Mercurial > libervia-web

annotate libervia/web/pages/forums/topics/page_meta.py @ 1598:86c7a3a625d5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
server: always start a new session on connection: The session was kept when a user was connecting from service profile (but not from other profiles), this was leading to session fixation vulnerability (an attacker on the same machine could get service profile session cookie, and use it when a victim would log-in). This patch fixes it by always starting a new session on connection. fix 443
author Goffi <goffi@goffi.org>
date Fri, 23 Feb 2024 13:35:24 +0100 (13 months ago)
parents eb00d593801d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
1 #!/usr/bin/env python3
1239
f511f8fbbf8a fixed shebangs
Goffi <goffi@goffi.org>
parents: 1216
diff changeset
2
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
3
1518
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
4 from libervia.web.server.constants import Const as C
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
5 from libervia.backend.core.i18n import _, D_
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
6 from libervia.backend.core.log import getLogger
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
7 from libervia.backend.tools.common import uri as xmpp_uri
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
8 from libervia.backend.tools.common import data_format
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
9 from libervia.web.server import session_iface
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
10
1145
29eb15062416 pages: set __name__ for imported pages
Goffi <goffi@goffi.org>
parents: 1124
diff changeset
11 log = getLogger(__name__)
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
12
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
13 name = "forum_topics"
1427
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
14 label = D_("Forum Topics")
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
15 access = C.PAGES_ACCESS_PUBLIC
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
16 template = "forum/view_topics.html"
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
17
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
18
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
19 def parse_url(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
20 self.get_path_args(request, ["service", "node"], 2, service="jid")
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
21
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
22
1427
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
23 def add_breadcrumb(self, request, breadcrumbs):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
24 data = self.get_r_data(request)
1427
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
25 breadcrumbs.append({
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
26 "label": label,
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
27 "url": self.get_url(data["service"].full(), data["node"])
1427
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
28 })
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
29
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
30
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
31 async def prepare_render(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
32 profile = self.get_profile(request) or C.SERVICE_PROFILE
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
33 data = self.get_r_data(request)
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
34 service, node = data["service"], data["node"]
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
35 request.template_data.update({"service": service, "node": node})
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
36 template_data = request.template_data
1432
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
37 page_max = data.get("page_max", 20)
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
38 extra = self.get_pubsub_extra(request, page_max=page_max)
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
39 topics, metadata = await self.host.bridge_call(
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
40 "forum_topics_get",
1432
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
41 service.full(),
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
42 node,
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
43 extra,
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
44 profile
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
45 )
1432
fa6fe9511aca pages (forums/topics): deserialise extra + use pagination
Goffi <goffi@goffi.org>
parents: 1427
diff changeset
46 metadata = data_format.deserialise(metadata)
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
47 self.set_pagination(request, metadata)
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
48 identities = self.host.get_session_data(
1506
ce879da7fcf7 server: fix `on_signal` callback
Goffi <goffi@goffi.org>
parents: 1432
diff changeset
49 request, session_iface.IWebSession
1266
6b7f9c3558cc server, pages: better identities handling:
Goffi <goffi@goffi.org>
parents: 1243
diff changeset
50 ).identities
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
51 for topic in topics:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
52 parsed_uri = xmpp_uri.parse_xmpp_uri(topic["uri"])
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
53 author = topic["author"]
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
54 topic["http_uri"] = self.get_page_by_name("forum_view").get_url(
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
55 parsed_uri["path"], parsed_uri["node"]
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
56 )
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
57 if author not in identities:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
58 id_raw = await self.host.bridge_call(
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
59 "identity_get", author, [], True, profile
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
60 )
1243
8aff742d0dd0 pages: updated `identityGet` call, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
61 identities[topic["author"]] = data_format.deserialise(id_raw)
8aff742d0dd0 pages: updated `identityGet` call, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
62
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
63 template_data["topics"] = topics
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
64 template_data["url_topic_new"] = self.get_sub_page_url(request, "forum_topic_new")
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
65
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
66
1427
eaf36fffcbdb pages (forums): better breadcrumbs
Goffi <goffi@goffi.org>
parents: 1425
diff changeset
67 async def on_data_post(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
68 profile = self.get_profile(request)
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
69 if profile is None:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
70 self.page_error(request, C.HTTP_FORBIDDEN)
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
71 type_ = self.get_posted_data(request, "type")
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
72 if type_ == "new_topic":
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
73 service, node, title, body = self.get_posted_data(
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
74 request, ("service", "node", "title", "body")
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
75 )
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
76
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
77 if not title or not body:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
78 self.page_error(request, C.HTTP_BAD_REQUEST)
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
79 topic_data = {"title": title, "content": body}
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
80 try:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
81 await self.host.bridge_call(
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
82 "forum_topic_create", service, node, topic_data, profile
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1058
diff changeset
83 )
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
84 except Exception as e:
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
85 if "forbidden" in str(e):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
86 self.page_error(request, 401)
1058
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
87 else:
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
88 raise e
2290b6ec3991 pages (forums): first draft
Goffi <goffi@goffi.org>
parents:
diff changeset
89 else:
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1173
diff changeset
90 log.warning(_("Unhandled data type: {}").format(type_))