0004-to-be-fixed-up-use-a-decorator-to-indicate-views-whe.patch

Benjamin Dauvergne, 23 juillet 2021 15:48

Voir les différences: en ligne côte à côte

Subject: [PATCH 4/4] to be fixed up: use a decorator to indicate views where
 view_restriction can be applied

 src/authentic2/idp/saml/saml2_endpoints.py | 18 +++++-------------
 src/authentic2/middleware.py               |  7 +++----
 src/authentic2/utils/view_decorators.py    | 20 ++++++++++++++++++++
 src/authentic2/views.py                    |  8 +++-----
 src/authentic2_auth_fc/views.py            |  1 -
 src/authentic2_idp_cas/views.py            |  6 +++---
 src/authentic2_idp_oidc/views.py           |  5 ++---
 tests/test_user_manager.py                 |  2 +-
 8 files changed, 37 insertions(+), 30 deletions(-)
 create mode 100644 src/authentic2/utils/view_decorators.py

     from authentic2.utils.misc import datetime_to_xs_datetime, find_authentication_event
     from authentic2.utils.misc import get_backends as get_idp_backends
     from authentic2.utils.misc import login_require, make_url
     from authentic2.utils.view_decorators import enable_view_restriction
     from . import app_settings
-...
         return kwargs['name_id_content']
     @enable_view_restriction
     @never_cache
     @csrf_exempt
     @log_assert
-...
         """
         nonce = login.request.id or get_nonce()
         save_key_values(nonce, force_text(login.dump()), False, nid_format)
         next_url = make_url(continue_sso, params={NONCE_FIELD_NAME: nonce})
         next_url = make_url('a2-idp-saml-continue', params={NONCE_FIELD_NAME: nonce})
         logger.debug('redirect to login page with next url %s', next_url)
         return login_require(
             request,
-...
         return HttpResponseRedirect(url)
     @enable_view_restriction
     @never_cache
     def continue_sso(request):
         consent_answer = None
-...
         return request.user.is_superuser()
     @enable_view_restriction
     @never_cache
     @csrf_exempt
     @login_required
-...
         return return_saml2_response(request, logout, title=_('You are being redirected to "%s"') % provider.name)
     finish_slo.no_view_restriction = True
     def return_logout_error(request, logout, error):
         logout.buildResponseMsg()
         set_saml2_response_responder_status_code(logout.response, error)
-...
         return a2_views.logout(request, next_url=next_url, do_local=False, check_referer=False)
     slo.no_view_restriction = True
     def icon_url(name):
         return '%s/authentic2/images/%s.png' % (settings.STATIC_URL, name)
-...
             return HttpResponseRedirect(logout.msgUrl)
     idp_slo.no_view_restriction = True
     def process_logout_response(request, logout, soap_response, next):
         logger.debug('logout response is %r', soap_response)
         try:
-...
         return process_logout_response(request, logout, get_saml2_query_request(request), next)
     slo_return.no_view_restriction = True
     # Helpers
     # Mapping to generate the metadata file, must be kept in sync with the url

         def process_view(self, request, view_func, view_args, view_kwargs):
             '''If current view is not the one where we should be, redirect'''
             if not getattr(view_func, 'enable_view_restriction', False):
                 return
             view = self.check_view_restrictions(request)
             if not view:
                 return
-...
             # do not block on the restricted view
             if url_name == view:
                 return
             # prevent blocking some views, like logout views
             if getattr(request.resolver_match.func, 'no_view_restriction', False):
                 return
             return utils_misc.redirect_and_come_back(request, view)

     # authentic2 - versatile identity manager
     # Copyright (C) 2010-2021 Entr'ouvert
+    #
     # This program is free software: you can redistribute it and/or modify it
     # under the terms of the GNU Affero General Public License as published
     # by the Free Software Foundation, either version 3 of the License, or
     # (at your option) any later version.
+    #
     # This program is distributed in the hope that it will be useful,
     # but WITHOUT ANY WARRANTY; without even the implied warranty of
     # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     # GNU Affero General Public License for more details.
+    #
     # You should have received a copy of the GNU Affero General Public License
     # along with this program.  If not, see <http://www.gnu.org/licenses/>.
     def enable_view_restriction(view):
         view.enable_view_restriction = True
         return view

     from .utils import switch_user as utils_switch_user
     from .utils.evaluate import HTTPHeaders
     from .utils.service import get_service_from_request, get_service_from_token, set_service_ref
     from .utils.view_decorators import enable_view_restriction
     User = get_user_model()
-...
             return ctx
     homepage = Homepage.as_view()
     homepage = enable_view_restriction(Homepage.as_view())
     class ProfileView(cbv.TemplateNamesMixin, TemplateView):
-...
             return context
     profile = login_required(ProfileView.as_view())
     profile = enable_view_restriction(login_required(ProfileView.as_view()))
     def logout_list(request):
-...
         return response
     logout.no_view_restriction = True
     def login_password_profile(request, *args, **kwargs):
         context = kwargs.pop('context', {})
         can_change_password = utils_misc.user_can_change_password(request=request)

src/authentic2_auth_fc/views.py
572	572
573	573
574	574	logout = LogoutReturnView.as_view()
575		logout.no_view_restriction = True

         normalize_attribute_values,
         redirect,
+    )
     from authentic2.utils.view_decorators import enable_view_restriction
     from authentic2.views import logout as logout_view
     from authentic2_idp_cas.constants import (
         ATTRIBUTES_ELT,
-...
             return redirect(request, next_url)
     login = LoginView.as_view()
     login = enable_view_restriction(LoginView.as_view())
     logout = LogoutView.as_view()
     logout.no_view_restriction = True
     _continue = ContinueView.as_view()
     _continue = enable_view_restriction(ContinueView.as_view())
     validate = ValidateView.as_view()
     service_validate = ServiceValidateView.as_view()
     proxy = ProxyView.as_view()

     from authentic2.decorators import setting_enabled
     from authentic2.exponential_retry_timeout import ExponentialRetryTimeout
     from authentic2.utils.misc import last_authentication_event, login_require, make_url, redirect
     from authentic2.utils.view_decorators import enable_view_restriction
     from authentic2.views import logout as a2_logout
     from django_rbac.utils import get_ou_model
-...
         return HttpResponse(utils.get_jwkset().export(private_keys=False), content_type='application/json')
     @enable_view_restriction
     @setting_enabled('ENABLE', settings=app_settings)
     def authorize(request, *args, **kwargs):
         validated_redirect_uri = None
-...
         # FIXME: do something with id_token_hint
         id_token_hint = request.GET.get('id_token_hint')
         return a2_logout(request, next_url=post_logout_redirect_uri, do_local=False, check_referer=False)
     logout.no_view_restriction = True

         user_count = User.objects.count()
         # queries should be batched to keep prefetching working without
         # overspending memory for the queryset cache, 4 queries by batches
         num_queries = int(4 + 4 * (user_count / DEFAULT_BATCH_SIZE + bool(user_count % DEFAULT_BATCH_SIZE)))
         num_queries = int(4 * (user_count / DEFAULT_BATCH_SIZE + bool(user_count % DEFAULT_BATCH_SIZE)))
         # export task also perform one query to set trigram an another to get users count
         num_queries += 3
         with django_assert_num_queries(num_queries):
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0004-to-be-fixed-up-use-a-decorator-to-indicate-views-whe.patch