haiwen/seahub
1
0
Fork 0
mirror of https://github.com/haiwen/seahub.git synced 2025-09-06 17:33:18 +00:00
Code Issues Releases Wiki Activity

do not update sudo mode ts if loggin in from client

Browse Source
This commit is contained in:
Shuai Lin
2015-05-06 14:39:14 +08:00
parent 89bff04eb8
commit 6f5b329f65
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
seahub/base/sudo_mode.py
View File

@@ -24,7 +24,7 @@ def update_sudo_mode_ts(request):
def update_sudo_ts_when_login(**kwargs): def update_sudo_ts_when_login(**kwargs):
request = kwargs['request'] request = kwargs['request']
if request.user.is_staff: if request.user.is_staff and not getattr(request, 'client_token_login', False):
update_sudo_mode_ts(request) update_sudo_mode_ts(request)
if ENABLE_SUDO_MODE: if ENABLE_SUDO_MODE:

1
seahub/views/__init__.py
View File

@@ -2115,6 +2115,7 @@ def client_token_login(request):
if request.user.is_authenticated() and request.user.username == user.username: if request.user.is_authenticated() and request.user.username == user.username:
pass pass
else: else:
request.client_token_login = True
auth_login(request, user) auth_login(request, user)
return HttpResponseRedirect(request.GET.get("next", reverse('libraries'))) return HttpResponseRedirect(request.GET.get("next", reverse('libraries')))

11
tests/api/test_auth.py
View File

@@ -77,6 +77,12 @@ class AuthTest(ApiTestBase):
r = requests.get(url) r = requests.get(url)
assert r.url == urljoin(BASE_URL, '/profile/') assert r.url == urljoin(BASE_URL, '/profile/')
def test_client_login_token_wont_enter_sudo_mode(self):
url = self._get_client_login_url(admin=True)
url += '&next=/sys/useradmin'
r = requests.get(url)
assert r.url == urljoin(BASE_URL, '/sys/sudo/?next=/sys/useradmin/')
def _desktop_login(self): def _desktop_login(self):
data = { data = {
'username': USERNAME, 'username': USERNAME,
@@ -106,7 +112,8 @@ class AuthTest(ApiTestBase):
def _logout(self, token): def _logout(self, token):
self.post(LOGOUT_DEVICE_URL, token=token) self.post(LOGOUT_DEVICE_URL, token=token)
def _get_client_login_url(self): def _get_client_login_url(self, admin=False):
token = self.post(CLIENT_LOGIN_TOKEN_URL).json()['token'] post = self.admin_post if admin else self.post
token = post(CLIENT_LOGIN_TOKEN_URL).json()['token']
assert len(token) == 32 assert len(token) == 32
return urljoin(BASE_URL, 'client-login/') + '?token=' + token return urljoin(BASE_URL, 'client-login/') + '?token=' + token