Author: tmckay
Date: 2012-12-06 21:18:00 +0000 (Thu, 06 Dec 2012)
New Revision: 5566
Modified:
trunk/wooly/python/wooly/__init__.py
Log:
Tweak for redirect from stale login page. Explanatory note is now displayed.
BZ850759
Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py 2012-12-06 15:03:59 UTC (rev 5565)
+++ trunk/wooly/python/wooly/__init__.py 2012-12-06 21:18:00 UTC (rev 5566)
@@ -777,26 +777,34 @@
def check_csrf(self, page):
if self.client_session.get_csrf() != self.csrf_value:
- mainpage = None
+ # For a current login, log that there may have been
+ # a possible CSRF attempt. If the client is not
+ # logged in then this is probably due to a stale login
+ # form instead.
if self.login_current():
log.info("Possible CSRF attempt using %s" % self)
- if self.app.authorizator.is_enforcing():
- try:
- p = self.app.authorizator.find_mainpage(self)
- mainpage = self.app.pages_by_name[p]
- except:
- pass
- if mainpage is None:
- mainpage = self.app.pages_by_name["index.html"]
- sess = Session(mainpage)
-
- # If we are redirecting from a stale login form
- # to the login form, add the extra notice so
- # users understand why they have to log in again
- if page == self.app.login_page and mainpage == self.app.login_page:
- self.app.login_page.login_form.login_invalid.set(sess, "form")
-
+ # If we are currently on the login page,redirect
+ # back to the login page instead of the mainpage
+ # with a notice explaining the need to login in again.
+ # If we go to the mainpage we will lose the warning
+ # because the 'login_invalid' parameter is only a page
+ # parameter for the login_page and will not be rendered
+ # in the url for other pages.
+ if page == self.app.login_page:
+ sess = Session(page)
+ page.login_form.login_invalid.set(sess, "form")
+ else:
+ mainpage = None
+ if self.app.authorizator.is_enforcing():
+ try:
+ p = self.app.authorizator.find_mainpage(self)
+ mainpage = self.app.pages_by_name[p]
+ except:
+ pass
+ if mainpage is None:
+ mainpage = self.app.pages_by_name["index.html"]
+ sess = Session(mainpage)
page.redirect.set(self, sess.marshal())
raise PageRedirect()
@@ -1017,8 +1025,15 @@
self.timestamp = datetime.now() #may want a superclass since this is duplicated
in TaskInvocation
def get_message(self, session):
- timestamp = "%s-%02d-%02d %02d:%02d:%02d" % (self.timestamp.year,
self.timestamp.month, self.timestamp.day, self.timestamp.hour, self.timestamp.minute,
self.timestamp.second)
- return "<span class='notification_time'>%s</span> %s:
%s" % (timestamp, self.preamble, self.message)
+ timestamp = "%s-%02d-%02d %02d:%02d:%02d" % (self.timestamp.year,
+ self.timestamp.month,
+ self.timestamp.day,
+ self.timestamp.hour,
+ self.timestamp.minute,
+ self.timestamp.second)
+ return "<span class='notification_time'>%s</span> %s:
%s" % (timestamp,
+ self.preamble,
+ self.message)
class SessionAttribute(object):
def __init__(self, widget, name):
Show replies by date