Mercurial > p > roundup > code
view roundup/dist/command/bdist_rpm.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | 551fec9c4cfc |
| children |
line wrap: on
line source
# # Copyright (C) 2009 Stefan Seefeld # All rights reserved. # For license terms see the file COPYING.txt. # # converted to not use distutils 2021 from setuptools.command.bdist_rpm import bdist_rpm as base import os # cribbed from 2.7 distutils def write_file(filename, contents): """Create a file with the specified name and write 'contents' (a sequence of strings without line terminators) to it. """ f = open(filename, "w") try: for line in contents: f.write(line + "\n") finally: f.close() class bdist_rpm(base): def finalize_options(self): base.finalize_options(self) if self.install_script: # install script is overridden. skip default return # install script option must be file name. # create the file in rpm build directory. install_script = os.path.join(self.rpm_base, "install.sh") self.mkpath(self.rpm_base) self.execute(write_file, (install_script, [ ("%s setup.py install --root=$RPM_BUILD_ROOT " "--record=ROUNDUP_FILES") % self.python, # allow any additional extension for man pages # (rpm may compress them to .gz or .bz2) # man page here is any file # with single-character extension # in man directory r"sed -e 's,\(/man/.*\..\)$,\\1*,' " "<ROUNDUP_FILES >INSTALLED_FILES", ]), "writing '%s'" % install_script) self.install_script = install_script
