From 7e0972bded362bc4b851c109df2c8a6548481a8e Mon Sep 17 00:00:00 2001 From: Jacob Kaplan-Moss Date: Tue, 2 Sep 2008 21:10:00 +0000 Subject: [PATCH] Security fix. Announcement forthcoming. git-svn-id: http://code.djangoproject.com/svn/django/branches/0.96-bugfixes@8877 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- .../contrib/admin/templates/admin/login.html | 1 - django/contrib/admin/views/decorators.py | 42 ++----------------- 2 files changed, 3 insertions(+), 40 deletions(-) diff --git a/django/contrib/admin/templates/admin/login.html b/django/contrib/admin/templates/admin/login.html index 0773132cec191..eab80017fe04c 100644 --- a/django/contrib/admin/templates/admin/login.html +++ b/django/contrib/admin/templates/admin/login.html @@ -19,7 +19,6 @@
- {#{% trans 'Have you forgotten your password?' %}#}
diff --git a/django/contrib/admin/views/decorators.py b/django/contrib/admin/views/decorators.py index 9e8e485b8581c..e68ac1be6f908 100644 --- a/django/contrib/admin/views/decorators.py +++ b/django/contrib/admin/views/decorators.py @@ -5,42 +5,19 @@ from django.shortcuts import render_to_response from django.utils.html import escape from django.utils.translation import gettext_lazy -import base64, datetime, md5 -import cPickle as pickle +import base64, datetime ERROR_MESSAGE = gettext_lazy("Please enter a correct username and password. Note that both fields are case-sensitive.") LOGIN_FORM_KEY = 'this_is_the_login_form' def _display_login_form(request, error_message=''): request.session.set_test_cookie() - if request.POST and request.POST.has_key('post_data'): - # User has failed login BUT has previously saved post data. - post_data = request.POST['post_data'] - elif request.POST: - # User's session must have expired; save their post data. - post_data = _encode_post_data(request.POST) - else: - post_data = _encode_post_data({}) return render_to_response('admin/login.html', { 'title': _('Log in'), 'app_path': escape(request.path), - 'post_data': post_data, 'error_message': error_message }, context_instance=template.RequestContext(request)) -def _encode_post_data(post_data): - pickled = pickle.dumps(post_data) - pickled_md5 = md5.new(pickled + settings.SECRET_KEY).hexdigest() - return base64.encodestring(pickled + pickled_md5) - -def _decode_post_data(encoded_data): - encoded_data = base64.decodestring(encoded_data) - pickled, tamper_check = encoded_data[:-32], encoded_data[-32:] - if md5.new(pickled + settings.SECRET_KEY).hexdigest() != tamper_check: - from django.core.exceptions import SuspiciousOperation - raise SuspiciousOperation, "User may have tampered with session cookie." - return pickle.loads(pickled) - def staff_member_required(view_func): """ Decorator for views that checks that the user is logged in and is a staff @@ -49,10 +26,6 @@ def staff_member_required(view_func): def _checklogin(request, *args, **kwargs): if request.user.is_authenticated() and request.user.is_staff: # The user is valid. Continue to the admin page. - if request.POST.has_key('post_data'): - # User must have re-authenticated through a different window - # or tab. - request.POST = _decode_post_data(request.POST['post_data']) return view_func(request, *args, **kwargs) assert hasattr(request, 'session'), "The Django admin requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'." @@ -60,7 +33,7 @@ def _checklogin(request, *args, **kwargs): # If this isn't already the login page, display it. if not request.POST.has_key(LOGIN_FORM_KEY): if request.POST: - message = _("Please log in again, because your session has expired. Don't worry: Your submission has been saved.") + message = _("Please log in again, because your session has expired.") else: message = "" return _display_login_form(request, message) @@ -93,16 +66,7 @@ def _checklogin(request, *args, **kwargs): # TODO: set last_login with an event. user.last_login = datetime.datetime.now() user.save() - if request.POST.has_key('post_data'): - post_data = _decode_post_data(request.POST['post_data']) - if post_data and not post_data.has_key(LOGIN_FORM_KEY): - # overwrite request.POST with the saved post_data, and continue - request.POST = post_data - request.user = user - return view_func(request, *args, **kwargs) - else: - request.session.delete_test_cookie() - return http.HttpResponseRedirect(request.path) + return http.HttpResponseRedirect(request.path) else: return _display_login_form(request, ERROR_MESSAGE)