Mercurial > p > roundup > code
view roundup/scripts/roundup_demo.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | 062a54eeb0a1 |
| children | 7b9bddda9d2d |
line wrap: on
line source
#! /usr/bin/env python # # Copyright 2004 Richard Jones (richard@mechanicalcat.net) # DEFAULT_HOME = './demo' DEFAULT_TEMPLATE = 'classic' import sys # --- patch sys.path to make sure 'import roundup' finds correct version import os.path as osp thisdir = osp.dirname(osp.abspath(__file__)) rootdir = osp.dirname(osp.dirname(thisdir)) if (osp.exists(thisdir + '/__init__.py') and osp.exists(rootdir + '/roundup/__init__.py')): # the script is located inside roundup source code sys.path.insert(0, rootdir) # --/ from roundup import admin, configuration, demo, instance from roundup.i18n import _ from roundup.anypy.my_input import my_input from roundup import version_check def run(): home = DEFAULT_HOME template = DEFAULT_TEMPLATE nuke = sys.argv[-1] == 'nuke' # if there is no tracker in home, force nuke try: instance.open(home) except configuration.NoConfigError: nuke = 1 # if we are to create the tracker, prompt for home if nuke: if len(sys.argv) > 2: backend = sys.argv[-2] else: backend = 'anydbm' # FIXME: i'd like to have an option to abort the tracker creation # say, by entering a single dot. but i cannot think of # appropriate prompt for that. home = my_input( _('Enter directory path to create demo tracker [%s]: ') % home) if not home: home = DEFAULT_HOME templates = admin.AdminTool().listTemplates().keys() template = my_input( _('Enter tracker template to use (one of (%(template_list)s)) [%(d\ efault_template)s]: ') % { 'template_list': ','.join(templates), 'default_template': template}) if not template: template = DEFAULT_TEMPLATE # install demo.install_demo(home, backend, admin.AdminTool().listTemplates()[template]['path']) # run demo.run_demo(home) if __name__ == '__main__': run() # vim: set et sts=4 sw=4 :
