0001-auth_oidc-provide-a-less-scary-displayed-error-messa.patch

Paul Marillonnet, 23 janvier 2023 10:47

Voir les différences: en ligne côte à côte

Subject: [PATCH] auth_oidc: provide a less scary displayed error message
 (#73669)

    The user simply gets a generic error message.  The more detailed
    description gets logged and appears as a django debug-level message.

 src/authentic2_auth_oidc/views.py | 41 +++++++++++++++++--------------
 tests/test_auth_oidc.py           | 32 ++++++++++++++++++++++--
 2 files changed, 53 insertions(+), 20 deletions(-)

             error = request.GET['error']
             error_dict = self.errors.get(error, {})
             level = error_dict.get('level', logging.WARNING)
             error_description = request.GET.get('error_description', error_dict.get('error_description'))
             remote_error_description = request.GET.get('error_description')
             local_error_description = error_dict.get('error_description')
             error_description = remote_error_description or local_error_description
             error_url = request.GET.get('error_url')
             log_msg = 'auth_oidc: error received '
-...
                 log_msg += ' see %s' % error_url
             logger.log(level, log_msg)
             if error_description:
             message_params = {
                 'request_id': request.request_id,
                 'provider_name': provider and provider.name,
                 'error': error,
+            }
             if provider:
                 message = _(
                     'Login with %(provider_name)s failed, please try again later and/or report '
                     '%(request_id)s to an administrator (%(error)s)'
+                )
             else:
                 message = _(
                     'Login with OpenID Connect failed, please try again later and/or report %s to an '
                     'administrator. (%(error)s)'
+                )
             messages.warning(request, local_error_description or message % message_params)
             if remote_error_description:  # log a more precise error description for debugging purposes
                 message = _('%(error_description)s (%(error)s)') % {
                     'error_description': error_description,
                     'error_description': remote_error_description,
                     'error': error,
+                }
                 messages.add_message(request, level, message)
             else:  # unexpected error code
                 message_params = {
                     'request_id': request.request_id,
                     'provider_name': provider and provider.name,
                     'error': error,
+                }
                 if provider:
                     message = _(
                         'Login with %(provider_name)s failed, report %(request_id)s to an administrator (%(error)s)'
+                    )
                 else:
                     message = _('Login with OpenID Connect failed, report %s to an administrator. (%(error)s)')
                 messages.warning(request, message % message_params)
                 messages.debug(request, message)
             return self.continue_to_next_url(request)

     import pytest
     from django.contrib.auth import get_user_model
     from django.contrib.messages import constants as message_constants
     from django.core.exceptions import ValidationError
     from django.db import IntegrityError, transaction
     from django.http import QueryDict
     from django.test.utils import override_settings
     from django.urls import reverse
     from django.utils.encoding import force_str
     from django.utils.timezone import now, utc
-...
         assert 'denied by you or the identity provider' in caplog.records[-1].message
         assert caplog.records[-1].levelname == 'INFO'
         assert 'denied by you or the identity provider' in response.pyquery('.info').text()
         assert 'access_denied' in response
         assert 'denied by you or the identity provider' in response.pyquery('.warning').text()
         assert 'access_denied' not in response  # error code not logged in UI anymore
         response = app.get(
             login_callback_url(oidc_provider),
             params={
                 'error': 'access_denied',
                 'error_description': 'some OP technical error message',
                 'state': state,
             },
+        )
         response = response.maybe_follow()
         assert 'denied by you or the identity provider' not in caplog.records[-1].message
         assert 'some OP technical error message' in caplog.records[-1].message
         with override_settings(MESSAGE_LEVEL=message_constants.DEBUG):
             response = app.get(
                 login_callback_url(oidc_provider),
                 params={
                     'error': 'access_denied',
                     'error_description': 'some OP technical error message',
                     'state': state,
                 },
+            )
             response = response.maybe_follow()
             assert 'denied by you or the identity provider' in response.pyquery('.warning').text()
             assert 'some OP technical error message (access_denied)' in response.pyquery('.debug').text()
     def test_error_other(app, caplog, oidc_provider_jwkset):
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0001-auth_oidc-provide-a-less-scary-displayed-error-messa.patch