1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
|
# -*- coding: utf-8 -*-
#
# Copyright (C) 2009 Ignacio Vazquez-Abrams
# Copyright (C) 2012 Red Hat, Inc
# This file is part of python-fedora
#
# python-fedora is free software; you can redistribute it and/or
# modify it under the terms of the GNU Lesser General Public
# License as published by the Free Software Foundation; either
# version 2.1 of the License, or (at your option) any later version.
#
# python-fedora is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
# Lesser General Public License for more details.
#
# You should have received a copy of the GNU Lesser General Public
# License along with python-fedora; if not, see <http://www.gnu.org/licenses/>
#
'''
.. moduleauthor:: Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
.. moduleauthor:: Toshio Kuratomi <toshio@fedoraproject.org>
.. note:: Toshio only added httponly cookie support
.. versionchanged:: 0.3.26
Made session cookies httponly
'''
from fedora.client import AuthError
import django
from django.contrib.auth import authenticate, login, logout
from django.contrib.auth.models import AnonymousUser
class FasMiddleware(object):
def process_request(self, request):
# Retrieve the sessionid that the user gave, associating them with the
# account system session
sid = request.COOKIES.get('tg-visit', None)
# Check if the session is still valid
authenticated = False
if sid:
user = authenticate(session_id=sid)
if user:
try:
login(request, user)
authenticated = True
except AuthError:
pass
if not authenticated:
# Hack around misthought out djiblits/django interaction;
# If we're logging in in django and get to here without having
# the second factor of authentication, we need to logout the
# django kept session information. Since we can't know precisely
# what private information django might be keeping we need to use
# django API to remove everything. However, djiblits requires the
# request.session.test_cookie_worked() function in order to log
# someone in later. The django logout function has removed that
# function from the session attribute so the djiblit login fails.
#
# Save the necessary pieces of the session architecture here
cookie_status = request.session.test_cookie_worked()
logout(request)
# python doesn't have closures
if cookie_status:
request.session.test_cookie_worked = lambda: True
else:
request.session.test_cookie_worked = lambda: False
request.session.delete_test_cookie = lambda: None
def process_response(self, request, response):
if response.status_code != 301:
if isinstance(request.user, AnonymousUser):
response.set_cookie(key='tg-visit', value='', max_age=0)
if 'tg-visit' in request.session:
del request.session['tg-visit']
else:
try:
if django.VERSION[:2] <= (1, 3):
response.set_cookie(
'tg-visit',
request.user.session_id, max_age=1814400,
path='/', secure=True)
else:
response.set_cookie(
'tg-visit',
request.user.session_id, max_age=1814400,
path='/', secure=True, httponly=True)
except AttributeError:
# We expect that request.user.session_id won't be set
# if the user is logging in with a non-FAS account
# (ie: Django local auth).
pass
return response
|
