view roundup/cgi/engine_jinja2.py @ 8411:ef1ea918b07a reauth-confirm_id

feat(security): Add user confirmation/reauth for sensitive changes Auditors can raise Reauth(reason) exception to require the user to enter a token (e.g. account password) to verify the user is performing the change. Naming is subject to change. actions.py: New ReauthAction class handler and verifyPassword() method for overriding if needed. client.py: Handle Reauth exception by calling Client:reauth() method. Default client:reauth method. Add 'reauth' action declaration. exceptions.py: Define and document Reauth exception as a subclass of RoundupCGIException. templating.py: Define method utils.embed_form_fields(). The original form making a change to the database has a lot of form fields. These need to be resubmitted to Roundup as part of the form submission that verifies the user's password. This method turns all non file form fields into type=hidden inputs. It escapes the names and values to prevent XSS. For file form fields, it base64 encodes the contents and puts them in hidden pre blocks. The pre blocks have data attributes for the filename, filetype and the original field name. (Note the original field name is not used.) This stops the file content data (maybe binary e.g. jpegs) from breaking the html page. The reauth template runs JavaScript that turns the encoded data inside the pre tags back into a file. Then it adds a multiple file input control to the page and attaches all the files to it. This file input is submitted with the rest of the fields. _generic.reauth.html (multiple tracker templates): Generates a form with id=reauth_form to: display any message from the Reauth exception to the user (e.g. why user is asked to auth). get the user's password submit the form embed all the form data that triggered the reauth recreate any file data that was submitted as part of the form and generate a new file input to push the data to the back end It has the JavaScript routine (as an IIFE) that regenerates a file input without user intervention. All the TAL based tracker templates use the same form. There is also one for the jinja2 template. The JavaScript for both is the same. reference.txt: document embed_form_fields utility method. upgrading.txt: initial upgrading docs. TODO: Finalize naming. I am leaning toward ConfirmID rather than Reauth. Still looking for a standard name for this workflow. Externalize the javascript in _generic.reauth.html to a seperate file and use utils.readfile() to embed it or change the script to load it from a @@file url. Clean up upgrading.txt with just steps to implement and less feature detail/internals. Document internals/troubleshooting in reference.txt. Add tests using live server.
author John Rouillard <rouilj@ieee.org>
date Mon, 11 Aug 2025 14:01:12 -0400
parents b8e63e65d9a8
children 9c3ec0a5c7fc
line wrap: on
line source

"""
Experimental Jinja2 support for Roundup. It will become less
experimental when it is completely clear what information is
passed to template, and when the info is limited to the sane
minimal set (to avoid Roundup state changes from template).

[ ] fallback mechanizm to use multiple templating engines in
    parallel and aid in incremental translation from one
    engine to another

[ ] define a place for templates
    probably
      TRACKER_HOME/templates/jinja2
    with
      TRACKER_HOME/templates/INFO.txt
        describing how the dir was created, for example
          "This is a copy of 'classic' template from ..."
        also template fallback mechanizm for multi-engine
          configuration
    [ ] backward compatibility - if no engine is explicitly
          specified, use TRACKER_HOME/html directory
    [ ] copy TEMPLATES-INFO.txt to INFO.txt
      [ ] implement VERSION file in environment for auto
          upgrade

[ ] precompile() is a stub

[ ] add {{ debug() }} dumper to inspect available variables
    https://github.com/mitsuhiko/jinja2/issues/174
"""

from __future__ import print_function
import jinja2
import mimetypes
import sys

# http://jinja.pocoo.org/docs/api/#loaders

from roundup.cgi.templating import context, LoaderBase, TemplateBase
from roundup.anypy.strings import s2u


class Jinja2Loader(LoaderBase):
    def __init__(self, template_dir):
        self._env = jinja2.Environment(
            loader=jinja2.FileSystemLoader(template_dir),
            extensions=['jinja2.ext.i18n'],
            autoescape=True
        )

        # Adding a custom filter that can transform roundup's vars to unicode
        # This is necessary because jinja2 can only deal with unicode objects
        # and roundup uses utf-8 for the internal representation.
        # The automatic conversion will assume 'ascii' and fail sometime.
        # Analysed with roundup 1.5.0 and jinja 2.7.1. See issue2550811.
        self._env.filters["u"] = s2u

    def _find(self, tplname):
        for extension in ('', '.html', '.xml'):
            try:
                filename = tplname + extension
                return self._env.get_template(filename)
            except jinja2.TemplateNotFound:
                continue

        return None

    def check(self, tplname):
        return bool(self._find(tplname))

    def load(self, tplname):
        tpl = self._find(tplname)
        pt = Jinja2ProxyPageTemplate(tpl)
        pt.content_type = mimetypes.guess_type(tpl.filename)[0] or 'text/html'
        return pt

    def precompile(self):
        pass


class Jinja2ProxyPageTemplate(TemplateBase):
    def __init__(self, template):
        self._tpl = template

    def render(self, client, classname, request, **options):
        # [ ] limit the information passed to the minimal necessary set
        c = context(client, self, classname, request)

        c.update({'options': options,
                  'gettext': lambda s: s2u(client.gettext(s)),
                  'ngettext': lambda s, p, n: s2u(client.ngettext(s, p, n))})
        s = self._tpl.render(c)
        return s if sys.version_info[0] > 2 else \
            s.encode(client.STORAGE_CHARSET, )

    def __getitem__(self, name):
        # [ ] figure out what are these for
        raise NotImplementedError
        # return self._pt[name]

    def __getattr__(self, name):
        # [ ] figure out what are these for
        raise NotImplementedError
        # return getattr(self._pt, name)

Roundup Issue Tracker: http://roundup-tracker.org/