kallithea Files · init.d/kallithea-daemon-arch

Files @ 8b47181750a8

Branch filter:

Location: kallithea/init.d/kallithea-daemon-arch

8b47181750a8 1.3 KiB text/plain Show Annotation Show as Raw Download as Raw

Mads Kiilerich

login: fix incorrect CSRF rejection of "Reset Your Password" form (Issue #350)

htmlfill would remove the CSRF token from the form when substituting the query
parameters, causing password reset to break.

By default, htmlfill will clear all input fields that doesn't have a new
"default" value provided. It could be fixed by setting force_defaults to False
- see http://www.formencode.org/en/1.2-branch/modules/htmlfill.html . It could
also be fixed by providing the CSRF token in the defaults to be substituted in
the form.

Instead, refactor password_reset_confirmation to have more explicitly safe
handling of query parameters. Replace htmlfill with the usual template
variables.

The URLs are generated in kallithea/model/user.py send_reset_password_email()
and should only contain email, timestamp (integer as digit string) and a hex
token from get_reset_password_token() .

#!/bin/bash
###########################################
#### THIS IS AN ARCH LINUX RC.D SCRIPT ####
###########################################

. /etc/rc.conf
. /etc/rc.d/functions

DAEMON=kallithea
APP_HOMEDIR="/srv"
APP_PATH="$APP_HOMEDIR/$DAEMON"
CONF_NAME="production.ini"
LOG_FILE="/var/log/$DAEMON.log"
PID_FILE="/run/daemons/$DAEMON"
APPL=/usr/bin/gearbox
RUN_AS="*****"

ARGS="serve --daemon \
--user=$RUN_AS \
--group=$RUN_AS \
--pid-file=$PID_FILE \
--log-file=$LOG_FILE \
-c $APP_PATH/$CONF_NAME"

[ -r /etc/conf.d/$DAEMON ] && . /etc/conf.d/$DAEMON

if [[ -r $PID_FILE ]]; then
    read -r PID < "$PID_FILE"
    if [[ $PID && ! -d /proc/$PID ]]; then
        unset PID
        rm_daemon $DAEMON
    fi
fi

case "$1" in
start)
    stat_busy "Starting $DAEMON"
    export HOME=$APP_PATH
    [ -z "$PID" ] && $APPL $ARGS &>/dev/null
    if [ $? = 0 ]; then
        add_daemon $DAEMON
        stat_done
    else
        stat_fail
        exit 1
    fi
    ;;
stop)
    stat_busy "Stopping $DAEMON"
    [ -n "$PID" ] && kill $PID &>/dev/null
    if [ $? = 0 ]; then
        rm_daemon $DAEMON
        stat_done
    else
        stat_fail
        exit 1
    fi
    ;;
restart)
    $0 stop
    sleep 1
    $0 start
    ;;
status)
    stat_busy "Checking $name status";
    ck_status $name
    ;;
*)
    echo "usage: $0 {start|stop|restart|status}"
esac