summaryrefslogtreecommitdiff
path: root/service/pixelated/resources
diff options
context:
space:
mode:
Diffstat (limited to 'service/pixelated/resources')
-rw-r--r--service/pixelated/resources/__init__.py10
-rw-r--r--service/pixelated/resources/auth.py31
-rw-r--r--service/pixelated/resources/inbox_resource.py56
-rw-r--r--service/pixelated/resources/login_resource.py32
-rw-r--r--service/pixelated/resources/root_resource.py120
-rw-r--r--service/pixelated/resources/session.py10
6 files changed, 147 insertions, 112 deletions
diff --git a/service/pixelated/resources/__init__.py b/service/pixelated/resources/__init__.py
index 11611f0b..023758de 100644
--- a/service/pixelated/resources/__init__.py
+++ b/service/pixelated/resources/__init__.py
@@ -13,8 +13,9 @@
#
# You should have received a copy of the GNU Affero General Public License
# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
-
+import hashlib
import json
+import os
from twisted.web.http import UNAUTHORIZED
from twisted.web.resource import Resource
@@ -26,6 +27,8 @@ from twisted.web.http import INTERNAL_SERVER_ERROR, SERVICE_UNAVAILABLE
log = Logger()
+CSRF_TOKEN_LENGTH = 32
+
class SetEncoder(json.JSONEncoder):
def default(self, obj):
@@ -62,6 +65,11 @@ class BaseResource(Resource):
Resource.__init__(self)
self._services_factory = services_factory
+ def _add_csrf_cookie(self, request):
+ csrf_token = IPixelatedSession(request.getSession()).get_csrf_token()
+ request.addCookie('XSRF-TOKEN', csrf_token)
+ log.debug('XSRF-TOKEN added: %s' % csrf_token)
+
def _get_user_id_from_request(self, request):
if self._services_factory.mode.is_single_user:
return None # it doesn't matter
diff --git a/service/pixelated/resources/auth.py b/service/pixelated/resources/auth.py
index adac985f..a2054f18 100644
--- a/service/pixelated/resources/auth.py
+++ b/service/pixelated/resources/auth.py
@@ -64,10 +64,18 @@ class SessionChecker(object):
class PixelatedRealm(object):
implements(portal.IRealm)
+ def __init__(self, authenticated_resource, public_resource):
+ self._authenticated_resource = authenticated_resource
+ self._public_resource = public_resource
+
def requestAvatar(self, avatarId, mind, *interfaces):
- if IResource in interfaces:
- return IResource, avatarId, lambda: None
- raise NotImplementedError()
+ if IResource not in interfaces:
+ raise NotImplementedError()
+ if avatarId == checkers.ANONYMOUS:
+ avatar = self._public_resource
+ else:
+ avatar = self._authenticated_resource
+ return IResource, avatar, lambda: None
@implementer(IResource)
@@ -75,7 +83,7 @@ class PixelatedAuthSessionWrapper(object):
isLeaf = False
- def __init__(self, portal, root_resource, anonymous_resource, credentialFactories):
+ def __init__(self, portal, root_resource, anonymous_resource, credentialFactories=[]):
self._portal = portal
self._credentialFactories = credentialFactories
self._root_resource = root_resource
@@ -93,23 +101,18 @@ class PixelatedAuthSessionWrapper(object):
return util.DeferredResource(self._login(creds, request))
def _login(self, credentials, request):
- pattern = re.compile("^/sandbox/")
-
def loginSucceeded(args):
interface, avatar, logout = args
- if avatar == checkers.ANONYMOUS and not pattern.match(request.path):
- return self._anonymous_resource
- else:
- return self._root_resource
+ # TODO: make sandbox public
+ return avatar
def loginFailed(result):
if result.check(error.Unauthorized, error.LoginFailed):
return UnauthorizedResource(self._credentialFactories)
else:
- log.err(
- result,
- "HTTPAuthSessionWrapper.getChildWithDefault encountered "
- "unexpected error")
+ log.error(
+ "PixelatedAuthSessionWrapper.getChildWithDefault encountered "
+ "unexpected error: %s" % result)
return ErrorPage(500, None, None)
d = self._portal.login(credentials, None, IResource)
diff --git a/service/pixelated/resources/inbox_resource.py b/service/pixelated/resources/inbox_resource.py
new file mode 100644
index 00000000..d0096efe
--- /dev/null
+++ b/service/pixelated/resources/inbox_resource.py
@@ -0,0 +1,56 @@
+#
+# Copyright (c) 2016 ThoughtWorks, Inc.
+#
+# Pixelated is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Pixelated is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
+import hashlib
+import os
+import pkg_resources
+from string import Template
+
+import pixelated
+from pixelated.resources import BaseResource
+
+from twisted.logger import Logger
+
+logger = Logger()
+
+
+MODE_STARTUP = 1
+MODE_RUNNING = 2
+
+
+class InboxResource(BaseResource):
+ isLeaf = True
+
+ def __init__(self, services_factory):
+ BaseResource.__init__(self, services_factory)
+ with open(pkg_resources.resource_filename('templates', 'index.html')) as f:
+ self._html_template = f.read()
+ with open(pkg_resources.resource_filename('templates', 'Interstitial.html')) as f:
+ self.interstitial = f.read()
+ self._mode = MODE_STARTUP
+
+ def initialize(self):
+ self._mode = MODE_RUNNING
+
+ def _is_starting(self):
+ return self._mode == MODE_STARTUP
+
+ def render_GET(self, request):
+ if self._is_starting():
+ return self.interstitial
+ else:
+ account_email = self.mail_service(request).account_email
+ response = Template(self._html_template).safe_substitute(account_email=account_email)
+ return str(response)
diff --git a/service/pixelated/resources/login_resource.py b/service/pixelated/resources/login_resource.py
index ed0cb54e..9bb771df 100644
--- a/service/pixelated/resources/login_resource.py
+++ b/service/pixelated/resources/login_resource.py
@@ -15,6 +15,7 @@
# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
import os
+import pkg_resources
from xml.sax import SAXParseException
from pixelated.authentication import Authenticator
@@ -34,22 +35,6 @@ from twisted.web.template import Element, XMLFile, renderElement, renderer
log = Logger()
-def _get_startup_folder():
- path = os.path.dirname(os.path.abspath(__file__))
- return os.path.join(path, '..', 'assets')
-
-
-def _get_static_folder():
- static_folder = os.path.abspath(os.path.join(os.path.abspath(__file__), "..", "..", "..", "web-ui", "app"))
- # this is a workaround for packaging
- if not os.path.exists(static_folder):
- static_folder = os.path.abspath(
- os.path.join(os.path.abspath(__file__), "..", "..", "..", "..", "web-ui", "app"))
- if not os.path.exists(static_folder):
- static_folder = os.path.join('/', 'usr', 'share', 'pixelated-user-agent')
- return static_folder
-
-
def parse_accept_language(all_headers):
accepted_languages = ['pt-BR', 'en-US']
languages = all_headers.get('accept-language', '').split(';')[0]
@@ -60,7 +45,7 @@ def parse_accept_language(all_headers):
class DisclaimerElement(Element):
- loader = XMLFile(FilePath(os.path.join(_get_startup_folder(), '_login_disclaimer_banner.html')))
+ loader = XMLFile(FilePath(pkg_resources.resource_filename('templates', '_login_disclaimer_banner.html')))
def __init__(self, banner):
super(DisclaimerElement, self).__init__()
@@ -83,7 +68,7 @@ class DisclaimerElement(Element):
class LoginWebSite(Element):
- loader = XMLFile(FilePath(os.path.join(_get_startup_folder(), 'login.html')))
+ loader = XMLFile(FilePath(pkg_resources.resource_filename('templates', 'login.html')))
def __init__(self, error_msg=None, disclaimer_banner_file=None):
super(LoginWebSite, self).__init__()
@@ -97,6 +82,11 @@ class LoginWebSite(Element):
return tag('')
@renderer
+ def csrftoken(self, request, tag):
+ tag.fillSlots(csrftoken=IPixelatedSession(request.getSession()).get_csrf_token())
+ return tag
+
+ @renderer
def disclaimer(self, request, tag):
return DisclaimerElement(self.disclaimer_banner_file).render(request)
@@ -106,15 +96,12 @@ class LoginResource(BaseResource):
def __init__(self, services_factory, provider=None, disclaimer_banner=None, authenticator=None):
BaseResource.__init__(self, services_factory)
- self._static_folder = _get_static_folder()
- self._startup_folder = _get_startup_folder()
self._disclaimer_banner = disclaimer_banner
self._provider = provider
self._authenticator = authenticator or Authenticator(provider)
self._bootstrap_user_services = BootstrapUserServices(services_factory, provider)
- self.putChild('startup-assets', File(self._startup_folder))
- with open(os.path.join(self._startup_folder, 'Interstitial.html')) as f:
+ with open(pkg_resources.resource_filename('templates', 'Interstitial.html')) as f:
self.interstitial = f.read()
def getChild(self, path, request):
@@ -127,6 +114,7 @@ class LoginResource(BaseResource):
return NoResource()
def render_GET(self, request):
+ request.getSession()
request.setResponseCode(OK)
return self._render_template(request)
diff --git a/service/pixelated/resources/root_resource.py b/service/pixelated/resources/root_resource.py
index 8df76c70..5cc93dbe 100644
--- a/service/pixelated/resources/root_resource.py
+++ b/service/pixelated/resources/root_resource.py
@@ -13,12 +13,12 @@
#
# You should have received a copy of the GNU Affero General Public License
# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
-import hashlib
import json
import os
-from string import Template
+import pkg_resources
from pixelated.resources.users import UsersResource
+import pixelated
from pixelated.resources import BaseResource, UnAuthorizedResource, UnavailableResource
from pixelated.resources import IPixelatedSession
from pixelated.resources.attachments_resource import AttachmentsResource
@@ -33,43 +33,42 @@ from pixelated.resources.mail_resource import MailResource
from pixelated.resources.mails_resource import MailsResource
from pixelated.resources.tags_resource import TagsResource
from pixelated.resources.keys_resource import KeysResource
+from pixelated.resources.inbox_resource import InboxResource, MODE_STARTUP, MODE_RUNNING
from twisted.web.resource import NoResource
from twisted.web.static import File
+from twisted.web.util import Redirect
from twisted.logger import Logger
-log = Logger()
-
-
-CSRF_TOKEN_LENGTH = 32
-
-MODE_STARTUP = 1
-MODE_RUNNING = 2
+logger = Logger()
class RootResource(BaseResource):
- def __init__(self, services_factory):
+
+ def __init__(self, services_factory, static_folder, public=False):
BaseResource.__init__(self, services_factory)
- self._startup_assets_folder = self._get_startup_folder()
- self._static_folder = self._get_static_folder()
- self._html_template = open(os.path.join(self._static_folder, 'index.html')).read()
+ self._public = public
+ self._static_folder = static_folder
self._services_factory = services_factory
- self._child_resources = ChildResourcesMap()
- with open(os.path.join(self._startup_assets_folder, 'Interstitial.html')) as f:
+ with open(pkg_resources.resource_filename('templates', 'Interstitial.html')) as f:
self.interstitial = f.read()
+ self._redirect_to_login_resource = Redirect('login')
+ self._inbox_resource = InboxResource(services_factory)
self._startup_mode()
def _startup_mode(self):
- self.putChild('startup-assets', File(self._startup_assets_folder))
+ self.putChildPublic('static', File(self._static_folder))
self._mode = MODE_STARTUP
+ logger.debug('Root in STARTUP mode. %s' % self)
- def getChild(self, path, request):
+ def getChildWithDefault(self, path, request):
+ self._add_csrf_cookie(request)
if path == '':
- return self
+ return self._redirect_to_login_resource if self._public else self._inbox_resource
if self._mode == MODE_STARTUP:
return UnavailableResource()
if self._is_xsrf_valid(request):
- return self._child_resources.get(path)
+ return BaseResource.getChildWithDefault(self, path, request)
return UnAuthorizedResource()
def _is_xsrf_valid(self, request):
@@ -78,6 +77,7 @@ class RootResource(BaseResource):
return True
xsrf_token = request.getCookie('XSRF-TOKEN')
+ logger.debug('CSRF token: %s' % xsrf_token)
ajax_request = (request.getHeader('x-requested-with') == 'XMLHttpRequest')
if ajax_request:
@@ -87,62 +87,32 @@ class RootResource(BaseResource):
csrf_input = request.args.get('csrftoken', [None])[0] or json.loads(request.content.read()).get('csrftoken', [None])[0]
return csrf_input and csrf_input == xsrf_token
- def initialize(self, provider=None, disclaimer_banner=None, authenticator=None):
- self._child_resources.add('sandbox', SandboxResource(self._static_folder))
- self._child_resources.add('assets', File(self._static_folder))
- self._child_resources.add('keys', KeysResource(self._services_factory))
- self._child_resources.add(AttachmentsResource.BASE_URL, AttachmentsResource(self._services_factory))
- self._child_resources.add('contacts', ContactsResource(self._services_factory))
- self._child_resources.add('features', FeaturesResource(provider))
- self._child_resources.add('tags', TagsResource(self._services_factory))
- self._child_resources.add('mails', MailsResource(self._services_factory))
- self._child_resources.add('mail', MailResource(self._services_factory))
- self._child_resources.add('feedback', FeedbackResource(self._services_factory))
- self._child_resources.add('user-settings', UserSettingsResource(self._services_factory))
- self._child_resources.add('users', UsersResource(self._services_factory))
- self._child_resources.add(LoginResource.BASE_URL,
- LoginResource(self._services_factory, provider, disclaimer_banner=disclaimer_banner, authenticator=authenticator))
- self._child_resources.add(LogoutResource.BASE_URL, LogoutResource(self._services_factory))
-
- self._mode = MODE_RUNNING
-
- def _get_startup_folder(self):
- path = os.path.dirname(os.path.abspath(__file__))
- return os.path.join(path, '..', 'assets')
+ def putChildPublic(self, path, resource):
+ return BaseResource.putChild(self, path, resource)
- def _get_static_folder(self):
- static_folder = os.path.abspath(os.path.join(os.path.abspath(__file__), "..", "..", "..", "web-ui", "app"))
- # this is a workaround for packaging
- if not os.path.exists(static_folder):
- static_folder = os.path.abspath(
- os.path.join(os.path.abspath(__file__), "..", "..", "..", "..", "web-ui", "app"))
- if not os.path.exists(static_folder):
- static_folder = os.path.join('/', 'usr', 'share', 'pixelated-user-agent')
- return static_folder
+ def putChildProtected(self, path, resource):
+ return BaseResource.putChild(self, path, UnAuthorizedResource() if self._public else resource)
- def _is_starting(self):
- return self._mode == MODE_STARTUP
+ def putChild(self, path, resource):
+ logger.warn('Use either `putChildPublic` or `putChildProtected` on this resource')
+ return self.putChildProtected(path, resource) # to be on the safe side
- def _add_csrf_cookie(self, request):
- csrf_token = hashlib.sha256(os.urandom(CSRF_TOKEN_LENGTH)).hexdigest()
- request.addCookie('XSRF-TOKEN', csrf_token)
-
- def render_GET(self, request):
- self._add_csrf_cookie(request)
- if self._is_starting():
- return self.interstitial
- else:
- account_email = self.mail_service(request).account_email
- response = Template(self._html_template).safe_substitute(account_email=account_email)
- return str(response)
-
-
-class ChildResourcesMap(object):
- def __init__(self):
- self._registry = {}
-
- def add(self, path, resource):
- self._registry[path] = resource
-
- def get(self, path):
- return self._registry.get(path) or NoResource()
+ def initialize(self, provider=None, disclaimer_banner=None, authenticator=None):
+ self.putChildPublic('sandbox', SandboxResource(self._static_folder))
+ self.putChildProtected('keys', KeysResource(self._services_factory))
+ self.putChildProtected(AttachmentsResource.BASE_URL, AttachmentsResource(self._services_factory))
+ self.putChildProtected('contacts', ContactsResource(self._services_factory))
+ self.putChildProtected('features', FeaturesResource(provider))
+ self.putChildProtected('tags', TagsResource(self._services_factory))
+ self.putChildProtected('mails', MailsResource(self._services_factory))
+ self.putChildProtected('mail', MailResource(self._services_factory))
+ self.putChildProtected('feedback', FeedbackResource(self._services_factory))
+ self.putChildProtected('user-settings', UserSettingsResource(self._services_factory))
+ self.putChildProtected('users', UsersResource(self._services_factory))
+ self.putChildPublic(LoginResource.BASE_URL,
+ LoginResource(self._services_factory, provider, disclaimer_banner=disclaimer_banner, authenticator=authenticator))
+ self.putChildPublic(LogoutResource.BASE_URL, LogoutResource(self._services_factory))
+
+ self._inbox_resource.initialize()
+ self._mode = MODE_RUNNING
+ logger.debug('Root in RUNNING mode. %s' % self)
diff --git a/service/pixelated/resources/session.py b/service/pixelated/resources/session.py
index 9ade8d29..0e46ad8f 100644
--- a/service/pixelated/resources/session.py
+++ b/service/pixelated/resources/session.py
@@ -13,11 +13,15 @@
#
# You should have received a copy of the GNU Affero General Public License
# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
+import hashlib
+import os
from zope.interface import Interface, Attribute, implements
from twisted.python.components import registerAdapter
from twisted.web.server import Session
+CSRF_TOKEN_LENGTH = 32
+
class IPixelatedSession(Interface):
user_uuid = Attribute('The uuid of the currently logged in user')
@@ -28,6 +32,7 @@ class PixelatedSession(object):
def __init__(self, session):
self.user_uuid = None
+ self._csrf_token = None
def is_logged_in(self):
return self.user_uuid is not None
@@ -35,5 +40,10 @@ class PixelatedSession(object):
def expire(self):
self.user_uuid = None
+ def get_csrf_token(self):
+ if self._csrf_token is None:
+ self._csrf_token = hashlib.sha256(os.urandom(CSRF_TOKEN_LENGTH)).hexdigest()
+ return self._csrf_token
+
registerAdapter(PixelatedSession, Session, IPixelatedSession)
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 06:18:31 +0000