Mercurial > p > roundup > code
comparison roundup/cgi/client.py @ 4781:6e9b9743de89
Implementation for:
http://issues.roundup-tracker.org/issue2550731
Add mechanism for the detectors to be able to tell the source of the
data changes.
Support for tx_Source property on database handle. Can be
used by detectors to find out the source of a change in an auditor to
block changes arriving by unauthenticated mechanisms (e.g. plain email
where headers can be faked). The property db.tx_Source has the
following values:
* None - Default value set to None. May be valid if it's a script
that is created by the user. Otherwise it's an error and indicates
that some code path is not properly setting the tx_Source property.
* "cli" - this string value is set when using roundup-admin and
supplied scripts.
* "web" - this string value is set when using any web based
technique: html interface, xmlrpc ....
* "email" - this string value is set when using an unauthenticated
email based technique.
* "email-sig-openpgp" - this string value is set when email with a
valid pgp signature is used. (*NOTE* the testing for this mode
is incomplete. If you have a pgp infrastructure you should test
and verify that this is properly set.)
This also includes some (possibly incomplete) tests cases for the
modes above and an example of using ts_Source in the customization.txt
document.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Tue, 23 Apr 2013 23:06:09 -0400 |
| parents | fe9568a6cbd6 |
| children | b474adb17fda |
comparison
equal
deleted
inserted
replaced
| 4774:3adff0fb0207 | 4781:6e9b9743de89 |
|---|---|
| 790 return | 790 return |
| 791 | 791 |
| 792 # open the database or only set the user | 792 # open the database or only set the user |
| 793 if not hasattr(self, 'db'): | 793 if not hasattr(self, 'db'): |
| 794 self.db = self.instance.open(username) | 794 self.db = self.instance.open(username) |
| 795 self.db.tx_Source = "web" | |
| 795 else: | 796 else: |
| 796 if self.instance.optimize: | 797 if self.instance.optimize: |
| 797 self.db.setCurrentUser(username) | 798 self.db.setCurrentUser(username) |
| 799 self.db.tx_Source = "web" | |
| 798 else: | 800 else: |
| 799 self.db.close() | 801 self.db.close() |
| 800 self.db = self.instance.open(username) | 802 self.db = self.instance.open(username) |
| 803 self.db.tx_Source = "web" | |
| 801 # The old session API refers to the closed database; | 804 # The old session API refers to the closed database; |
| 802 # we can no longer use it. | 805 # we can no longer use it. |
| 803 self.session_api = Session(self) | 806 self.session_api = Session(self) |
| 804 | 807 |
| 805 | 808 |