Mercurial > p > roundup > code
view roundup/cgi/engine_jinja2.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | ec1f725f5c91 |
| children | 07ce4e4110f5 |
line wrap: on
line source
""" Experimental Jinja2 support for Roundup. It will become less experimental when it is completely clear what information is passed to template, and when the info is limited to the sane minimal set (to avoid Roundup state changes from template). [ ] fallback mechanizm to use multiple templating engines in parallel and aid in incremental translation from one engine to another [ ] define a place for templates probably TRACKER_HOME/templates/jinja2 with TRACKER_HOME/templates/INFO.txt describing how the dir was created, for example "This is a copy of 'classic' template from ..." also template fallback mechanizm for multi-engine configuration [ ] backward compatibility - if no engine is explicitly specified, use TRACKER_HOME/html directory [ ] copy TEMPLATES-INFO.txt to INFO.txt [ ] implement VERSION file in environment for auto upgrade [ ] precompile() is a stub [ ] add {{ debug() }} dumper to inspect available variables https://github.com/mitsuhiko/jinja2/issues/174 """ from __future__ import print_function import jinja2 import gettext import mimetypes import sys # http://jinja.pocoo.org/docs/api/#loaders from roundup.cgi.templating import context, LoaderBase, TemplateBase from roundup.anypy.strings import s2u class Jinja2Loader(LoaderBase): def __init__(self, dir): self._env = jinja2.Environment( loader=jinja2.FileSystemLoader(dir), extensions=['jinja2.ext.i18n'], autoescape=True ) # Adding a custom filter that can transform roundup's vars to unicode # This is necessary because jinja2 can only deal with unicode objects # and roundup uses utf-8 for the internal representation. # The automatic conversion will assume 'ascii' and fail sometime. # Analysed with roundup 1.5.0 and jinja 2.7.1. See issue2550811. self._env.filters["u"] = s2u def _find(self, tplname): for extension in ('', '.html', '.xml'): try: filename = tplname + extension return self._env.get_template(filename) except jinja2.TemplateNotFound: continue return None def check(self, tplname): return bool(self._find(tplname)) def load(self, tplname): tpl = self._find(tplname) pt = Jinja2ProxyPageTemplate(tpl) pt.content_type = mimetypes.guess_type(tpl.filename)[0] or 'text/html' return pt def precompile(self): pass class Jinja2ProxyPageTemplate(TemplateBase): def __init__(self, template): self._tpl = template def render(self, client, classname, request, **options): # [ ] limit the information passed to the minimal necessary set c = context(client, self, classname, request) c.update({'options': options, 'gettext': lambda s: s2u(client.gettext(s)), 'ngettext': lambda s, p, n: s2u(client.ngettext(s, p, n))}) s = self._tpl.render(c) return s if sys.version_info[0] > 2 else \ s.encode(client.STORAGE_CHARSET, ) def __getitem__(self, name): # [ ] figure out what are these for raise NotImplementedError # return self._pt[name] def __getattr__(self, name): # [ ] figure out what are these for raise NotImplementedError # return getattr(self._pt, name)
