Mercurial > libervia-web

annotate libervia/web/pages/chat/select/page_meta.py @ 1598:86c7a3a625d5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
server: always start a new session on connection: The session was kept when a user was connecting from service profile (but not from other profiles), this was leading to session fixation vulnerability (an attacker on the same machine could get service profile session cookie, and use it when a victim would log-in). This patch fixes it by always starting a new session on connection. fix 443
author Goffi <goffi@goffi.org>
date Fri, 23 Feb 2024 13:35:24 +0100
parents c6976c5b85a1
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
1 #!/usr/bin/env python3
1239
f511f8fbbf8a fixed shebangs
Goffi <goffi@goffi.org>
parents: 1216
diff changeset
2
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
3
1518
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
4 from libervia.backend.core.i18n import _
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
5 from libervia.web.server.constants import Const as C
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
6 from twisted.internet import defer
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
7 from twisted.words.protocols.jabber import jid
1518
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
8 from libervia.backend.tools.common import data_objects
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
9 from libervia.backend.core.log import getLogger
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
10
1145
29eb15062416 pages: set __name__ for imported pages
Goffi <goffi@goffi.org>
parents: 1124
diff changeset
11 log = getLogger(__name__)
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 999
diff changeset
12
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
13 name = "chat_select"
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
14 access = C.PAGES_ACCESS_PROFILE
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
15 template = "chat/select.html"
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
16
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
17
1593
c6976c5b85a1 browser (chat/select): add bookmarked entities on empty search
Goffi <goffi@goffi.org>
parents: 1578
diff changeset
18 async def prepare_render(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
19 profile = self.get_profile(request)
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
20 template_data = request.template_data
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 999
diff changeset
21 rooms = template_data["rooms"] = []
1593
c6976c5b85a1 browser (chat/select): add bookmarked entities on empty search
Goffi <goffi@goffi.org>
parents: 1578
diff changeset
22 bookmarks = await self.host.bridge_call("bookmarks_list", "muc", "all", profile)
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
23 for bm_values in list(bookmarks.values()):
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
24 for room_jid, room_data in bm_values.items():
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
25 url = self.get_page_by_name("chat").get_url(room_jid)
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 999
diff changeset
26 rooms.append(data_objects.Room(room_jid, name=room_data.get("name"), url=url))
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
27 rooms.sort(key=lambda r: r.name)
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
28
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
29
1593
c6976c5b85a1 browser (chat/select): add bookmarked entities on empty search
Goffi <goffi@goffi.org>
parents: 1578
diff changeset
30 async def on_data_post(self, request):
1578
c57133362fb7 pages (chat/select): fix search submission.
Goffi <goffi@goffi.org>
parents: 1518
diff changeset
31 jid_ = self.get_posted_data(request, "search")
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
32 if "@" not in jid_:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
33 profile = self.get_profile(request)
1593
c6976c5b85a1 browser (chat/select): add bookmarked entities on empty search
Goffi <goffi@goffi.org>
parents: 1578
diff changeset
34 service = await self.host.bridge_call("muc_get_service", "", profile)
999
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
35 if service:
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
36 muc_jid = jid.JID(service)
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
37 muc_jid.user = jid_
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
38 jid_ = muc_jid.full()
ded41172dcb5 pages (chat): new chat_select page which display rooms from bookmarks and allows to specify a jid to talk to.
Goffi <goffi@goffi.org>
parents:
diff changeset
39 else:
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
40 log.warning(_("Invalid jid received: {jid}".format(jid=jid_)))
1593
c6976c5b85a1 browser (chat/select): add bookmarked entities on empty search
Goffi <goffi@goffi.org>
parents: 1578
diff changeset
41 return C.POST_NO_CONFIRM
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
42 url = self.get_page_by_name("chat").get_url(jid_)
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
43 self.http_redirect(request, url)