Commit 01bdcdba authored by Georgios D. Tsoukalas's avatar Georgios D. Tsoukalas
Browse files

Merge branch 'feature-api-csrf-exempt' into develop

parents 1dd208f7 89356126
*.db
*.egg
*.tar.gz
*.pyc
*~
*.*.swp
......
......@@ -36,6 +36,7 @@ from django.conf import settings
from snf_django.lib.api.proxy import proxy
from snf_django.lib.api.utils import prefix_pattern
from snf_django.utils.urls import extend_with_root_redirects
from snf_django.lib.api.urls import api_patterns
from synnefo.cyclades_settings import (
BASE_URL, BASE_HOST, BASE_PATH, COMPUTE_PREFIX, VMAPI_PREFIX,
PLANKTON_PREFIX, HELPDESK_PREFIX, UI_PREFIX, ASTAKOS_BASE_URL,
......@@ -50,15 +51,18 @@ from functools import partial
astakos_proxy = partial(proxy, proxy_base=BASE_ASTAKOS_PROXY_PATH,
target_base=ASTAKOS_BASE_URL)
cyclades_patterns = patterns('',
(prefix_pattern(UI_PREFIX), include('synnefo.ui.urls')),
cyclades_patterns = api_patterns('',
(prefix_pattern(VMAPI_PREFIX), include('synnefo.vmapi.urls')),
(prefix_pattern(PLANKTON_PREFIX), include('synnefo.plankton.urls')),
(prefix_pattern(HELPDESK_PREFIX), include('synnefo.helpdesk.urls')),
(prefix_pattern(COMPUTE_PREFIX), include('synnefo.api.urls')),
(prefix_pattern(USERDATA_PREFIX), include('synnefo.userdata.urls')),
)
cyclades_patterns += patterns('',
(prefix_pattern(UI_PREFIX), include('synnefo.ui.urls')),
(prefix_pattern(HELPDESK_PREFIX), include('synnefo.helpdesk.urls')),
)
urlpatterns = patterns(
'',
(prefix_pattern(BASE_PATH), include(cyclades_patterns)),
......@@ -68,12 +72,14 @@ if PROXY_USER_SERVICES:
astakos_proxy = partial(proxy, proxy_base=BASE_ASTAKOS_PROXY_PATH,
target_base=ASTAKOS_BASE_URL)
proxy_patterns = patterns(
proxy_patterns = patterns('',
(prefix_pattern(ASTAKOS_VIEWS_PREFIX), astakos_proxy),
)
proxy_patterns += api_patterns(
'',
(r'^login/?$', astakos_proxy),
(r'^feedback/?$', astakos_proxy),
(r'^user_catalogs/?$', astakos_proxy),
(prefix_pattern(ASTAKOS_VIEWS_PREFIX), astakos_proxy),
(prefix_pattern(ASTAKOS_ACCOUNTS_PREFIX), astakos_proxy),
)
......
......@@ -41,6 +41,7 @@ from django.http import HttpResponse
from django.utils import cache
from django.utils import simplejson as json
from django.template.loader import render_to_string
from django.views.decorators import csrf
from astakosclient import AstakosClient
from astakosclient.errors import AstakosClientException
......@@ -118,7 +119,7 @@ def api_method(http_method=None, token_required=True, user_required=True,
logger.exception("Unexpected ERROR")
fault = faults.InternalServerError("Unexpected error")
return render_fault(request, fault)
return wrapper
return csrf.csrf_exempt(wrapper)
return decorator
......
# Copyright 2012, 2013 GRNET S.A. All rights reserved.
#
# Redistribution and use in source and binary forms, with or
# without modification, are permitted provided that the following
# conditions are met:
#
# 1. Redistributions of source code must retain the above
# copyright notice, this list of conditions and the following
# disclaimer.
#
# 2. Redistributions in binary form must reproduce the above
# copyright notice, this list of conditions and the following
# disclaimer in the documentation and/or other materials
# provided with the distribution.
#
# THIS SOFTWARE IS PROVIDED BY GRNET S.A. ``AS IS'' AND ANY EXPRESS
# OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL GRNET S.A OR
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
# USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
# AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
# ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
# POSSIBILITY OF SUCH DAMAGE.
#
# The views and conclusions contained in the software and
# documentation are those of the authors and should not be
# interpreted as representing official policies, either expressed
# or implied, of GRNET S.A.
from django.core import urlresolvers
from django.views.decorators import csrf
from django.conf.urls.defaults import patterns
def _patch_pattern(regex_pattern):
"""
Patch pattern callback using csrf_exempt. Enforce
RegexURLPattern callback to get resolved if required.
"""
if not regex_pattern._callback:
# enforce _callback resolving
regex_pattern._get_callback()
regex_pattern._callback = \
csrf.csrf_exempt(regex_pattern._callback)
def _patch_resolver(r):
"""
Patch all patterns found in resolver with _patch_pattern
"""
if hasattr(r, '_get_url_patterns'):
entries = r._get_url_patterns()
else:
# first level view in patterns ?
entries = [r]
for entry in entries:
if isinstance(entry, urlresolvers.RegexURLResolver):
_patch_resolver(entry)
#if isinstance(entry, urlresolvers.RegexURLPattern):
# let it break...
else:
_patch_pattern(entry)
def api_patterns(*args, **kwargs):
"""
Protect all url patterns from csrf attacks.
"""
_patterns = patterns(*args, **kwargs)
for entry in _patterns:
_patch_resolver(entry)
return _patterns
......@@ -35,6 +35,7 @@ from functools import partial
from django.conf.urls.defaults import include, patterns
from snf_django.lib.api.proxy import proxy
from snf_django.lib.api.utils import prefix_pattern
from snf_django.lib.api.urls import api_patterns
from pithos.api.settings import (
BASE_PATH, ASTAKOS_BASE_URL, BASE_ASTAKOS_PROXY_PATH,
ASTAKOS_ACCOUNTS_PREFIX, PROXY_USER_SERVICES,
......@@ -43,7 +44,7 @@ from urlparse import urlparse
# TODO: This only works when in this order.
pithos_api_patterns = patterns(
pithos_api_patterns = api_patterns(
'pithos.api.functions',
(r'^$', 'top_demux'),
(r'^(?P<v_account>.+?)/(?P<v_container>.+?)/(?P<v_object>.+?)$',
......@@ -67,8 +68,8 @@ urlpatterns = patterns(
if PROXY_USER_SERVICES:
astakos_proxy = partial(proxy, proxy_base=BASE_ASTAKOS_PROXY_PATH,
target_base=ASTAKOS_BASE_URL)
proxy_patterns = patterns(
proxy_patterns = api_patterns(
'',
(r'^login/?$', astakos_proxy),
(r'^feedback/?$', astakos_proxy),
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment