Indlela yokungenisa ukuthunyelwa kwamafomu omphakathi kunethiwekhi yangasese

Landela ukuthunyelwa okukodwa kwefomu lomphakathi kusukela kurekhodi lokwamukela kuya kumngenisi wangasese, futhi gcina ukuqinisekiswa, izifakazelo kanye nokuphathwa kokuphindwa kuhlangothi olulungile.

Ifomu lomphakathi elingakaze likhulume nenethiwekhi yangasese lisakhiqiza idatha okufanele inethiwekhi yangasese ihlulele yona. Umhubhe ushintsha kuphela ukuthi ubani oshayela ubani. Konke ngemuva kokulanda kuyisinqumo sokungenisa, futhi singesohlangothi lwangasese. Lo mhlahlandlela ulandela ukuthunyelwa okukodwa kusukela kusiphequluli kuya kurekhodi langaphakathi elibhaliwe.

Qala lapho ukuthunyelwa kwehlela khona

Isiphequluli sithumela endaweni yokugcina evamile, ebhala umugqa endaweni yokugcina yokwamukela elawulwayo futhi ingabuyiseli lutho ngaphandle kwesiqinisekiso. Leyo ndawo yokugcina iyindawo yokudlulisela, futhi kufanele kube yiyo kuphela into okungase kubhalwe kuyo isendlalelo somphakathi. Gcina idatha eluhlaza lapho ingashintshiwe, kanye nesikhathi efike ngaso kanye nesikhombi serekhodi esizinzile.

Ngemuva kwalokho isisebenzi sangasese sidonsa imigqa elindile ngomhubhe futhi sinqume ukuthi senzeni ngayinye. Sisebenza ngaphansi kobunikazi baso, futhi lokho kuyisihloko sesigaba esilandelayo.

curl --silent --fail \
  --cert /etc/importer/client.crt --key /etc/importer/client.key \
  "https://intake.corp.internal/api/pending?limit=20" \
  -o /var/lib/importer/pending.json

Nika umngenisi igunya alidingayo kuphela

Inqubo yewebhu yomphakathi kanye nobunikazi obubhala kuhlelo langaphakathi kufanele kube izinhloko ezimbili ezihlukene. Iseva yomphakathi ayidingi ukuphathwa kwangaphakathi ngenxa kuphela yokuthi kufanele ilethe idatha yefomu, futhi i-akhawunti eyodwa eyabiwe yazo zombili izinhlangothi yenza noma yiliphi iphutha lewebhu libe ukubhala kwangaphakathi. Khipha isisebenzi izifakazelo zaso, unqamule kumsebenzi owodwa wokungenisa, futhi rekhoda ukuthi iyiphi inhloko eyenza ukungenisa ngakunye. Lokho kwehlukanisa kuyikho okwenza umngcele womhubhe ube nencazelo esikhundleni sokuba umhlobiso.

Nqamula futhi ukuthi isisebenzi singafunda kuwuphi umthombo. Uma ukuqaliswa kusebenzisa umugqa noma insizakalo yokudlulisa, leyo nsizakalo igcina ukuqinisekisa kwayo kanye nenqubomgomo yokufinyelela, ngoba i-VPN ayiqinisekisi lutho ngaphakathi komthwalo.

Umsebenzi wesikhathi esifushane awuxolelwe ekubuyekezweni okufanayo. Ngenkathi usebenza, indawo yawo yenethiwekhi kanye nezifakazelo zaso kusanikeza igunya, futhi impilo emfushane inciphisa iwindi kuphela. Impilo ayisiyo indawo yesinqumo sokuthi ubuphi ubunikazi obungase benze imisebenzi.

Qinisekisa ngaphambi kokuthi kushintshe noma yini yangaphakathi

Izinkambu zefomu lomphakathi ziwumbhalo olawulwa umhlaseli kuze kufakazelwe okuphambene, futhi isiqondiso se-OWASP sokuqinisekisa okokufaka sibalisa imifudlana yangemuva phakathi kwemithombo engathenjwa ngenxa yaleso sizathu. Ukudluliswa okubethelwe kusho ukuthi amabhayithi afike ephelele, hhayi ukuthi achaza isicelo esivunyelwe. Hlaziya futhi uqinisekise ngaphambi kwanoma yisiphi isinyathelo segunya, ukuze umugqa omubi ungafiki endleleni yekhodi engase yenze okuthile.

Chaza izinkambu ezivunyelwe, izimo zazo, ubukhulu bazo kanye nemithetho yebhizinisi okufanele igcinwe. Usuku lungase lube sesimweni esifanele futhi lusibe luhlanya kumsebenzi oceliwe, futhi umthwalo oqamba i-akhawunti yangaphakathi noma isimo sokuvunywa akumele ukwazi ukuzinika kokubili.

Thumela imigqa enqatshiwe kumphumela wokubuyekeza esikhundleni sokuqagela isilungiso noma ukuyidlulisela ku-shell noma kubukhoma bedatha eluhlaza. Rekhoda isikhombi serekhodi kanye nomthetho ohlulekile, hhayi yonke inkambu eyashicilelwa umfakisi.

Yenza indawo yokuphinda kumsebenzi owodwa

Uma irekhodi submission-1042 lidonswa kabili ngoba isiqinisekiso sokuqala silahlekile, isisebenzi sidinga indlela ehlala njalo yokubona irekhodi lomthombo kanye nomphumela walo obhaliwe. Isimiso sesikhathi esisebenza umsebenzi kanye asifakazeli ukuthi umugqa ngamunye wasetshenziswa kanye. Ukulethwa okuphindwe kabili kuyinto evamile, ngakho umklamo kufanele ukumunce.

Sebenzisa ukuthengiselana kanye nendlela yokuphatha izimpinda yohlelo langaphakathi uqobo, futhi gcina isikhombi somthombo, umphumela kanye nesiqinisekiso ngokulandelana okuhambisanayo. Qinisekisa kuphela ngemuva kokuthi umsebenzi obekuhloswe wona ubhaliwe noma wabelwe ngokuhlala njalo, futhi ungalokothi ususe umugqa wokwamukela ngenxa kuphela yokuthi amabhayithi alandiwe.

Ngemuva kwalokho kufakazele ngezinto ezintathu eziqinile: umugqa ovumelekile, umugqa ongesimweni esingalungile, kanye nesikhombi somthombo esilawulwayo esifanayo esilethwe kabili. Ngakunye kwazo kudlula endaweni yokugcina efanayo esetshenziswa isisebenzi.

for f in fixtures/valid-submission.json fixtures/bad-date.json; do
  curl --silent --fail --cert /etc/importer/client.crt \
    -X POST --data @"$f" https://intake.corp.internal/api/records
done
curl --silent --fail --cert /etc/importer/client.crt \
  -X POST --data @fixtures/valid-submission.json https://intake.corp.internal/api/records

Imigqa emibili yokuqala kufanele iphelele ezimweni zangaphakathi ezihlukene, futhi owesithathu kufanele ubuyisele isikhombi esivele sibhaliwe salelo rekhodi lomthombo esikhundleni sokwakha owesibili. Noma yini enye isho ukuthi ukungenisa akukakwazi ukuphindwa.

Izihloko ezihlobene