Accept query/form/JSON params for API POSTs; panel sends form-encoded (HF gateway strips JSON quotes)

control.py

@@ -13,7 +13,7 @@ from collections import deque
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlparse
 
-BUILD = "diag-1"
+BUILD = "v3"
 
 DATA_DIR = os.environ.get("MC_DATA", "/data")
 JAR = os.environ.get("MC_JAR", "/server/minecraft_server.26.3.jar")
@@ -367,10 +367,10 @@ class Handler(BaseHTTPRequestHandler):
 
     def do_POST(self):
         u = urlparse(self.path)
-        body, raw = self._read_post()
-        body = body or {}
+        raw = self._read_body() or b""
+        params = self._params(u, raw)
         if u.path == "/api/login":
-            if CONTROL_PASSWORD and body.get("password") == CONTROL_PASSWORD:
+            if CONTROL_PASSWORD and params.get("password") == CONTROL_PASSWORD:
                 self._json(200, {"ok": True, "token": token_for(CONTROL_PASSWORD)})
             elif CONTROL_PASSWORD:
                 self._json(401, {"ok": False, "error": "wrong password"})
@@ -382,26 +382,13 @@ class Handler(BaseHTTPRequestHandler):
             if not auth_ok(self.headers.get("X-Token", "")):
                 self._json(401, {"ok": False, "error": "auth required"})
                 return
-            ok, msg = controller.send_command(body.get("cmd", ""))
-            if not ok and not body:
-                self._json(400, {
-                    "ok": False,
-                    "error": msg,
-                    "diag": {
-                        "cl": self.headers.get("Content-Length"),
-                        "te": self.headers.get("Transfer-Encoding"),
-                        "ct": self.headers.get("Content-Type"),
-                        "proto": self.request_version,
-                        "raw": raw[:64].decode("utf-8", "replace"),
-                    },
-                })
-            else:
-                self._json(200 if ok else 400, {"ok": ok, "error": msg})
+            ok, msg = controller.send_command(params.get("cmd", ""))
+            self._json(200 if ok else 400, {"ok": ok, "error": msg})
         elif u.path == "/api/action":
             if not auth_ok(self.headers.get("X-Token", "")):
                 self._json(401, {"ok": False, "error": "auth required"})
                 return
-            action = body.get("action")
+            action = params.get("action")
             if action == "restart":
                 self._json(200, {"ok": True, "error": controller.restart()})
             elif action == "stop":
@@ -411,6 +398,24 @@ class Handler(BaseHTTPRequestHandler):
         else:
             self._json(404, {"ok": False, "error": "not found"})
 
+    def _params(self, u, raw):
+        params = {}
+        for key, vals in parse_qs(u.query).items():
+            params[key] = vals[-1]
+        ctype = (self.headers.get("Content-Type") or "").split(";")[0].strip().lower()
+        if ctype == "application/x-www-form-urlencoded" and raw:
+            for key, vals in parse_qs(raw.decode("utf-8", "replace")).items():
+                params[key] = vals[-1]
+        if raw:
+            try:
+                obj = json.loads(raw.decode("utf-8"))
+                if isinstance(obj, dict):
+                    for key, val in obj.items():
+                        params[str(key)] = val
+            except (ValueError, json.JSONDecodeError):
+                pass
+        return params
+
 
 PAGE = r"""<!DOCTYPE html>
 <html lang="en">
@@ -509,8 +514,8 @@ $('logbox').addEventListener('scroll', () => {
 function doLogin() {
   fetch('/api/login', {
     method: 'POST',
-    headers: {'Content-Type': 'application/json'},
-    body: JSON.stringify({password: $('pw').value})
+    headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+    body: 'password=' + encodeURIComponent($('pw').value)
   }).then(r => {
     if (r.status === 401) { $('pw_err').textContent = 'wrong password'; throw 0; }
     return r.json();
@@ -563,11 +568,12 @@ function renderLine(txt) {
   return div;
 }
 
-function api(url, body) {
+function api(url, data) {
+  const body = Object.keys(data || {}).map(k => encodeURIComponent(k) + '=' + encodeURIComponent(data[k])).join('&');
   return fetch(url, {
     method: 'POST',
-    headers: {'Content-Type': 'application/json', 'X-Token': token},
-    body: JSON.stringify(body || {})
+    headers: {'Content-Type': 'application/x-www-form-urlencoded', 'X-Token': token},
+    body: body
   }).then(r => r.json().then(d => ({status: r.status, d})));
 }