Mercurial > p > roundup > code
diff roundup/cgi/client.py @ 5879:94a7669677ae
add permissions to control user of rest and xmlrpc API interfaces.
issue2551058: Add new permissions: 'Rest Access' and 'Xmlrpc Access'
to allow per-user access control to rest and xmlrpc interfaces using
roles.
Updated all schemas to add these new perms to all authenticated roles.
Error conditions in handle_xmlrpc were not working right in manual
testing. I tried to make it a little better, but I don't actually
understand how the fault xmlrpc object is supposed to be used. So I
may have messed something up. I'll try to ping the people who wrote
the xmlrpc code to have them review.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Fri, 27 Sep 2019 23:29:59 -0400 |
| parents | 1b57d8f3eb97 |
| children | 9938c40e03bc |
line wrap: on
line diff
--- a/roundup/cgi/client.py Fri Sep 27 20:38:31 2019 -0400 +++ b/roundup/cgi/client.py Fri Sep 27 23:29:59 2019 -0400 @@ -62,6 +62,14 @@ description="User may access the web interface") security.addPermissionToRole('Admin', p) + p = security.addPermission(name="Rest Access", + description="User may access the rest interface") + security.addPermissionToRole('Admin', p) + + p = security.addPermission(name="Xmlrpc Access", + description="User may access the xmlrpc interface") + security.addPermissionToRole('Admin', p) + # doing Role stuff through the web - make sure Admin can # TODO: deprecate this and use a property-based control p = security.addPermission(name="Web Roles", @@ -497,9 +505,22 @@ self.determine_user() except LoginError as msg: output = xmlrpc_.client.dumps( - xmlrpc_.client.Fault(1, "%s:%s" % (exc_type, exc_value)), + xmlrpc_.client.Fault(401, "%s" % msg), allow_none=True) + self.setHeader("Content-Type", "text/xml") + self.setHeader("Content-Length", str(len(output))) + self.write(s2b(output)) + return + if not self.db.security.hasPermission('Xmlrpc Access', self.userid): + output = xmlrpc_.client.dumps( + xmlrpc_.client.Fault(403, "Forbidden"), + allow_none=True) + self.setHeader("Content-Type", "text/xml") + self.setHeader("Content-Length", str(len(output))) + self.write(s2b(output)) + return + self.check_anonymous_access() try: @@ -544,6 +565,11 @@ self.write(output) return + if not self.db.security.hasPermission('Rest Access', self.userid): + self.response_code = 403 + self.write(s2b('{ "error": { "status": 403, "msg": "Forbidden." } }')) + return + self.check_anonymous_access() try: