0001-whitelist-send_registration_email_next_url-using-HMA.patch

Benjamin Dauvergne, 19 juin 2019 15:50

Voir les différences: en ligne côte à côte

Subject: [PATCH] whitelist send_registration_email_next_url using HMAC
 signature (#34115)

 src/authentic2/constants.py |  1 +
 src/authentic2/crypto.py    | 17 +++++++++++++++++
 src/authentic2/utils.py     | 18 ++++++++++++++----
 src/authentic2/views.py     |  2 +-
 tests/test_api.py           |  4 +++-
 5 files changed, 36 insertions(+), 6 deletions(-)

src/authentic2/constants.py
21	21	SWITCH_USER_SESSION_KEY = '_switch_user'
22	22	LAST_LOGIN_SESSION_KEY = '_last_login'
23	23	SERVICE_FIELD_NAME = 'service'
	24	NEXT_URL_SIGNATURE = 'next-signature'

     import base64
     import hashlib
     import hmac
     import struct
     from Crypto.Cipher import AES
-...
     from Crypto.Hash import HMAC
     from Crypto import Random
     from django.utils.crypto import constant_time_compare
     class DecryptionError(Exception):
         pass
-...
             if not raise_on_error:
                 return None
             raise
     def hmac_url(key, url):
         if hasattr(key, 'encode'):
             key = key.encode('utf-8')
         if hasattr(url, 'decode'):
             url = url.encode('ascii')
         return base64.b32encode(hmac.HMAC(key=key, msg=url, digestmod=hashlib.sha256).digest()).strip('=')
     def check_hmac_url(key, url, signature):
         if hasattr(signature, 'decode'):
             signature = signature.decode('ascii')
         return constant_time_compare(signature, hmac_url(key, url))

     from authentic2.saml.saml2utils import filter_attribute_private_key, \
         filter_element_private_key
     from . import plugins, app_settings, constants
     from . import plugins, app_settings, constants, crypto
     class CleanLogMessage(logging.Filter):
-...
         logger.info(u'account deletion mail sent to %s', user.email)
     def build_reset_password_url(user, request=None, next_url=None, set_random_password=True):
     def build_reset_password_url(user, request=None, next_url=None, set_random_password=True, sign_next_url=True):
         '''Build a reset password URL'''
         from .compat import default_token_generator
-...
         if request:
             reset_url = request.build_absolute_uri(reset_url)
         if next_url:
             reset_url += '?' + urlparse.urlencode({'next': next_url})
             params = {'next': next_url}
             if sign_next_url:
                 params[constants.NEXT_URL_SIGNATURE] = crypto.hmac_url(settings.SECRET_KEY, next_url)
             reset_url += '?' + urlparse.urlencode(params)
         return reset_url, token
-...
                                  legacy_subject_templates=['registration/password_reset_subject.txt'],
                                  legacy_body_templates=['registration/password_reset_email.html'],
                                  set_random_password=True,
                                  sign_next_url=True,
                                  **kwargs):
         from . import middleware
-...
         # Build reset URL
         ctx['reset_url'], token = build_reset_password_url(user, request=request, next_url=next_url,
                                                            set_random_password=set_random_password)
                                                            set_random_password=set_random_password,
                                                            sign_next_url=sign_next_url)
         send_templated_mail(user.email, template_names, ctx, request=request,
                             legacy_subject_templates=legacy_subject_templates,
-...
             return True
         if same_origin(request.build_absolute_uri(), next_url):
             return True
         signature = request.POST.get(constants.NEXT_URL_SIGNATURE) or request.GET.get(constants.NEXT_URL_SIGNATURE)
         if signature:
             return crypto.check_hmac_url(settings.SECRET_KEY, next_url, signature)
         for origin in app_settings.A2_REDIRECT_WHITELIST:
             if same_origin(next_url, origin):
                 return True

         def get_form_kwargs(self, **kwargs):
             kwargs = super(PasswordResetView, self).get_form_kwargs(**kwargs)
             initial = kwargs.setdefault('initial', {})
             initial['next_url'] = self.request.GET.get(REDIRECT_FIELD_NAME, '')
             initial['next_url'] = utils.select_next_url(self.request, '')
             return kwargs
         def get_context_data(self, **kwargs):

             'email': 'john.doe@example.net',
             'title': 'Mr',
             'send_registration_email': True,
             'send_registration_email_next_url': 'http://example.com/',
+        }
         assert len(mail.outbox) == 0
         resp = app.post_json('/api/users/', params=payload, status=201)
-...
         resp = app.get(relative_url, status=200)
         resp.form.set('new_password1', '1234==aA')
         resp.form.set('new_password2', '1234==aA')
         resp = resp.form.submit().follow()
         resp = resp.form.submit()
         # Check user was properly logged in
         assert str(app.session['_auth_user_id']) == str(user_id)
         assert resp.location == 'http://example.com/'
     def test_api_users_create_force_password_reset(app, client, settings, superuser):
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-whitelist-send_registration_email_next_url-using-HMA.patch