Socket IO ACL not setup. Keypad not working. stuck in Please Wait Loading

[jimmyhchan]

Hi there.

I have manually setup an raspbian image on a raspberrypi 3 and have most of everything working with a customized version of the docker file.

Unfortunately, the virtual keypad was not working. The symptoms is the same as outlined here https://www.alarmdecoder.com/forums/viewtopic.php?f=3&t=1167&p=4267&hilit=keypad+loading#p4267

Steps to repro:

• setup the webapp
• go through the setup flow
• navigate to the keypad page
  BUG:
• Keypad only shows Please Wait Loading...
• Clicks on any button causes the log

 ERROR: default_error_handler: method_access_denied, You do not have access to method "on_keypress" (endpoint=/alarmdecoder, msg_id=None) [in /usr/local/lib/python2.7/dist-packages/socketio/virtsocket.py:51]

Root cause

I debugged a bit and found the root cause is user_id is None in the recv_connect method which calls add_acl_method:
https://github.com/nutechsoftware/alarmdecoder-webapp/blob/master/ad2web/decoder.py#L829

I could not find anything which sets the user_id for the session. Perhaps a dependency api changed.

Fix/workaround

I have a fix using user_is_authenticated(current_user) instead. Happy to create a real PR if someone can confirm this is the desired approach.

@@ -23,6 +23,7 @@ from socketioflaskdebug.debugger import SocketIODebugger
 from sqlalchemy.orm.exc import NoResultFound
 
 from flask import Blueprint, Response, request, g, current_app
+from flask_login import current_user
 import jsonpickle
 
 from OpenSSL import SSL
@@ -826,7 +827,8 @@ class DecoderNamespace(BaseNamespace, BroadcastMixin):
                     # check setup complete
                     setup_stage = Setting.get_by_name('setup_stage').value
 
-                    if (setup_stage and setup_stage != SETUP_COMPLETE) or user_id:
+                    # if (setup_stage and setup_stage != SETUP_COMPLETE) or user_id:
+                    if (setup_stage and setup_stage != SETUP_COMPLETE) or user_is_authenticated(current_user):
                         self.add_acl_method('on_keypress')
                         self.add_acl_method('on_firmwareupload')
                         self.add_acl_method('on_test')

[denhams]

Worked for me. Thanks!

[delphimon]

I did a little more digging and this is actually due to Flask-login changing the internal session variables it uses to prefix with an underscore starting with version 0.5.0: maxcountryman/flask-login@1d1a3a8. Your solution can work, the smallest possible chance to make it compatible with Flask-login 0.5.0 is to just change 'user_id' to '_user_id'.

I don't know that this is actually a better method, but it works with existing logic. Submitted PR: #97

[edrikk]

@ajschmidt8
Given that you have commit access, I wanted to flag a few PRs/changes that I've been running cleanly for a couple of years. These changes will also enable updating/correcting the requirements.txt file.
I'll using this same "approve" comment across these items.

This is both of the above changes. ie the diff above, as well as changing user_id to '_user_id' in line:
user_id = session.get('_user_id', None)

[ajschmidt8]

I will review PRs that are open. I'm not going to parse comments from issues and try to figure out what changes need to be made.