Mercurial > p > roundup > code
view roundup/cgi/PageTemplates/PathIterator.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | 99667a0cbd2d |
| children |
line wrap: on
line source
############################################################################## # # Copyright (c) 2001 Zope Corporation and Contributors. All Rights Reserved. # # This software is subject to the provisions of the Zope Public License, # Version 2.0 (ZPL). A copy of the ZPL should accompany this distribution. # THIS SOFTWARE IS PROVIDED "AS IS" AND ANY AND ALL EXPRESS OR IMPLIED # WARRANTIES ARE DISCLAIMED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED # WARRANTIES OF TITLE, MERCHANTABILITY, AGAINST INFRINGEMENT, AND FITNESS # FOR A PARTICULAR PURPOSE # ############################################################################## """Path Iterator A TALES Iterator with the ability to use first() and last() on subpaths of elements. """ from . import TALES from .Expressions import restrictedTraverse, Undefs, getSecurityManager class Iterator(TALES.Iterator): def __bobo_traverse__(self, REQUEST, name): if name in ('first', 'last'): path = REQUEST['TraversalRequestNameStack'] names = list(path) names.reverse() path[:] = [tuple(names)] return getattr(self, name) def same_part(self, name, ob1, ob2): if name is None: return ob1 == ob2 if isinstance(name, type('')): name = name.split('/') name = list(filter(None, name)) securityManager = getSecurityManager() try: ob1 = restrictedTraverse(ob1, name, securityManager) ob2 = restrictedTraverse(ob2, name, securityManager) except Undefs: return 0 return ob1 == ob2
