view roundup/dist/command/build_doc.py @ 7155:89a59e46b3af

improve REST interface security When using REST, we reflect the client's origin. If the wildcard '*' is used in allowed_api_origins all origins are allowed. When this is done, it also added an 'Access-Control-Allow-Credentials: true' header. This Credentials header should not be added if the site is matched only by '*'. This header should be provided only for explicit origins (e.g. https://example.org) not for the wildcard. This is now fixed for CORS preflight OPTIONS request as well as normal GET, PUT, DELETE, POST, PATCH and OPTIONS requests. A missing Access-Control-Allow-Credentials will prevent the tracker from being accessed using credentials. This prevents an unauthorized third party web site from using a user's credentials to access information in the tracker that is not publicly available. Added test for this specific case. In addition, allowed_api_origins can include explicit origins in addition to '*'. '*' must be first in the list. Also adapted numerous tests to work with these changes. Doc updates.
author John Rouillard <rouilj@ieee.org>
date Thu, 23 Feb 2023 12:01:33 -0500
parents 42bf0a707763
children 4ff18b1cd9bf
line wrap: on
line source

#
# Copyright (C) 2009 Stefan Seefeld
# All rights reserved.
# For license terms see the file COPYING.txt.
#

import os, sys
import os.path
import glob

try:
    from setuptools.command.install import install as _build_py
    raise ImportError
except ImportError:
    from distutils.command.build import build as _build_py  # try/except clause
    orig_build = _build_py

try:
    # would be nice to use setuptools.Command.spawn() as it
    # obeys the dry-run flag.
    from subprocess import run as spawn
except ImportError:
    from distutils.spawn import spawn  # try/except: in except for subprocess

try:
    from distutils.spawn import find_executable # try/except: in try local find
except ImportError:
    from roundup.dist.command import find_executable

class build_doc(_build_py):
    """Defines the specific procedure to build roundup's documentation."""

    description = "build documentation"

    def run(self):
        """Run this command, i.e. do the actual document generation."""

        sphinx = find_executable('sphinx-build')
        if sphinx:
            sphinx = [sphinx]
        else:
            try:  # try to find version installed with Python tools
                  # tested with Sphinx 1.1.3
                import sphinx as sp
            except ImportError:
                pass
            else:
                sphinx = [sys.executable, sp.__file__]

        if not sphinx:
            self.warn("could not find sphinx-build in PATH")
            self.warn("cannot build documentation")
            return

        doc_dir = os.path.join('share', 'doc', 'roundup', 'html')
        temp_dir = os.path.join(self.build_temp, 'doc')
        cmd = sphinx + ['-d', temp_dir, 'doc', doc_dir]
        spawn(cmd)

Roundup Issue Tracker: http://roundup-tracker.org/