X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=roundup%2Fcgi_client.py;h=f1e960e91ed8902a9bf1e8434438aef7e9df7227;hb=539767b70b0d7fc4553c0037cb3f551bb0c6b1ee;hp=c565c546d0823757bb23b5fe952cee1ad106c61b;hpb=27e2c6ec318fec6ad7d874b0ee17ff460b5e33e0;p=roundup.git diff --git a/roundup/cgi_client.py b/roundup/cgi_client.py index c565c54..f1e960e 100644 --- a/roundup/cgi_client.py +++ b/roundup/cgi_client.py @@ -15,7 +15,7 @@ # BASIS, AND THERE IS NO OBLIGATION WHATSOEVER TO PROVIDE MAINTENANCE, # SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS. # -# $Id: cgi_client.py,v 1.49 2001-11-04 03:07:12 richard Exp $ +# $Id: cgi_client.py,v 1.54 2001-11-07 01:16:12 richard Exp $ import os, cgi, pprint, StringIO, urlparse, re, traceback, mimetypes import binascii, Cookie, time @@ -61,7 +61,11 @@ class Client: self.form = cgi.FieldStorage(environ=env) self.headers_done = 0 - self.debug = 0 + try: + self.debug = int(env.get("ROUNDUP_DEBUG", 0)) + except ValueError: + # someone gave us a non-int debug level, turn it off + self.debug = 0 def getuid(self): return self.db.user.lookup(self.user) @@ -76,6 +80,8 @@ class Client: self.request.send_header(*entry) self.request.end_headers() self.headers_done = 1 + if self.debug: + self.headers_sent = headers def pagehead(self, title, message=None): url = self.env['SCRIPT_NAME'] + '/' @@ -140,14 +146,23 @@ class Client: if keys: self.write('
Form entries
') for k in self.form.keys(): - v = str(self.form[k].value) - self.write('
%s:%s
'%(k, cgi.escape(v))) + v = self.form.getvalue(k, "") + if type(v) is type([]): + # Multiple username fields specified + v = "|".join(v) + self.write('
%s=%s
'%(k, cgi.escape(v))) + keys = self.headers_sent.keys() + keys.sort() + self.write('
Sent these HTTP headers
') + for k in keys: + v = self.headers_sent[k] + self.write('
%s=%s
'%(k, cgi.escape(v))) keys = self.env.keys() keys.sort() self.write('
CGI environment
') for k in keys: v = self.env[k] - self.write('
%s:%s
'%(k, cgi.escape(v))) + self.write('
%s=%s
'%(k, cgi.escape(v))) self.write('') self.write('') @@ -571,7 +586,7 @@ class Client: else: raise Unauthorised - def login(self, message=None): + def login(self, message=None, newuser_form=None): self.pagehead('Login to roundup', message) self.write(''' @@ -589,30 +604,35 @@ class Client: self.write('
') self.pagefoot() return + values = {'realname': '', 'organisation': '', 'address': '', + 'phone': '', 'username': '', 'password': '', 'confirm': ''} + if newuser_form is not None: + for key in newuser_form.keys(): + values[key] = newuser_form[key].value self.write('''

New User Registration marked items are optional...

Name: - + Organisation: - + E-Mail Address: - + Phone: - + Preferred Login name: - + Password: - + Password Again: - +
-''') +'''%values) self.pagefoot() def login_action(self, message=None): @@ -643,9 +663,15 @@ class Client: def set_cookie(self, user, password): # construct the cookie user = binascii.b2a_base64('%s:%s'%(user, password)).strip() + if user[-1] == '=': + if user[-2] == '=': + user = user[:-2] + else: + user = user[:-1] + expire = Cookie._getdate(86400*365) path = '/'.join((self.env['SCRIPT_NAME'], self.env['INSTANCE_NAME'])) - self.header({'Set-Cookie': 'roundup_user="%s"; Path="%s";'%(user, - path)}) + self.header({'Set-Cookie': 'roundup_user=%s; expires=%s; Path=%s;' % ( + user, expire, path)}) def make_user_anonymous(self): # make us anonymous if we can @@ -661,7 +687,7 @@ class Client: now = Cookie._getdate() path = '/'.join((self.env['SCRIPT_NAME'], self.env['INSTANCE_NAME'])) self.header({'Set-Cookie': - 'roundup_user=deleted; Max-Age=0; expires="%s"; Path="%s";'%(now, + 'roundup_user=deleted; Max-Age=0; expires=%s; Path=%s;'%(now, path)}) return self.login() @@ -674,12 +700,15 @@ class Client: self.db = self.instance.open('admin') # TODO: pre-check the required fields and username key property - cl = self.db.classes['user'] - props, dummy = parsePropsFromForm(self.db, cl, self.form) - uid = cl.create(**props) - self.user = self.db.user.get(uid, 'username') - password = self.db.user.get(uid, 'password') - self.set_cookie(self.user, password) + cl = self.db.user + try: + props, dummy = parsePropsFromForm(self.db, cl, self.form) + uid = cl.create(**props) + except ValueError, message: + return self.login(message, newuser_form=self.form) + self.user = cl.get(uid, 'username') + password = cl.get(uid, 'password') + self.set_cookie(self.user, self.form['password'].value) return self.index() def main(self, dre=re.compile(r'([^\d]+)(\d+)'), @@ -692,6 +721,8 @@ class Client: if (cookie.has_key('roundup_user') and cookie['roundup_user'].value != 'deleted'): cookie = cookie['roundup_user'].value + if len(cookie)%4: + cookie = cookie + '='*(4-len(cookie)%4) user, password = binascii.a2b_base64(cookie).split(':') # make sure the user exists try: @@ -919,6 +950,31 @@ def parsePropsFromForm(db, cl, form, nodeid=0): # # $Log: not supported by cvs2svn $ +# Revision 1.53 2001/11/06 23:22:05 jhermann +# More IE fixes: it does not like quotes around cookie values; in the +# hope this does not break anything for other browser; if it does, we +# need to check HTTP_USER_AGENT +# +# Revision 1.52 2001/11/06 23:11:22 jhermann +# Fixed debug output in page footer; added expiry date to the login cookie +# (expires 1 year in the future) to prevent probs with certain versions +# of IE +# +# Revision 1.51 2001/11/06 22:00:34 jhermann +# Get debug level from ROUNDUP_DEBUG env var +# +# Revision 1.50 2001/11/05 23:45:40 richard +# Fixed newuser_action so it sets the cookie with the unencrypted password. +# Also made it present nicer error messages (not tracebacks). +# +# Revision 1.49 2001/11/04 03:07:12 richard +# Fixed various cookie-related bugs: +# . bug #477685 ] base64.decodestring breaks +# . bug #477837 ] lynx does not like the cookie +# . bug #477892 ] Password edit doesn't fix login cookie +# Also closed a security hole - a logged-in user could edit another user's +# details. +# # Revision 1.48 2001/11/03 01:30:18 richard # Oops. uses pagefoot now. #