Changeset - 78c7e8efe658
Parent rev.
Child rev.
[Not reviewed]
beta
0 4 0
Marcin Kuzminski - 13 years ago 2013-04-15 01:46:32
marcin@python-works.com
new feature: API access white list definition from .ini files
4 files changed with 26 insertions and 3 deletions:
development.ini
6
production.ini
6
rhodecode/config/deployment.ini_tmpl
6
rhodecode/lib/auth.py
8
3
0 comments (0 inline, 0 general)
development.ini
➞
Show inline comments
 
@@ -102,24 +102,30 @@ git_path = git
 
## hide all refs in changelog switch this to --branches --tags
 
git_rev_filter=--all
 

			




	
	
	
		
 
## RSS feed options

			




	
	
	
		
 
rss_cut_off_limit = 256000

			




	
	
	
		
 
rss_items_per_page = 10

			




	
	
	
		
 
rss_include_diff = false

			




	
	
	
		
 

			




	
	
	
		
 
## options for showing and identifying changesets

			




	
	
	
		
 
show_sha_length = 12

			




	
	
	
		
 
show_revision_number = true

			




	
	
	
		
 

			




	
	
	
		
 
## white list of API enabled controllers. This allows to add list of

			




	
	
	
		
 
## controllers to which access will be enabled by api_key. eg: to enable

			




	
	
	
		
 
## api access to raw_files put `FilesController:raw`, to enable access to patches

			




	
	
	
		
 
## add `ChangesetController:changeset_patch`. This list should be "," separated

			




	
	
	
		
 
## Syntax is <ControllerClass>:<function>. Check debug logs for generated names

			




	
	
	
		
 
api_access_controllers_whitelist =

			




	
	
	
		
 

			




	
	
	
		
 
## alternative_gravatar_url allows you to use your own avatar server application

			




	
	
	
		
 
## the following parts of the URL will be replaced

			




	
	
	
		
 
## {email}        user email

			




	
	
	
		
 
## {md5email}     md5 hash of the user email (like at gravatar.com)

			




	
	
	
		
 
## {size}         size of the image that is expected from the server application

			




	
	
	
		
 
## {scheme}       http/https from RhodeCode server

			




	
	
	
		
 
## {netloc}       network location from RhodeCode server

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}

			




	
	
	
		
 

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    production.ini
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -102,24 +102,30 @@ git_path = git

			




	
	
	
		
 
## hide all refs in changelog switch this to --branches --tags

			




	
	
	
		
 
git_rev_filter=--all

			




	
	
	
		
 

			




	
	
	
		
 
## RSS feed options

			




	
	
	
		
 
rss_cut_off_limit = 256000

			




	
	
	
		
 
rss_items_per_page = 10

			




	
	
	
		
 
rss_include_diff = false

			




	
	
	
		
 

			




	
	
	
		
 
## options for showing and identifying changesets

			




	
	
	
		
 
show_sha_length = 12

			




	
	
	
		
 
show_revision_number = true

			




	
	
	
		
 

			




	
	
	
		
 
## white list of API enabled controllers. This allows to add list of

			




	
	
	
		
 
## controllers to which access will be enabled by api_key. eg: to enable

			




	
	
	
		
 
## api access to raw_files put `FilesController:raw`, to enable access to patches

			




	
	
	
		
 
## add `ChangesetController:changeset_patch`. This list should be "," separated

			




	
	
	
		
 
## Syntax is <ControllerClass>:<function>. Check debug logs for generated names

			




	
	
	
		
 
api_access_controllers_whitelist =

			




	
	
	
		
 

			




	
	
	
		
 
## alternative_gravatar_url allows you to use your own avatar server application

			




	
	
	
		
 
## the following parts of the URL will be replaced

			




	
	
	
		
 
## {email}        user email

			




	
	
	
		
 
## {md5email}     md5 hash of the user email (like at gravatar.com)

			




	
	
	
		
 
## {size}         size of the image that is expected from the server application

			




	
	
	
		
 
## {scheme}       http/https from RhodeCode server

			




	
	
	
		
 
## {netloc}       network location from RhodeCode server

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}

			




	
	
	
		
 

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    rhodecode/config/deployment.ini_tmpl
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -102,24 +102,30 @@ git_path = git

			




	
	
	
		
 
## hide all refs in changelog switch this to --branches --tags

			




	
	
	
		
 
git_rev_filter=--all

			




	
	
	
		
 

			




	
	
	
		
 
## RSS feed options

			




	
	
	
		
 
rss_cut_off_limit = 256000

			




	
	
	
		
 
rss_items_per_page = 10

			




	
	
	
		
 
rss_include_diff = false

			




	
	
	
		
 

			




	
	
	
		
 
## options for showing and identifying changesets

			




	
	
	
		
 
show_sha_length = 12

			




	
	
	
		
 
show_revision_number = true

			




	
	
	
		
 

			




	
	
	
		
 
## white list of API enabled controllers. This allows to add list of

			




	
	
	
		
 
## controllers to which access will be enabled by api_key. eg: to enable

			




	
	
	
		
 
## api access to raw_files put `FilesController:raw`, to enable access to patches

			




	
	
	
		
 
## add `ChangesetController:changeset_patch`. This list should be "," separated

			




	
	
	
		
 
## Syntax is <ControllerClass>:<function>. Check debug logs for generated names

			




	
	
	
		
 
api_access_controllers_whitelist =

			




	
	
	
		
 

			




	
	
	
		
 
## alternative_gravatar_url allows you to use your own avatar server application

			




	
	
	
		
 
## the following parts of the URL will be replaced

			




	
	
	
		
 
## {email}        user email

			




	
	
	
		
 
## {md5email}     md5 hash of the user email (like at gravatar.com)

			




	
	
	
		
 
## {size}         size of the image that is expected from the server application

			




	
	
	
		
 
## {scheme}       http/https from RhodeCode server

			




	
	
	
		
 
## {netloc}       network location from RhodeCode server

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbyemail/{email}/{size}

			




	
	
	
		
 
#alternative_gravatar_url = http://myavatarserver.com/getbymd5/{md5email}?s={size}

			




	
	
	
		
 

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    rhodecode/lib/auth.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -30,25 +30,25 @@ import hashlib

			




	
	
	
		
 

			




	
	
	
		
 
from tempfile import _RandomNameSequence

			




	
	
	
		
 
from decorator import decorator

			




	
	
	
		
 

			




	
	
	
		
 
from pylons import config, url, request

			




	
	
	
		
 
from pylons.controllers.util import abort, redirect

			




	
	
	
		
 
from pylons.i18n.translation import _

			




	
	
	
		
 
from sqlalchemy.orm.exc import ObjectDeletedError

			




	
	
	
		
 

			




	
	
	
		
 
from rhodecode import __platform__, is_windows, is_unix

			




	
	
	
		
 
from rhodecode.model.meta import Session

			




	
	
	
		
 

			




	
	
	
		
 
from rhodecode.lib.utils2 import str2bool, safe_unicode

			




	
	
	
		
 
from rhodecode.lib.utils2 import str2bool, safe_unicode, aslist

			




	
	
	
		
 
from rhodecode.lib.exceptions import LdapPasswordError, LdapUsernameError,\

			




	
	
	
		
 
    LdapImportError

			




	
	
	
		
 
from rhodecode.lib.utils import get_repo_slug, get_repos_group_slug,\

			




	
	
	
		
 
    get_user_group_slug

			




	
	
	
		
 
from rhodecode.lib.auth_ldap import AuthLdap

			




	
	
	
		
 

			




	
	
	
		
 
from rhodecode.model import meta

			




	
	
	
		
 
from rhodecode.model.user import UserModel

			




	
	
	
		
 
from rhodecode.model.db import Permission, RhodeCodeSetting, User, UserIpMap

			




	
	
	
		
 
from rhodecode.lib.caching_query import FromCache

			




	
	
	
		
 

			




	
	
	
		
 
log = logging.getLogger(__name__)

			




	
	
		
 
@@ -522,35 +522,40 @@ class LoginRequired(object):

			




	
	
	
		
 
    """

			




	
	
	
		
 

			




	
	
	
		
 
    def __init__(self, api_access=False):

			




	
	
	
		
 
        self.api_access = api_access

			




	
	
	
		
 

			




	
	
	
		
 
    def __call__(self, func):

			




	
	
	
		
 
        return decorator(self.__wrapper, func)

			




	
	
	
		
 

			




	
	
	
		
 
    def __wrapper(self, func, *fargs, **fkwargs):

			




	
	
	
		
 
        cls = fargs[0]

			




	
	
	
		
 
        user = cls.rhodecode_user

			




	
	
	
		
 
        loc = "%s:%s" % (cls.__class__.__name__, func.__name__)

			




	
	
	
		
 

			




	
	
	
		
 
        # defined whitelist of controllers which API access will be enabled

			




	
	
	
		
 
        whitelist = aslist(config.get('api_access_controllers_whitelist'),

			




	
	
	
		
 
                           sep=',')

			




	
	
	
		
 
        api_access_whitelist = loc in whitelist

			




	
	
	
		
 
        log.debug('loc:%s is in API whitelist:%s:%s' % (loc, whitelist,

			




	
	
	
		
 
                                                        api_access_whitelist))

			




	
	
	
		
 
        #check IP

			




	
	
	
		
 
        ip_access_ok = True

			




	
	
	
		
 
        if not user.ip_allowed:

			




	
	
	
		
 
            from rhodecode.lib import helpers as h

			




	
	
	
		
 
            h.flash(h.literal(_('IP %s not allowed' % (user.ip_addr))),

			




	
	
	
		
 
                    category='warning')

			




	
	
	
		
 
            ip_access_ok = False

			




	
	
	
		
 

			




	
	
	
		
 
        api_access_ok = False

			




	
	
	
		
 
        if self.api_access:

			




	
	
	
		
 
        if self.api_access or api_access_whitelist:

			




	
	
	
		
 
            log.debug('Checking API KEY access for %s' % cls)

			




	
	
	
		
 
            if user.api_key == request.GET.get('api_key'):

			




	
	
	
		
 
                api_access_ok = True

			




	
	
	
		
 
            else:

			




	
	
	
		
 
                log.debug("API KEY token not valid")

			




	
	
	
		
 

			




	
	
	
		
 
        log.debug('Checking if %s is authenticated @ %s' % (user.username, loc))

			




	
	
	
		
 
        if (user.is_authenticated or api_access_ok) and ip_access_ok:

			




	
	
	
		
 
            reason = 'RegularAuth' if user.is_authenticated else 'APIAuth'

			




	
	
	
		
 
            log.info('user %s is authenticated and granted access to %s '

			




	
	
	
		
 
                     'using %s' % (user.username, loc, reason)

			




	
	
	
		
 
            )

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.