0004-to-be-fixed-up-use-a-decorator-to-indicate-views-whe.patch

Benjamin Dauvergne, 23 juillet 2021 11:59

Voir les différences: en ligne côte à côte

Subject: [PATCH 4/4] to be fixed up: use a decorator to indicate views where
 view_restriction can be applied

 src/authentic2/idp/saml/saml2_endpoints.py | 12 -------
 src/authentic2/idp/saml/urls.py            |  9 ++---
 src/authentic2/middleware.py               |  6 ++--
 src/authentic2/urls.py                     |  5 +--
 src/authentic2/utils/view_decorators.py    | 40 ++++++++++++++++++++++
 src/authentic2/views.py                    |  3 --
 src/authentic2_idp_cas/urls.py             |  6 ++--
 src/authentic2_idp_oidc/urls.py            |  4 ++-
 8 files changed, 57 insertions(+), 28 deletions(-)
 create mode 100644 src/authentic2/utils/view_decorators.py

         return return_saml2_response(request, logout, title=_('You are being redirected to "%s"') % provider.name)
     finish_slo.no_view_restriction = True
     def return_logout_error(request, logout, error):
         logout.buildResponseMsg()
         set_saml2_response_responder_status_code(logout.response, error)
-...
         return a2_views.logout(request, next_url=next_url, do_local=False, check_referer=False)
     slo.no_view_restriction = True
     def icon_url(name):
         return '%s/authentic2/images/%s.png' % (settings.STATIC_URL, name)
-...
             return HttpResponseRedirect(logout.msgUrl)
     idp_slo.no_view_restriction = True
     def process_logout_response(request, logout, soap_response, next):
         logger.debug('logout response is %r', soap_response)
         try:
-...
         return process_logout_response(request, logout, get_saml2_query_request(request), next)
     slo_return.no_view_restriction = True
     # Helpers
     # Mapping to generate the metadata file, must be kept in sync with the url

         slo_soap,
         sso,
+    )
     from authentic2.utils.view_decorators import view_restriction
     from . import views
     urlpatterns = [
         url(r'^metadata$', metadata, name='a2-idp-saml-metadata'),
         url(r'^sso$', sso, name='a2-idp-saml-sso'),
         url(r'^continue$', continue_sso, name='a2-idp-saml-continue'),
         url(r'^sso$', view_restriction(sso), name='a2-idp-saml-sso'),
         url(r'^continue$', view_restriction(continue_sso), name='a2-idp-saml-continue'),
         url(r'^slo$', slo, name='a2-idp-saml-slo'),
         url(r'^slo/soap$', slo_soap, name='a2-idp-saml-slo-soap'),
         url(r'^idp_slo/(.*)$', idp_slo, name='a2-idp-saml-slo-idp'),
-...
         url(r'^finish_slo$', finish_slo, name='a2-idp-saml-finish-slo'),
         url(r'^artifact$', artifact, name='a2-idp-saml-artifact'),
         # legacy endpoint, now it's prefered to pass the entity_id in a parameter
         url(r'^idp_sso/(.+)$', idp_sso, name='a2-idp-saml-idp-sso-named'),
         url(r'^idp_sso/$', idp_sso, name='a2-idp-saml2-idp-sso'),
         url(r'^idp_sso/(.+)$', view_restriction(idp_sso), name='a2-idp-saml-idp-sso-named'),
         url(r'^idp_sso/$', view_restriction(idp_sso), name='a2-idp-saml2-idp-sso'),
         url(r'^federations/create/(?P<pk>\d+)/$', views.create_federation, name='a2-idp-saml2-federation-create'),
         url(r'^federations/(?P<pk>\d+)/delete/$', views.delete_federation, name='a2-idp-saml2-federation-delete'),
+    ]

         def process_view(self, request, view_func, view_args, view_kwargs):
             '''If current view is not the one where we should be, redirect'''
             if not getattr(view_func, 'view_restriction', False):
                 return
             view = self.check_view_restrictions(request)
             if not view:
                 return
-...
             # do not block on the restricted view
             if url_name == view:
                 return
             # prevent blocking some views, like logout views
             if getattr(request.resolver_match.func, 'no_view_restriction', False):
                 return
             return utils_misc.redirect_and_come_back(request, view)

     from authentic2.decorators import lasso_required, required, setting_enabled
     from . import plugins, views
     from .utils.view_decorators import view_restriction
     admin.autodiscover()
-...
             login_required(views.authorized_oauth_services),
             name='authorized-oauth-services',
         ),
         url(r'^$', views.profile, name='account_management'),
         url(r'^$', view_restriction(views.profile), name='account_management'),
         # Password change
         url(r'^password/change/$', views.password_change, name='password_change'),
         url(
-...
+    ]
     urlpatterns = [
         url(r'^$', views.homepage, name='auth_homepage'),
         url(r'^$', view_restriction(views.homepage), name='auth_homepage'),
         url(r'^login/$', views.login, name='auth_login'),
         url(r'^logout/$', views.logout, name='auth_logout'),
         url(r'^su/(?P<uuid>[A-Za-z0-9_-]+)/$', views.su, name='su'),

     # authentic2 - versatile identity manager
     # Copyright (C) 2010-2021 Entr'ouvert
+    #
     # This program is free software: you can redistribute it and/or modify it
     # under the terms of the GNU Affero General Public License as published
     # by the Free Software Foundation, either version 3 of the License, or
     # (at your option) any later version.
+    #
     # This program is distributed in the hope that it will be useful,
     # but WITHOUT ANY WARRANTY; without even the implied warranty of
     # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     # GNU Affero General Public License for more details.
+    #
     # You should have received a copy of the GNU Affero General Public License
     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     import copy
     import functools
     import types
     def copy_callable(f):
         """Based on http://stackoverflow.com/a/6528148/190597 (Glenn Maynard)"""
         assert hasattr(f, '__call__')
         if isinstance(f, types.FunctionType):
             g = types.FunctionType(
                 f.__code__, f.__globals__, name=f.__name__, argdefs=f.__defaults__, closure=f.__closure__
+            )
             g = functools.update_wrapper(g, f)
             g.__kwdefaults__ = f.__kwdefaults__
             return g
         else:
             return copy.copy(f)
     def view_restriction(view):
         decorated_view = copy_callable(view)
         decorated_view.view_restriction = True
         return decorated_view

         return response
     logout.no_view_restriction = True
     def login_password_profile(request, *args, **kwargs):
         context = kwargs.pop('context', {})
         can_change_password = utils_misc.user_can_change_password(request=request)

     from django.conf.urls import url
     from authentic2.utils.view_decorators import view_restriction
     from . import views
     urlpatterns = [
         url('^login/?$', views.login, name='a2-idp-cas-login'),
         url('^continue/$', views._continue, name='a2-idp-cas-continue'),
         url('^login/?$', view_restriction(views.login), name='a2-idp-cas-login'),
         url('^continue/$', view_restriction(views._continue), name='a2-idp-cas-continue'),
         url('^validate/?$', views.validate, name='a2-idp-cas-validate'),
         url('^serviceValidate/?$', views.service_validate, name='a2-idp-cas-service-validate'),
         url('^logout/?$', views.logout, name='a2-idp-cas-logout'),

     from django.conf.urls import url
     from authentic2.utils.view_decorators import view_restriction
     from . import views
     urlpatterns = [
         url(r'^.well-known/openid-configuration$', views.openid_configuration, name='oidc-openid-configuration'),
         url(r'^idp/oidc/certs/?$', views.certs, name='oidc-certs'),
         url(r'^idp/oidc/authorize/?$', views.authorize, name='oidc-authorize'),
         url(r'^idp/oidc/authorize/?$', view_restriction(views.authorize), name='oidc-authorize'),
         url(r'^idp/oidc/token/?$', views.token, name='oidc-token'),
         url(r'^idp/oidc/user_info/?$', views.user_info, name='oidc-user-info'),
         url(r'^idp/oidc/logout/?$', views.logout, name='oidc-logout'),
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0004-to-be-fixed-up-use-a-decorator-to-indicate-views-whe.patch