Mercurial > p > roundup > code
view roundup/cgi/engine_chameleon.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | 4d20d8251bf2 |
| children | b8e63e65d9a8 |
line wrap: on
line source
"""Templating engine adapter for the Chameleon.""" __docformat__ = 'restructuredtext' import chameleon from roundup.cgi.templating import context, TALLoaderBase from roundup.anypy.strings import s2u class Loader(TALLoaderBase): def __init__(self, dir): self.dir = dir self.loader = chameleon.PageTemplateLoader(dir) def load(self, tplname): src, filename = self._find(tplname) return RoundupPageTemplate(self.loader.load(src)) class RoundupPageTemplate(object): def __init__(self, pt): self._pt = pt def render(self, client, classname, request, **options): c = context(client, self, classname, request) c.update({'options': options}) def translate(msgid, domain=None, mapping=None, default=None): result = client.translator.translate(domain, msgid, mapping=mapping, default=default) return s2u(result) output = self._pt.render(None, translate, **c) return output.encode(client.charset) def __getitem__(self, name): return self._pt[name] def __getattr__(self, name): return getattr(self._pt, name)
