Attack Surface Lab

var api = "/api/moderation/";

function remove(params) {
  if (prompt("Enter 'yes' to remove") !== "yes")
    return;
  $.post(api + "remove", params);
}

function removeByID(id) {
  remove({ ident: id });
}

// Neither function is ever called — dead code.

const adminApiBase = '/api/admin/users/';

const suspendUser = (userId, reason) => {
  const user = window.currentUser;
  if (!user || user.role !== 'admin') return;

  $.post(adminApiBase + 'suspend', {
    userId: userId,
    reason: reason
  });
};

const resetUserPassword = (userId) => {
  const user = window.currentUser;
  if (!user || user.role !== 'admin') return;

  $.post(adminApiBase + 'reset-password', {
    userId: userId
  });
};

function AnalyticsClient() {}

AnalyticsClient.prototype.init = function () {
  this.baseURL = '/api/analytics/';
};

AnalyticsClient.prototype.track = function (event, data) {
  fetch(this.baseURL + 'track', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ event: event, data: data })
  });
};

// Class defined but NEVER instantiated.
// No `new AnalyticsClient()` anywhere on the page.

var archivePath = '';

function getStorageRoot() {
  return '/api/storage';
}

function buildBucketPath(callback) {
  var bucketPath = getStorageRoot() + '/buckets';
  callback(bucketPath);
}

function setArchivePath(base) {
  archivePath = base + '/archive';
}

function getPurgeUrl() {
  buildBucketPath(function(bp) {
    setArchivePath(bp);
  });
  return archivePath + '/purge';
}

function purgeArchive(bucketId) {
  fetch(getPurgeUrl(), {
    method: 'DELETE',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ bucketId })
  });
}