Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
D
douban-api-proxy
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
captainwong
douban-api-proxy
Commits
a63baa17
Commit
a63baa17
authored
Jul 30, 2021
by
Ozzie Isaacs
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
better logged in session protection
parent
e245a147
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
with
492 additions
and
2123 deletions
+492
-2123
admin.py
cps/admin.py
+4
-0
ub.py
cps/ub.py
+44
-1
usermanagement.py
cps/usermanagement.py
+3
-1
web.py
cps/web.py
+1
-4
Calibre-Web TestSummary_Linux.html
test/Calibre-Web TestSummary_Linux.html
+440
-2117
No files found.
cps/admin.py
View file @
a63baa17
...
...
@@ -34,6 +34,7 @@ from babel.dates import format_datetime
from
flask
import
Blueprint
,
flash
,
redirect
,
url_for
,
abort
,
request
,
make_response
,
send_from_directory
,
g
,
Response
from
flask_login
import
login_required
,
current_user
,
logout_user
,
confirm_login
from
flask_babel
import
gettext
as
_
from
flask
import
session
as
flask_session
from
sqlalchemy
import
and_
from
sqlalchemy.orm.attributes
import
flag_modified
from
sqlalchemy.exc
import
IntegrityError
,
OperationalError
,
InvalidRequestError
...
...
@@ -98,8 +99,11 @@ def admin_required(f):
@
admi
.
before_app_request
def
before_request
():
# make remember me function work
if
current_user
.
is_authenticated
:
confirm_login
()
if
not
ub
.
check_user_session
(
current_user
.
id
,
flask_session
.
get
(
'_id'
))
and
'opds'
not
in
request
.
path
:
logout_user
()
g
.
constants
=
constants
g
.
user
=
current_user
g
.
allow_registration
=
config
.
config_public_reg
...
...
cps/ub.py
View file @
a63baa17
...
...
@@ -27,6 +27,8 @@ from flask import session as flask_session
from
binascii
import
hexlify
from
flask_login
import
AnonymousUserMixin
,
current_user
from
flask_login
import
user_logged_in
from
contextlib
import
contextmanager
try
:
from
flask_dance.consumer.backend.sqla
import
OAuthConsumerMixin
...
...
@@ -61,6 +63,36 @@ Base = declarative_base()
searched_ids
=
{}
def
signal_store_user_session
(
object
,
user
):
store_user_session
()
def
store_user_session
():
if
flask_session
.
get
(
'_user_id'
,
""
):
try
:
if
not
check_user_session
(
flask_session
.
get
(
'_user_id'
,
""
),
flask_session
.
get
(
'_id'
,
""
)):
user_session
=
User_Sessions
(
flask_session
.
get
(
'_user_id'
,
""
),
flask_session
.
get
(
'_id'
,
""
))
session
.
add
(
user_session
)
session
.
commit
()
except
(
exc
.
OperationalError
,
exc
.
InvalidRequestError
):
session
.
rollback
()
# log.debug(flask_session.get('_id', ""))
def
delete_user_session
(
user_id
,
session_key
):
try
:
# log.debug(session_key)
session
.
query
(
User_Sessions
)
.
filter
(
User_Sessions
.
user_id
==
user_id
,
User_Sessions
.
session_key
==
session_key
)
.
delete
()
session
.
commit
()
except
(
exc
.
OperationalError
,
exc
.
InvalidRequestError
):
session
.
rollback
()
def
check_user_session
(
user_id
,
session_key
):
return
bool
(
session
.
query
(
User_Sessions
)
.
filter
(
User_Sessions
.
user_id
==
user_id
,
User_Sessions
.
session_key
==
session_key
)
.
one_or_none
())
user_logged_in
.
connect
(
signal_store_user_session
)
def
store_ids
(
result
):
ids
=
list
()
for
element
in
result
:
...
...
@@ -72,7 +104,7 @@ class UserBase:
@
property
def
is_authenticated
(
self
):
return
Tru
e
return
self
.
is_activ
e
def
_has_role
(
self
,
role_flag
):
return
constants
.
has_flag
(
self
.
role
,
role_flag
)
...
...
@@ -261,6 +293,17 @@ class Anonymous(AnonymousUserMixin, UserBase):
flask_session
[
'view'
][
page
][
prop
]
=
value
return
None
class
User_Sessions
(
Base
):
__tablename__
=
'user_session'
id
=
Column
(
Integer
,
primary_key
=
True
)
user_id
=
Column
(
Integer
,
ForeignKey
(
'user.id'
))
session_key
=
Column
(
String
,
default
=
""
)
def
__init__
(
self
,
user_id
,
session_key
):
self
.
user_id
=
user_id
self
.
session_key
=
session_key
# Baseclass representing Shelfs in calibre-web in app.db
class
Shelf
(
Base
):
...
...
cps/usermanagement.py
View file @
a63baa17
...
...
@@ -21,7 +21,8 @@ import binascii
from
sqlalchemy.sql.expression
import
func
from
werkzeug.security
import
check_password_hash
from
flask_login
import
login_required
from
flask_login
import
login_required
,
login_user
from
.
import
lm
,
ub
,
config
,
constants
,
services
...
...
@@ -58,6 +59,7 @@ def load_user_from_request(request):
if
rp_header_username
:
user
=
_fetch_user_by_name
(
rp_header_username
)
if
user
:
login_user
(
user
)
return
user
auth_header
=
request
.
headers
.
get
(
"Authorization"
)
...
...
cps/web.py
View file @
a63baa17
...
...
@@ -1523,7 +1523,6 @@ def login():
login_result
,
error
=
services
.
ldap
.
bind_user
(
form
[
'username'
],
form
[
'password'
])
if
login_result
:
login_user
(
user
,
remember
=
bool
(
form
.
get
(
'remember_me'
)))
#ub.store_user_session()
log
.
debug
(
u"You are now logged in as: '
%
s'"
,
user
.
name
)
flash
(
_
(
u"you are now logged in as: '
%(nickname)
s'"
,
nickname
=
user
.
name
),
category
=
"success"
)
...
...
@@ -1531,7 +1530,6 @@ def login():
elif
login_result
is
None
and
user
and
check_password_hash
(
str
(
user
.
password
),
form
[
'password'
])
\
and
user
.
name
!=
"Guest"
:
login_user
(
user
,
remember
=
bool
(
form
.
get
(
'remember_me'
)))
#ub.store_user_session()
log
.
info
(
"Local Fallback Login as: '
%
s'"
,
user
.
name
)
flash
(
_
(
u"Fallback Login as: '
%(nickname)
s', LDAP Server not reachable, or user not known"
,
nickname
=
user
.
name
),
...
...
@@ -1561,7 +1559,6 @@ def login():
else
:
if
user
and
check_password_hash
(
str
(
user
.
password
),
form
[
'password'
])
and
user
.
name
!=
"Guest"
:
login_user
(
user
,
remember
=
bool
(
form
.
get
(
'remember_me'
)))
# ub.store_user_session()
log
.
debug
(
u"You are now logged in as: '
%
s'"
,
user
.
name
)
flash
(
_
(
u"You are now logged in as: '
%(nickname)
s'"
,
nickname
=
user
.
name
),
category
=
"success"
)
config
.
config_is_initial
=
False
...
...
@@ -1585,7 +1582,7 @@ def login():
@
login_required
def
logout
():
if
current_user
is
not
None
and
current_user
.
is_authenticated
:
#
ub.delete_user_session(current_user.id, flask_session.get('_id',""))
ub
.
delete_user_session
(
current_user
.
id
,
flask_session
.
get
(
'_id'
,
""
))
logout_user
()
if
feature_support
[
'oauth'
]
and
(
config
.
config_login_type
==
2
or
config
.
config_login_type
==
3
):
logout_oauth_user
()
...
...
test/Calibre-Web TestSummary_Linux.html
View file @
a63baa17
This source diff could not be displayed because it is too large. You can
view the blob
instead.
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment