admin
2633dc1654
gates / gates (push) Successful in 26s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
52 lines
3.9 KiB
Python
52 lines
3.9 KiB
Python
#!/usr/bin/env python3
|
|
"""fg_b4_member.py — B4 part 2: a family member signs in through the REAL internet (Cloudflare → demo-hp's tunnel) with a
|
|
browser's user agent. Attempt 2 of fg_b4.py used Python's urllib, whose user agent Cloudflare refuses at its edge (403,
|
|
"error code 1010") before the box — measured. MeTube is installed through the product, a test member is added on the
|
|
Család card, the member signs in with curl (cookie jar, browser UA) on the box's own page, reaches MeTube, then logs out
|
|
(and is refused after); a stranger's cookie-less request is refused through the same path. Then MeTube is removed with
|
|
its data and the member removed. Secrets never printed. Evidence: $EV/B4/member-internet.txt."""
|
|
import html, json, os, re, secrets, subprocess, sys, tempfile, time
|
|
os.environ.setdefault("GUEST", "9201"); os.environ.setdefault("BASE", "https://192.168.0.155")
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|
import fg_b4_lib as L
|
|
w = L.w
|
|
log = open(f"{w.EV}/B4/member-internet.txt", "a", buffering=1)
|
|
def say(*a):
|
|
w.say(*a); log.write(" ".join(map(str, a)) + "\n")
|
|
UA = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36"
|
|
jar = tempfile.mktemp(prefix="b4jar-")
|
|
def c(url, *a, data=None):
|
|
args = ["curl", "-s", "-L", "--max-time", "30", "-A", UA, "-b", jar, "-c", jar, "-H", "Accept: text/html", "-o", "/tmp/b4body",
|
|
"-w", "%{http_code} %{url_effective}"]
|
|
if data is not None: args += ["--data", data]
|
|
r = subprocess.run(args + list(a) + [url], capture_output=True, text=True)
|
|
code, _, eff = r.stdout.strip().partition(" ")
|
|
body = open("/tmp/b4body", encoding="utf-8", errors="replace").read() if os.path.exists("/tmp/b4body") else ""
|
|
return code, eff.split("?")[0], body
|
|
|
|
w.login()
|
|
say(f"##### B4 member through the real internet — {time.strftime('%FT%TZ', time.gmtime())}")
|
|
say("control: Python's user agent at the edge ->", subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "-A", "Python-urllib/3.13", "https://video.enkisfelhom.hu/"], capture_output=True, text=True).stdout,
|
|
"| a browser's ->", subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "-A", UA, "https://video.enkisfelhom.hu/"], capture_output=True, text=True).stdout, "(MeTube not installed yet: 404 from the box)")
|
|
L.deploy("metube", "video", say)
|
|
fpw = L.add_member("b4teszt", say)
|
|
code, url, body = c("https://video.enkisfelhom.hu/")
|
|
say(f"a member's browser opens video.enkisfelhom.hu (no cookie) -> {code} at {url} (the family sign-in page: {'name=\"_ft\"' in body})")
|
|
ft = re.search(r'name="_ft" value="([^"]+)"', body); rd = re.search(r'name="rd" value="([^"]*)"', body)
|
|
form = "&".join(f"{k}={__import__('urllib.parse').parse.quote(v)}" for k, v in
|
|
(("_ft", ft.group(1) if ft else ""), ("rd", html.unescape(rd.group(1)) if rd else ""), ("name", "b4teszt"), ("password", fpw)))
|
|
code, url, body = c("https://felhom.enkisfelhom.hu/__family/login", data=form)
|
|
say(f"the member signs in on the box's own page -> {code} at {url} (MeTube's own page: {'MeTube' in body and 'name=\"_ft\"' not in body})")
|
|
code, url, body = c("https://video.enkisfelhom.hu/history")
|
|
say(f"the member reads /history -> {code} ({'done' in body})")
|
|
code, url, body = c("https://felhom.enkisfelhom.hu/launcher")
|
|
say(f"the same browser at the DASHBOARD (/launcher) -> {code} at {url} (sent to the dashboard login: {'/login' in url})")
|
|
code, url, body = c("https://felhom.enkisfelhom.hu/__family/logout", data="")
|
|
code2, url2, _ = c("https://video.enkisfelhom.hu/history")
|
|
say(f"logout -> {code}; then /history -> {code2} at {url2} (refused: {'video.' not in url2 or code2 != '200'})")
|
|
say("a STRANGER (no cookie, browser UA) at video.enkisfelhom.hu/history ->",
|
|
subprocess.run(["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "-A", UA, "https://video.enkisfelhom.hu/history"], capture_output=True, text=True).stdout)
|
|
L.remove("metube", say)
|
|
L.remove_member("b4teszt", say)
|
|
os.unlink(jar)
|