Mercurial > p > roundup > code
comparison roundup/cgi/client.py @ 5696:b67636bc87d0
Add CSRF protection to rest code path. Follow same model as for
xmlrpc. The original rest code was developed before the CSRF code was
added to xmlrpc.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Sun, 07 Apr 2019 20:27:25 -0400 |
| parents | f60c44563c3a |
| children | 17e110426ad7 |
comparison
equal
deleted
inserted
replaced
| 5695:3e1b66c4e1e2 | 5696:b67636bc87d0 |
|---|---|
| 535 self.write(output) | 535 self.write(output) |
| 536 return | 536 return |
| 537 | 537 |
| 538 self.check_anonymous_access() | 538 self.check_anonymous_access() |
| 539 | 539 |
| 540 # Call rest library to handle the request | 540 try: |
| 541 handler = rest.RestfulInstance(self, self.db) | 541 # Call csrf with xmlrpc checks enabled. |
| 542 output = handler.dispatch(self.env['REQUEST_METHOD'], self.path, | 542 # It will return True if everything is ok, |
| 543 self.form) | 543 # raises exception on check failure. |
| 544 | 544 csrf_ok = self.handle_csrf(xmlrpc=True) |
| 545 except (Unauthorised, UsageError) as msg: | |
| 546 # report exception back to server | |
| 547 exc_type, exc_value, exc_tb = sys.exc_info() | |
| 548 # FIXME should return what the client requests | |
| 549 # via accept header. | |
| 550 output = s2b("%s: %s\n"%(exc_type, exc_value)) | |
| 551 self.response_code = 400 | |
| 552 self.setHeader("Content-Length", str(len(output))) | |
| 553 self.setHeader("Content-Type", "text/plain") | |
| 554 self.write(output) | |
| 555 csrf_ok = False # we had an error, failed check | |
| 556 return | |
| 557 | |
| 558 # With the return above the if will never be false, | |
| 559 # Keeping the if so we can remove return to pass | |
| 560 # output though and format output according to accept | |
| 561 # header. | |
| 562 if csrf_ok == True: | |
| 563 # Call rest library to handle the request | |
| 564 handler = rest.RestfulInstance(self, self.db) | |
| 565 output = handler.dispatch(self.env['REQUEST_METHOD'], | |
| 566 self.path, self.form) | |
| 567 | |
| 568 # type header set by rest handler | |
| 545 # self.setHeader("Content-Type", "text/xml") | 569 # self.setHeader("Content-Type", "text/xml") |
| 546 self.setHeader("Content-Length", str(len(output))) | 570 self.setHeader("Content-Length", str(len(output))) |
| 547 self.write(output) | 571 self.write(output) |
| 548 | 572 |
| 549 def add_ok_message(self, msg, escape=True): | 573 def add_ok_message(self, msg, escape=True): |