view libervia/web/server/pages_tools.py @ 1598:86c7a3a625d5

server: always start a new session on connection: The session was kept when a user was connecting from service profile (but not from other profiles), this was leading to session fixation vulnerability (an attacker on the same machine could get service profile session cookie, and use it when a victim would log-in). This patch fixes it by always starting a new session on connection. fix 443
author Goffi <goffi@goffi.org>
date Fri, 23 Feb 2024 13:35:24 +0100
parents eb00d593801d
children
line wrap: on
line source

#!/usr/bin/env python3

# Libervia Web frontend
# Copyright (C) 2011-2021 Jérôme Poisson <goffi@goffi.org>

# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.

# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

"""Helper methods for common operations on pages"""

from twisted.internet import defer
from libervia.backend.core.i18n import _
from libervia.backend.core.log import getLogger
from libervia.backend.tools.common import data_format
from libervia.web.server.constants import Const as C


log = getLogger(__name__)


def deserialise(comments_data_s):
    return data_format.deserialise(comments_data_s)


def retrieve_comments(self, service, node, profile, pass_exceptions=True):
    """Retrieve comments from server and convert them to data objects

    @param service(unicode): service holding the comments
    @param node(unicode): node to retrieve
    @param profile(unicode): profile of the user willing to find comments
    @param pass_exceptions(bool): if True bridge exceptions will be ignored but logged
        else exception will be raised
    """
    try:
        d = self.host.bridge_call(
            "mb_get", service, node, C.NO_LIMIT, [], data_format.serialise({}), profile
        )
    except Exception as e:
        if not pass_exceptions:
            raise e
        else:
            log.warning(
                _("Can't get comments at {node} (service: {service}): {msg}").format(
                    service=service, node=node, msg=e
                )
            )
            return defer.succeed([])

    d.addCallback(deserialise)
    return d