make cookie based login more robust (#93)

The login did not work when `came_from` request parameter was missing.

The user now gets redirected to the parent of `acl_users`,
i.e. to the root of the subhierarchy dominated by the user folder.

CHANGES.rst

@@ -5,6 +5,10 @@ Change Log
 ------------------
 - Changed adding object gui to modal window
 
+- Handle login issues for cookie based login when ``came_from`` is missing
+  (`#65
+  <https://github.com/zopefoundation/Products.PluggableAuthService/issues/65>`_)
+
 2.6.2 (2021-03-12)
 -------------------
 

src/Products/PluggableAuthService/plugins/CookieAuthHelper.py

@@ -32,6 +32,8 @@
 from AccessControl.class_init import InitializeClass
 from AccessControl.Permissions import view
 from AccessControl.SecurityInfo import ClassSecurityInfo
+from Acquisition import aq_inner
+from Acquisition import aq_parent
 from OFS.Folder import Folder
 from Products.PageTemplates.PageTemplateFile import PageTemplateFile
 from Products.PageTemplates.ZopePageTemplate import ZopePageTemplate
@@ -275,10 +277,15 @@ def login(self):
 
         if pas_instance is not None:
             pas_instance.updateCredentials(request, response, login, password)
-
-        came_from = url_local(request.form['came_from'])
-
-        return response.redirect(came_from)
+        came_from = request.form.get('came_from')
+        if came_from is not None:
+            return response.redirect(url_local(came_from))
+        # When this happens, this either means
+        # - the administrator did not setup the login form properly
+        # - the user manipulated the login form and removed `came_from`
+        # Still, the user provided correct credentials and is logged in.
+        pas_root = aq_parent(aq_inner(self._getPAS()))
+        return response.redirect(pas_root.absolute_url())
 
 
 classImplements(CookieAuthHelper, ICookieAuthHelper,

src/Products/PluggableAuthService/plugins/tests/test_CookieAuthHelper.py

@@ -21,6 +21,8 @@
 
 import six
 
+from ...interfaces.plugins import IChallengePlugin
+from ...tests import pastc
 from ...tests.conformance import IChallengePlugin_conformance
 from ...tests.conformance import ICredentialsResetPlugin_conformance
 from ...tests.conformance import ICredentialsUpdatePlugin_conformance
@@ -258,3 +260,28 @@ def test_extractCredentials_from_cookie_with_bad_binascii(self):
         request.set(helper.cookie_name, cookie_val)
 
         self.assertEqual(helper.extractCredentials(request), {})
+
+
+class CookieAuthHelperIntegrationTests(pastc.PASTestCase):
+
+    def test_login_with_missing_came_from(self):
+        pas = self.folder.acl_users
+        factory = pas.manage_addProduct['PluggableAuthService']
+        factory.addCookieAuthHelper('cookie_auth')
+        plugins = pas.plugins
+        plugins.activatePlugin(IChallengePlugin, 'cookie_auth')
+
+        response = FauxCookieResponse()
+        request = FauxSettableRequest(RESPONSE=response)
+
+        # find cookie auth
+        for id_, plugin in pas.plugins.items():
+            if id_ == 'cookie_auth':
+                cookie_auth = plugin
+                break
+
+        cookie_auth.REQUEST = request
+        cookie_auth.login()
+
+        self.assertEqual(
+            response.headers['Location'], 'http://nohost/test_folder_1_')