Mercurial > libervia-web

annotate libervia/web/pages/merge-requests/view/page_meta.py @ 1598:86c7a3a625d5

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
server: always start a new session on connection: The session was kept when a user was connecting from service profile (but not from other profiles), this was leading to session fixation vulnerability (an attacker on the same machine could get service profile session cookie, and use it when a victim would log-in). This patch fixes it by always starting a new session on connection. fix 443
author Goffi <goffi@goffi.org>
date Fri, 23 Feb 2024 13:35:24 +0100
parents eb00d593801d
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
1 #!/usr/bin/env python3
1239
f511f8fbbf8a fixed shebangs
Goffi <goffi@goffi.org>
parents: 1216
diff changeset
2
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
3
1518
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
4 from libervia.web.server.constants import Const as C
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
5 from libervia.backend.core.i18n import _
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
6 from libervia.web.server.utils import SubPage
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
7 from libervia.web.server import session_iface
1095
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
8 from twisted.words.protocols.jabber import jid
1518
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
9 from libervia.backend.tools.common import template_xmlui
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
10 from libervia.backend.tools.common import uri
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
11 from libervia.backend.tools.common import data_format
eb00d593801d refactoring: rename `libervia` to `libervia.web` + update imports following backend changes
Goffi <goffi@goffi.org>
parents: 1509
diff changeset
12 from libervia.backend.core.log import getLogger
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
13
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
14 name = "merge-requests_view"
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
15 access = C.PAGES_ACCESS_PUBLIC
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
16 template = "merge-request/item.html"
1145
29eb15062416 pages: set __name__ for imported pages
Goffi <goffi@goffi.org>
parents: 1124
diff changeset
17 log = getLogger(__name__)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
18
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
19
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
20 def parse_url(self, request):
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
21 try:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
22 item_id = self.next_path(request)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
23 except IndexError:
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
24 log.warning(_("no list item id specified"))
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
25 self.page_error(request, C.HTTP_BAD_REQUEST)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
26
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
27 data = self.get_r_data(request)
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
28 data["list_item_id"] = item_id
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
29
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
30
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
31 async def prepare_render(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
32 data = self.get_r_data(request)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
33 template_data = request.template_data
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
34 session = self.host.get_session_data(request, session_iface.IWebSession)
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
35 service, node, list_item_id = (
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
36 data.get("service", ""),
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
37 data.get("node", ""),
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
38 data["list_item_id"],
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
39 )
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
40 profile = self.get_profile(request)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
41
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
42 if profile is None:
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
43 profile = C.SERVICE_PROFILE
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
44
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
45 merge_requests = data_format.deserialise(
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
46 await self.host.bridge_call(
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
47 "merge_requests_get",
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
48 service.full() if service else "",
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
49 node,
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
50 C.NO_LIMIT,
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
51 [list_item_id],
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
52 "",
1499
134ff560d67e pages (merge-requests/view): serialise extra following backend change
Goffi <goffi@goffi.org>
parents: 1447
diff changeset
53 data_format.serialise({"parse": C.BOOL_TRUE, "labels_as_list": C.BOOL_TRUE}),
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
54 profile,
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
55 )
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
56 )
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
57 list_item = template_xmlui.create(
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
58 self.host, merge_requests['items'][0], ignore=["request_data", "type"]
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
59 )
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
60 template_data["item"] = list_item
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
61 template_data["patches"] = merge_requests['items_patches'][0]
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
62 comments_uri = list_item.widgets["comments_uri"].value
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
63 if comments_uri:
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
64 uri_data = uri.parse_xmpp_uri(comments_uri)
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
65 template_data["comments_node"] = comments_node = uri_data["node"]
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
66 template_data["comments_service"] = comments_service = uri_data["path"]
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
67 template_data["comments"] = data_format.deserialise(await self.host.bridge_call(
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
68 "mb_get", comments_service, comments_node, C.NO_LIMIT, [],
1447
907f519faaf0 pages: pubsub's `extra` is now serialised, following backend change
Goffi <goffi@goffi.org>
parents: 1378
diff changeset
69 data_format.serialise({}), profile
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
70 ))
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
71
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
72 template_data["login_url"] = self.get_page_redirect_url(request)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
73
1095
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
74 if session.connected:
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
75 # we set edition URL only if user is the publisher or the node owner
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
76 publisher = jid.JID(list_item.widgets["publisher"].value)
1095
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
77 is_publisher = publisher.userhostJID() == session.jid.userhostJID()
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
78 affiliation = None
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
79 if not is_publisher:
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
80 node = node or self.host.ns_map["merge_requests"]
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
81 affiliation = await self.host.get_affiliation(request, service, node)
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
82 if is_publisher or affiliation == "owner":
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
83 template_data["url_list_item_edit"] = self.get_url_by_path(
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
84 SubPage("merge-requests"),
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
85 service.full(),
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
86 node or "@",
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
87 SubPage("merge-requests_edit"),
1378
e3e303a30a74 pages (tickets): renamed "tickets" to "lists":
Goffi <goffi@goffi.org>
parents: 1302
diff changeset
88 list_item_id,
1113
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
89 )
cdd389ef97bc server: code style reformatting using black
Goffi <goffi@goffi.org>
parents: 1098
diff changeset
90
1095
7d5633ccbaf2 merge-requests (view), tickets (view): fill "url_ticket_edit" when logged user is publisher of ticket, or node owner.
Goffi <goffi@goffi.org>
parents: 1085
diff changeset
91
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
92 async def on_data_post(self, request):
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
93 type_ = self.get_posted_data(request, "type")
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
94 if type_ == "comment":
1509
106bae41f5c8 massive refactoring from camelCase -> snake_case. See backend commit log for more details
Goffi <goffi@goffi.org>
parents: 1506
diff changeset
95 blog_page = self.get_page_by_name("blog_view")
1302
04e7dd6b6f4d pages (blog, tickets, merge-requests): updated code to handle new serialisation, following backend changes
Goffi <goffi@goffi.org>
parents: 1239
diff changeset
96 await blog_page.on_data_post(self, request)
991
6ce9647011b3 pages(merge-requests): merge requests new, view and list pages implementations.
Goffi <goffi@goffi.org>
parents:
diff changeset
97 else:
1216
b2d067339de3 python 3 port:
Goffi <goffi@goffi.org>
parents: 1145
diff changeset
98 log.warning(_("Unhandled data type: {}").format(type_))