@@ -1228,7 +1228,7 @@
 	if (true) {
 		var modelName = '{{ modelName }}'
 		await $.ajax({
-			url: '/uniqObjName/Network/' + '{{ owner }}' + '/' + newName + '/' + modelName
+			url: '/uniqObjName/Network/' + '{{ owner }}' + '/' + modelName + '/' + newName
 		}).done(function (data) {
 			if (data.exists) {
 				alert('You already have a Network named "' + newName + '", please choose a different name.')
@@ -1351,7 +1351,7 @@
 	if (true) {
 		var modelName = "{{ modelName }}"
 		$.ajax({
-			url: "/uniqObjName/Network/" + "{{ owner }}" + "/" + newName + "/" + modelName
+			url: "/uniqObjName/Network/" + "{{ owner }}" + "/" + modelName + "/" + newName
 		}).done(function (data) {
 			if (data.exists) {
 				alert("You already have a Network named '" + newName + "', please choose a different name.")