- general security and encoding updates

geonode/geoserver/views.py

@@ -851,7 +851,7 @@ def get_capabilities(request, layerid=None, user=None,
                         'catalogue_url': settings.CATALOGUE['default']['URL'],
                     }
                     gc_str = tpl.render(ctx)
-                    gc_str = gc_str.encode("utf-8")
+                    gc_str = gc_str.encode("utf-8", "replace")
                     layerelem = etree.XML(gc_str)
                     rootdoc = etree.ElementTree(layerelem)
             except Exception as e:

geonode/layers/models.py

@@ -495,7 +495,7 @@ class Attribute(models.Model):
 
     def __unicode__(self):
         return "%s" % self.attribute_label.encode(
-            "utf-8") if self.attribute_label else self.attribute.encode("utf-8")
+            "utf-8", "replace") if self.attribute_label else self.attribute.encode("utf-8", "replace")
 
     def unique_values_as_list(self):
         return self.unique_values.split(',')

geonode/security/utils.py

@@ -433,7 +433,8 @@ def sync_geofence_with_guardian(layer, perms, user=None, group=None):
     """
     # Create new rule-set
     gf_services = {}
-    gf_services["*"] = 'view_resourcebase' in perms or 'change_layer_style' in perms
+    gf_services["*"] = 'download_resourcebase' in perms and \
+        ('view_resourcebase' in perms or 'change_layer_style' in perms)
     gf_services["WMS"] = 'view_resourcebase' in perms or 'change_layer_style' in perms
     gf_services["GWC"] = 'view_resourcebase' in perms or 'change_layer_style' in perms
     gf_services["WFS"] = ('download_resourcebase' in perms or 'change_layer_data' in perms) \

geonode/upload/models.py

@@ -87,7 +87,7 @@ class Meta:
 
     def get_session(self):
         if self.session:
-            return pickle.loads(str(self.session))
+            return pickle.loads(self.session.encode("utf-8", "replace"))
 
     def update_from_session(self, upload_session):
         self.state = upload_session.import_session.state
@@ -97,10 +97,10 @@ def update_from_session(self, upload_session):
             self.session = None
         else:
             # Make sure we don't pickle UTF-8 chars
-            upload_session.user.first_name = u'{}'.format(upload_session.user.first_name).encode('ascii', 'ignore')
-            upload_session.user.last_name = u'{}'.format(upload_session.user.last_name).encode('ascii', 'ignore')
+            upload_session.user.first_name = u'{}'.format(upload_session.user.first_name).decode("utf-8", "replace")
+            upload_session.user.last_name = u'{}'.format(upload_session.user.last_name).decode("utf-8", "replace")
             unicode_session = pickle.dumps(upload_session)
-            self.session = unicode_session
+            self.session = unicode_session.decode("utf-8", "replace")
         if self.upload_dir is None:
             self.upload_dir = path.dirname(upload_session.base_file)
             self.name = upload_session.layer_title or upload_session.name

geonode/upload/utils.py

@@ -523,17 +523,20 @@ def _get_layer_values(layer, upload_session, expand=0):
         lyr = inDataSource.GetLayer(str(layer.name))
         limit = 100
         for feat in islice(lyr, 0, limit):
-            feat_values = json_loads_byteified(feat.ExportToJson()).get('properties')
-            for k in feat_values.keys():
-                type_code = feat.GetFieldDefnRef(k).GetType()
-                binding = feat.GetFieldDefnRef(k).GetFieldTypeName(type_code)
-                feat_value = feat_values[k] if str(feat_values[k]) != 'None' else 0
-                if expand > 0:
-                    ff = {'value': feat_value, 'binding': binding}
-                    feat_values[k] = ff
-                else:
-                    feat_values[k] = feat_value
-            layer_values.append(feat_values)
+            try:
+                feat_values = json_loads_byteified(feat.ExportToJson()).get('properties')
+                for k in feat_values.keys():
+                    type_code = feat.GetFieldDefnRef(k).GetType()
+                    binding = feat.GetFieldDefnRef(k).GetFieldTypeName(type_code)
+                    feat_value = feat_values[k] if str(feat_values[k]) != 'None' else 0
+                    if expand > 0:
+                        ff = {'value': feat_value, 'binding': binding}
+                        feat_values[k] = ff
+                    else:
+                        feat_values[k] = feat_value
+                layer_values.append(feat_values)
+            except BaseException:
+                pass
     return layer_values
 
 

requirements.txt

@@ -31,7 +31,7 @@ awesome-slugify<=1.6.5 # python-awesome-slugify (1.6.5)
 django-floppyforms<=1.7.0 # python-django-floppyforms (1.7.0 in our ppa)
 chardet<=3.0.4 # python-chardet (3.0.4 in our ppa)
 decorator<=4.1.2 # python-decorator (4.1.2 in our ppa)
-celery==4.2.0 # python-celery (4.1.0)
+celery>4.0a0c,<=4.1.0 # python-celery (4.1.0)
 certifi<=2018.1.18 # depends on python-elasticsearch - python-certifi (2018.1.18 in our ppa)
 click==6.7 # python-click (6.7 in our ppa)
 coreapi==2.3.3 # python-coreapi (2.3.3 in our ppa)
@@ -154,7 +154,7 @@ geolinks<=0.2.0 # python-geolinks (0.2.0 in ppa)
 inflection<=0.3.1  # python-inflection (0.3.1 in our ppa)
 ipaddress<=1.0.18 # (1.0.18 in our ppa)
 jdcal<=1.3 # (1.3 in our ppa)
-kombu==4.2.1 # python-kombu (4.1.0 in our ppa)
+kombu==4.1.0 # python-kombu (4.1.0 in our ppa)
 mccabe>=0.5.3,<=0.6.1 # (0.4.0 in our ppa) FIXME
 mock<=2.0.0 # (1.3.0 in ppa) FIXME
 numpy<=1.13.1 # (1.11.0 in ppa) FIXME