Changeset - b537babcf966
Parent rev.
Child rev.
[Not reviewed]
stable
0 6 0
Søren Løvborg - 10 years ago 2015-09-18 13:57:49
sorenl@unity3d.com
login: include query parameters in came_from

The login controller uses the came_from query argument to determine
the page to continue to after login.

Previously, came_from specified only the URL path (obtained using
h.url.current), and any URL query parameters were passed along as
separate (additional) URL query parameters; to obtain the final redirect
target, h.url was used to combine came_from with the request.GET.

As of this changeset, came_from specifies both the URL path and query
string (obtained using request.path_qs), which means that came_from can
be used directly as the redirect target (as always, WebOb handles the
task of expanding the server relative path to a fully qualified URL).
The mangling of request.GET can also be removed.

The login code appended arbitrary, user-supplied query parameters to
URLs by calling the Routes URLGenerator (h.url) with user-supplied
keyword arguments. This construct is unfortunate, since url only
appends _unknown_ keyword arguments as query parameters, and the
parameter names could overlap with known keyword arguments, possibly
affecting the generated URL in various ways. This changeset removes
this usage from the login code, but other instances remain.

(In practice, the damage is apparently limited to causing an Internal
Server Error when going to e.g. "/_admin/login?host=foo", since WebOb
returns Unicode strings and URLGenerator only allows byte strings for
these keyword arguments.)
6 files changed with 24 insertions and 21 deletions:
kallithea/controllers/login.py
2
2
kallithea/lib/auth.py
3
2
kallithea/templates/base/base.html
1
1
kallithea/templates/changeset/changeset_file_comment.html
1
1
kallithea/templates/login.html
1
1
kallithea/tests/functional/test_login.py
16
14
0 comments (0 inline, 0 general)
kallithea/controllers/login.py
➞
Show inline comments
 
@@ -59,18 +59,18 @@ class LoginController(BaseController):
 
    def _validate_came_from(self, came_from):
 
        """Return True if came_from is valid and can and should be used"""
 
        url = urlparse.urlsplit(came_from)
 
        return not url.scheme and not url.netloc
 

			




	
	
	
		
 
    def index(self):

			




	
	
	
		
 
        c.came_from = safe_str(request.GET.pop('came_from', ''))

			




	
	
	
		
 
        c.came_from = safe_str(request.GET.get('came_from', ''))

			




	
	
	
		
 
        if c.came_from:

			




	
	
	
		
 
            if not self._validate_came_from(c.came_from):

			




	
	
	
		
 
                log.error('Invalid came_from (not server-relative): %r', c.came_from)

			




	
	
	
		
 
                raise HTTPBadRequest()

			




	
	
	
		
 
            came_from = url(c.came_from, **request.GET)

			




	
	
	
		
 
            came_from = url(c.came_from)

			




	
	
	
		
 
        else:

			




	
	
	
		
 
            c.came_from = came_from = url('home')

			




	
	
	
		
 

			




	
	
	
		
 
        not_default = self.authuser.username != User.DEFAULT_USER

			




	
	
	
		
 
        ip_allowed = AuthUser.check_ip_allowed(self.authuser, self.ip_addr)

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    kallithea/lib/auth.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -709,17 +709,18 @@ def set_available_permissions(config):

			




	
	
	
		
 
#==============================================================================

			




	
	
	
		
 
# CHECK DECORATORS

			




	
	
	
		
 
#==============================================================================

			




	
	
	
		
 

			




	
	
	
		
 
def redirect_to_login(message=None):

			




	
	
	
		
 
    from kallithea.lib import helpers as h

			




	
	
	
		
 
    p = url.current()

			




	
	
	
		
 
    p = request.path_qs

			




	
	
	
		
 
    if message:

			




	
	
	
		
 
        h.flash(h.literal(message), category='warning')

			




	
	
	
		
 
    log.debug('Redirecting to login page, origin: %s', p)

			




	
	
	
		
 
    return redirect(url('login_home', came_from=p, **request.GET))

			




	
	
	
		
 
    return redirect(url('login_home', came_from=p))

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class LoginRequired(object):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Must be logged in to execute this function else

			




	
	
	
		
 
    redirect to login page

			




	
	
	
		
 

			




        

    


    
    

    

        

                

                    kallithea/templates/base/base.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -291,13 +291,13 @@

			




	
	
	
		
 
      </a>

			




	
	
	
		
 

			




	
	
	
		
 
      <div class="user-menu">

			




	
	
	
		
 
        <div id="quick_login">

			




	
	
	
		
 
          %if c.authuser.username == 'default' or c.authuser.user_id is None:

			




	
	
	
		
 
            <h4>${_('Login to Your Account')}</h4>

			




	
	
	
		
 
            ${h.form(h.url('login_home',came_from=h.url.current()))}

			




	
	
	
		
 
            ${h.form(h.url('login_home', came_from=request.path_qs))}

			




	
	
	
		
 
            <div class="form">

			




	
	
	
		
 
                <div class="fields">

			




	
	
	
		
 
                    <div class="field">

			




	
	
	
		
 
                        <div class="label">

			




	
	
	
		
 
                            <label for="username">${_('Username')}:</label>

			




	
	
	
		
 
                        </div>

			




        

    


    
    

    

        

                

                    kallithea/templates/changeset/changeset_file_comment.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -84,13 +84,13 @@

			




	
	
	
		
 
      </div>

			




	
	
	
		
 
    ${h.end_form()}

			




	
	
	
		
 
  %else:

			




	
	
	
		
 
      ${h.form('')}

			




	
	
	
		
 
      <div class="clearfix">

			




	
	
	
		
 
          <div class="comment-help">

			




	
	
	
		
 
            ${_('You need to be logged in to comment.')} <a href="${h.url('login_home',came_from=h.url.current())}">${_('Login now')}</a>

			




	
	
	
		
 
            ${_('You need to be logged in to comment.')} <a href="${h.url('login_home', came_from=request.path_qs)}">${_('Login now')}</a>

			




	
	
	
		
 
          </div>

			




	
	
	
		
 
      </div>

			




	
	
	
		
 
      <div class="comment-button">

			




	
	
	
		
 
      ${h.reset('hide-inline-form', _('Hide'), class_='btn btn-small hide-inline-form')}

			




	
	
	
		
 
      </div>

			




	
	
	
		
 
      ${h.end_form()}

			




        

    


    
    

    

        

                

                    kallithea/templates/login.html
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -13,13 +13,13 @@

			




	
	
	
		
 
            <h5>${_('Log In to %s') % c.site_name}</h5>

			




	
	
	
		
 
        %else:

			




	
	
	
		
 
            <h5>${_('Log In')}</h5>

			




	
	
	
		
 
        %endif

			




	
	
	
		
 
    </div>

			




	
	
	
		
 
    <div class="panel-body inner">

			




	
	
	
		
 
        ${h.form(h.url.current(came_from=c.came_from, **request.GET))}

			




	
	
	
		
 
        ${h.form(url('login_home', came_from=c.came_from))}

			




	
	
	
		
 
        <div class="form">

			




	
	
	
		
 
            <i class="icon-lock"></i>

			




	
	
	
		
 
            <!-- fields -->

			




	
	
	
		
 

			




	
	
	
		
 
            <div class="form-horizontal">

			




	
	
	
		
 
                <div class="form-group">

			




        

    


    
    

    

        

                

                    kallithea/tests/functional/test_login.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
	
		
 
# -*- coding: utf-8 -*-

			




	
	
	
		
 
import re

			




	
	
	
		
 
import time

			




	
	
	
		
 
import urlparse

			




	
	
	
		
 

			




	
	
	
		
 
import mock

			




	
	
	
		
 

			




	
	
	
		
 
from kallithea.tests import *

			




	
	
	
		
 
from kallithea.tests.fixture import Fixture

			




	
	
	
		
 
from kallithea.lib.utils2 import generate_api_key

			




	
	
		
 
@@ -129,67 +130,68 @@ class TestLoginController(TestController

			




	
	
	
		
 

			




	
	
	
		
 
        response.mustcontain('Invalid username or password')

			




	
	
	
		
 

			




	
	
	
		
 
    # verify that get arguments are correctly passed along login redirection

			




	
	
	
		
 

			




	
	
	
		
 
    @parameterized.expand([

			




	
	
	
		
 
        ({'foo':'one', 'bar':'two'}, ('foo=one', 'bar=two')),

			




	
	
	
		
 
        ({'foo':'one', 'bar':'two'}, (('foo', 'one'), ('bar', 'two'))),

			




	
	
	
		
 
        ({'blue': u'blå'.encode('utf-8'), 'green':u'grøn'},

			




	
	
	
		
 
             ('blue=bl%C3%A5', 'green=gr%C3%B8n')),

			




	
	
	
		
 
             (('blue', u'blå'.encode('utf-8')), ('green', u'grøn'.encode('utf-8')))),

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_redirection_to_login_form_preserves_get_args(self, args, args_encoded):

			




	
	
	
		
 
        with fixture.anon_access(False):

			




	
	
	
		
 
            response = self.app.get(url(controller='summary', action='index',

			




	
	
	
		
 
                                        repo_name=HG_REPO,

			




	
	
	
		
 
                                        **args))

			




	
	
	
		
 
            self.assertEqual(response.status, '302 Found')

			




	
	
	
		
 
            came_from = urlparse.parse_qs(urlparse.urlparse(response.location).query)['came_from'][0]

			




	
	
	
		
 
            came_from_qs = urlparse.parse_qsl(urlparse.urlparse(came_from).query)

			




	
	
	
		
 
            for encoded in args_encoded:

			




	
	
	
		
 
                self.assertIn(encoded, response.location)

			




	
	
	
		
 
                self.assertIn(encoded, came_from_qs)

			




	
	
	
		
 

			




	
	
	
		
 
    @parameterized.expand([

			




	
	
	
		
 
        ({'foo':'one', 'bar':'two'}, ('foo=one', 'bar=two')),

			




	
	
	
		
 
        ({'blue': u'blå'.encode('utf-8'), 'green':u'grøn'},

			




	
	
	
		
 
        ({'blue': u'blå', 'green':u'grøn'},

			




	
	
	
		
 
             ('blue=bl%C3%A5', 'green=gr%C3%B8n')),

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_login_form_preserves_get_args(self, args, args_encoded):

			




	
	
	
		
 
        response = self.app.get(url(controller='login', action='index',

			




	
	
	
		
 
                                    came_from = '/_admin/users',

			




	
	
	
		
 
                                    **args))

			




	
	
	
		
 
                                    came_from=url('/_admin/users', **args)))

			




	
	
	
		
 
        came_from = urlparse.parse_qs(urlparse.urlparse(response.form.action).query)['came_from'][0]

			




	
	
	
		
 
        for encoded in args_encoded:

			




	
	
	
		
 
            self.assertIn(encoded, response.form.action)

			




	
	
	
		
 
            self.assertIn(encoded, came_from)

			




	
	
	
		
 

			




	
	
	
		
 
    @parameterized.expand([

			




	
	
	
		
 
        ({'foo':'one', 'bar':'two'}, ('foo=one', 'bar=two')),

			




	
	
	
		
 
        ({'blue': u'blå'.encode('utf-8'), 'green':u'grøn'},

			




	
	
	
		
 
        ({'blue': u'blå', 'green':u'grøn'},

			




	
	
	
		
 
             ('blue=bl%C3%A5', 'green=gr%C3%B8n')),

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_redirection_after_successful_login_preserves_get_args(self, args, args_encoded):

			




	
	
	
		
 
        response = self.app.post(url(controller='login', action='index',

			




	
	
	
		
 
                                     came_from = '/_admin/users',

			




	
	
	
		
 
                                     **args),

			




	
	
	
		
 
                                     came_from = url('/_admin/users', **args)),

			




	
	
	
		
 
                                 {'username': TEST_USER_ADMIN_LOGIN,

			




	
	
	
		
 
                                  'password': TEST_USER_ADMIN_PASS})

			




	
	
	
		
 
        self.assertEqual(response.status, '302 Found')

			




	
	
	
		
 
        for encoded in args_encoded:

			




	
	
	
		
 
            self.assertIn(encoded, response.location)

			




	
	
	
		
 

			




	
	
	
		
 
    @parameterized.expand([

			




	
	
	
		
 
        ({'foo':'one', 'bar':'two'}, ('foo=one', 'bar=two')),

			




	
	
	
		
 
        ({'blue': u'blå'.encode('utf-8'), 'green':u'grøn'},

			




	
	
	
		
 
        ({'blue': u'blå', 'green':u'grøn'},

			




	
	
	
		
 
             ('blue=bl%C3%A5', 'green=gr%C3%B8n')),

			




	
	
	
		
 
    ])

			




	
	
	
		
 
    def test_login_form_after_incorrect_login_preserves_get_args(self, args, args_encoded):

			




	
	
	
		
 
        response = self.app.post(url(controller='login', action='index',

			




	
	
	
		
 
                                     came_from = '/_admin/users',

			




	
	
	
		
 
                                     **args),

			




	
	
	
		
 
                                     came_from=url('/_admin/users', **args)),

			




	
	
	
		
 
                                 {'username': 'error',

			




	
	
	
		
 
                                  'password': 'test12'})

			




	
	
	
		
 

			




	
	
	
		
 
        response.mustcontain('Invalid username or password')

			




	
	
	
		
 
        came_from = urlparse.parse_qs(urlparse.urlparse(response.form.action).query)['came_from'][0]

			




	
	
	
		
 
        for encoded in args_encoded:

			




	
	
	
		
 
            self.assertIn(encoded, response.form.action)

			




	
	
	
		
 
            self.assertIn(encoded, came_from)

			




	
	
	
		
 

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 
    # REGISTRATIONS

			




	
	
	
		
 
    #==========================================================================

			




	
	
	
		
 
    def test_register(self):

			




	
	
	
		
 
        response = self.app.get(url(controller='login', action='register'))

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.