Mercurial > p > roundup > code
view roundup/dist/command/build_doc.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | 42bf0a707763 |
| children | 4ff18b1cd9bf |
line wrap: on
line source
# # Copyright (C) 2009 Stefan Seefeld # All rights reserved. # For license terms see the file COPYING.txt. # import os, sys import os.path import glob try: from setuptools.command.install import install as _build_py raise ImportError except ImportError: from distutils.command.build import build as _build_py # try/except clause orig_build = _build_py try: # would be nice to use setuptools.Command.spawn() as it # obeys the dry-run flag. from subprocess import run as spawn except ImportError: from distutils.spawn import spawn # try/except: in except for subprocess try: from distutils.spawn import find_executable # try/except: in try local find except ImportError: from roundup.dist.command import find_executable class build_doc(_build_py): """Defines the specific procedure to build roundup's documentation.""" description = "build documentation" def run(self): """Run this command, i.e. do the actual document generation.""" sphinx = find_executable('sphinx-build') if sphinx: sphinx = [sphinx] else: try: # try to find version installed with Python tools # tested with Sphinx 1.1.3 import sphinx as sp except ImportError: pass else: sphinx = [sys.executable, sp.__file__] if not sphinx: self.warn("could not find sphinx-build in PATH") self.warn("cannot build documentation") return doc_dir = os.path.join('share', 'doc', 'roundup', 'html') temp_dir = os.path.join(self.build_temp, 'doc') cmd = sphinx + ['-d', temp_dir, 'doc', doc_dir] spawn(cmd)
