elections/commands.py | 4 +++ elections/config/app.cfg | 4 +-- elections/controllers.py | 43 ++++++++-------------------------------- elections/templates/login.html | 37 +--------------------------------- elections/templates/master.html | 20 +++++++----------- examples/elections.wsgi | 4 +++ 6 files changed, 29 insertions(+), 83 deletions(-) New commits: commit a8125d683490a7e123929998cc89782a163a00cc Author: Toshio Kuratomi <toshio(a)fedoraproject.org&gt; Date: Tue Jul 21 23:19:22 2009 -0700 Preliminary port to using jsonfas2 with csrf protection. diff --git a/elections/commands.py b/elections/commands.py index 07f9906..acac305 100644 --- a/elections/commands.py +++ b/elections/commands.py @@ -10,6 +10,9 @@ import pkg_resources pkg_resources.require("TurboGears") import turbogears +from turbogears import startup +from fedora.tg.util import enable_csrf + import cherrypy cherrypy.lowercase_api = True @@ -47,6 +50,7 @@ def start(): turbogears.update_config(configfile=configfile, modulename="elections.config") + startup.call_on_startup.append(enable_csrf) from elections.controllers import Root turbogears.start_server(Root()) diff --git a/elections/config/app.cfg b/elections/config/app.cfg index 279f12e..cd9d8fc 100644 --- a/elections/config/app.cfg +++ b/elections/config/app.cfg @@ -84,8 +84,8 @@ identity.failure_url="/login" # FAS2 Auth # ========= -identity.provider='jsonfas' -visit.manager="jsonfas" +identity.provider="jsonfas2" +visit.manager="jsonfas2" visit.cookie.secure = True # compress the data sends to the web browser diff --git a/elections/controllers.py b/elections/controllers.py index 360def0..804b0c4 100644 --- a/elections/controllers.py +++ b/elections/controllers.py @@ -1,6 +1,6 @@ # -*- coding: utf-8 -*- # -# Copyright © 2008 Nigel Jones, Toshio Kuratomi, Ricky Zhou, Luca Foppiano All rights reserved. +# Copyright © 2008-2009 Nigel Jones, Toshio Kuratomi, Ricky Zhou, Luca Foppiano All rights reserved. # # This copyrighted material is made available to anyone wishing to use, modify, # copy, or redistribute it subject to the terms and conditions of the GNU @@ -29,6 +29,8 @@ from turbogears.database import session from cherrypy import request, response from fedora.client.fas2 import AccountSystem +import fedora.controllers.login as fc_login +import fedora.controllers.logout as fc_logout from elections import model from elections.model import * from elections.admin import Admin @@ -120,37 +122,10 @@ class Root(controllers.RootController): return dict(votecount=votecount, usernamemap=usernamemap, election=election, appTitle=self.appTitle) @expose(template="elections.templates.login", allow_json=True) - def login(self, forward_url=None, previous_url=None, *args, **kw): - if not identity.current.anonymous \ - and identity.was_login_attempted() \ - and not identity.get_identity_errors(): - # User is logged in - if 'tg_format' in request.params and request.params['tg_format'] == 'json': - # When called as a json method, doesn't make any sense to - # redirect to a page. Returning the logged in identity - # is better. - return dict(user = identity.current.user) - if not forward_url: - forward_url=config.get('base_url_filter.base_url') + '/' - raise redirect(forward_url) - - forward_url=None - previous_url=request.path - - if identity.was_login_attempted(): - msg="The credentials you supplied were not correct or did not grant access to this resource." - elif identity.get_identity_errors(): - msg="You must provide your credentials before accessing this resource." - else: - msg="Please log in." - forward_url= request.headers.get("Referer", "/") - - response.status=403 - return dict(message=msg, previous_url=previous_url, logging_in=True, - original_parameters=request.params, - forward_url=forward_url, appTitle=self.appTitle + ' -- Fedora Account System Login') - - @expose() + def login(self, forward_url=None, *args, **kw): + login_dict = fc_login(forward_url, args, kwargs) + return login_dict + + @expose(allow_json=True) def logout(self): - identity.current.logout() - raise redirect(request.headers.get("Referer","/")) + return fc_logout() diff --git a/elections/templates/login.html b/elections/templates/login.html index d71e393..e77aada 100644 --- a/elections/templates/login.html +++ b/elections/templates/login.html @@ -3,44 +3,11 @@ xmlns:py="http://genshi.edgewall.org/" xmlns:xi="http://www.w3.org/2001/XInclude"> <xi:include href="master.html" /> + <xi:include href="${tg.fedora_template('login.html')}" /> <head> <title>${appTitle}</title> </head> <body> - <div id="loginBox"> - <h1>Login</h1> - <p>${message}</p> - <form action="${previous_url}" method="POST"> - <table> - <tr> - <td class="label"> - <label for="user_name">User Name:</label> - </td> - <td class="field"> - <input type="text" id="user_name" name="user_name"/> - </td> - </tr> - <tr> - <td class="label"> - <label for="password">Password:</label> - </td> - <td class="field"> - <input type="password" id="password" name="password"/> - </td> - </tr> - <tr> - <td colspan="2" class="buttons"> - <input type="submit" name="login" value="Login"/> - </td> - </tr> - </table> - - <input py:if="forward_url" type="hidden" name="forward_url" value="${forward_url}"/> - - <div py:for="name,values in original_parameters.items()" py:strip="1"> - <input py:for="value in isinstance(values, list) and values or [values]" type="hidden" name="${name}" value="${value}"/> - </div> - </form> - </div> + <loginform>${message}</loginform> </body> </html> diff --git a/elections/templates/master.html b/elections/templates/master.html index 884761d..42fdc45 100644 --- a/elections/templates/master.html +++ b/elections/templates/master.html @@ -7,6 +7,7 @@ <meta py:replace="select('*|text()')" /> <link rel="stylesheet" type="text/css" media="screen" href="${tg.url('/static/css/style.css')}" /> <link rel="stylesheet" type="text/css" media="screen" href="https://fedoraproject.org/static/css/fedora.css" /> + <jsglobals /> </head> <body py:match="body" py:attrs="select('@*')"> <div id="wrapper"> @@ -29,18 +30,9 @@ <div id="content"> - <div py:if="tg.config('identity.on') and not defined('logging_in')" id="pageLogin"> - <span py:if="tg.identity.anonymous"> - <a href="${tg.url('/login')}">Login</a> - </span> - <span py:if="not tg.identity.anonymous"> - Welcome ${tg.identity.user.human_name or tg.identity.user.user_name}. - <a href="${tg.url('/logout')}">Logout</a> - </span> - </div> - <div py:if="tg_flash" class="flash"> - ${tg_flash} - </div> + <ul class="toolbar" id="#main-toolbar"> + <logintoolitem href="${tg.url('/')}" /> + </ul> <div py:replace="select('*|text()')" /> </div> <p> @@ -67,4 +59,8 @@ </div> </div> </body> + + <xi:include href="${tg.fedora_template('login.html')}" /> + <xi:include href="${tg.fedora_template('jsglobals.html')}" /> + </html> diff --git a/examples/elections.wsgi b/examples/elections.wsgi index c56c59b..a62b4d5 100644 --- a/examples/elections.wsgi +++ b/examples/elections.wsgi @@ -16,6 +16,8 @@ import atexit import cherrypy import cherrypy._cpwsgi import turbogears +from turbogears import startup +from fedora.tg.util import enable_csrf turbogears.update_config(configfile="/etc/elections.cfg", modulename="elections.config") turbogears.config.update({'global': {'server.environment': 'production'}}) @@ -25,6 +27,8 @@ turbogears.config.update({'global': {'server.webpath': '/elections'}}) #turbogears.config.update({'global': {'base_url_filter.on': True}}) #turbogears.config.update({'global': {'base_url_filter.base_url': 'http://localhost/elections'}}) +startup.call_on_startup.append(enable_csrf) + import elections.controllers cherrypy.root = elections.controllers.Root()