Edgewall Software

Ticket #1890: 1890-firststeps.patch

File 1890-firststeps.patch, 9.4 kB (added by maxb1@…, 2 years ago)

Patch vs. trunk@3391 to fix the easy part of this issue: hide the username box for authenticated users, and make equivalent changes to the .py files so that stale templates or malicious users cannot change the behaviour.

  • templates/ticket.cs 

    Solve the easier portion of #1890 - prevent authenticated users impersonating
other users in ticket/comment/attachment/wikipage creation.

Also, hide the redundant "Your email or username:" field from authenticated
users.

* templates/attachment.cs, templates/newticket.cs, templates/ticket.cs,
  templates/wiki.cs: Only show "Your email or username:" field if not
    authenticated.

* trac/util/__init__.py (get_reporter_id): Refactor a bit.
    Add optional second argument specifying a request argument to prefer over
    session name/email information for anonymous requests.

* trac/attachment.py (AttachmentModule._do_save),
* trac/wiki/web_ui.py (WikiModule._do_save, WikiModule._render_editor),
* trac/ticket/web_ui.py (NewticketModule.process_request,
  NewticketModule._do_create, TicketModule.process_request,
  TicketModule._do_save):
    At every appropriate point, use get_reporter_id() to retrieve author
    or reporter names, thus (for authenticated requests) giving req.authname
    precedence over req.args['author' or 'reporter'].
     
    140140 <hr /> 
    141141 <h3><a name="edit" onfocus="document.getElementById('comment').focus()">Add/Change #<?cs 
    142142   var:ticket.id ?> (<?cs var:ticket.summary ?>)</a></h3> 
     143 <?cs if:trac.authname == "anonymous" ?> 
     144  <div class="field"> 
     145   <label for="author">Your email or username:</label><br /> 
     146   <input type="text" id="author" name="author" size="40" 
     147     value="<?cs var:ticket.reporter_id ?>" /><br /> 
     148  </div> 
     149 <?cs /if ?> 
    143150 <div class="field"> 
    144   <label for="author">Your email or username:</label><br /> 
    145   <input type="text" id="author" name="author" size="40" 
    146     value="<?cs var:ticket.reporter_id ?>" /><br /> 
    147  </div> 
    148  <div class="field"> 
    149151  <fieldset class="iefix"> 
    150152   <label for="comment">Comment (you may use <a tabindex="42" href="<?cs 
    151153     var:trac.href.wiki ?>/WikiFormatting">WikiFormatting</a> here):</label><br /> 

  • templates/attachment.cs

     
    1414  </div> 
    1515  <fieldset> 
    1616   <legend>Attachment Info</legend> 
     17   <?cs if:trac.authname == "anonymous" ?> 
     18    <div class="field"> 
     19     <label>Your email or username:<br /> 
     20     <input type="text" name="author" size="30" value="<?cs 
     21       var:attachment.author?>" /></label> 
     22    </div> 
     23   <?cs /if ?> 
    1724   <div class="field"> 
    18     <label>Your email or username:<br /> 
    19     <input type="text" name="author" size="30" value="<?cs 
    20       var:attachment.author?>" /></label> 
    21    </div> 
    22    <div class="field"> 
    2325    <label>Description of the file (optional):<br /> 
    2426    <input type="text" name="description" size="60" /></label> 
    2527   </div> 

  • templates/newticket.cs

     
    1111<?cs include:"site_newticket.cs" ?> 
    1212<form id="newticket" method="post" action="<?cs 
    1313  var:trac.href.newticket ?>#preview"> 
     14 <?cs if:trac.authname == "anonymous" ?> 
     15  <div class="field"> 
     16   <label for="reporter">Your email or username:</label><br /> 
     17   <input type="text" id="reporter" name="reporter" size="40" value="<?cs 
     18     var:newticket.reporter ?>" /><br /> 
     19  </div> 
     20 <?cs /if ?> 
    1421 <div class="field"> 
    15   <label for="reporter">Your email or username:</label><br /> 
    16   <input type="text" id="reporter" name="reporter" size="40" value="<?cs 
    17     var:newticket.reporter ?>" /><br /> 
    18  </div> 
    19  <div class="field"> 
    2022  <label for="summary">Short summary:</label><br /> 
    2123  <input id="summary" type="text" name="summary" size="80" value="<?cs 
    2224    var:newticket.summary ?>"/> 

  • templates/wiki.cs

     
    240240    </div> 
    241241    <fieldset id="changeinfo"> 
    242242     <legend>Change information</legend> 
     243     <?cs if:trac.authname == "anonymous" ?> 
     244      <div class="field"> 
     245       <label>Your email or username:<br /> 
     246       <input id="author" type="text" name="author" size="30" value="<?cs 
     247         var:wiki.author ?>" /></label> 
     248      </div> 
     249     <?cs /if ?> 
    243250     <div class="field"> 
    244       <label>Your email or username:<br /> 
    245       <input id="author" type="text" name="author" size="30" value="<?cs 
    246         var:wiki.author ?>" /></label> 
    247      </div> 
    248      <div class="field"> 
    249251      <label>Comment about this change (optional):<br /> 
    250252      <input id="comment" type="text" name="comment" size="60" value="<?cs 
    251253        var:wiki.comment?>" /></label> 

  • trac/attachment.py

     
    362362            raise TracError('No file uploaded') 
    363363 
    364364        attachment.description = req.args.get('description', '') 
    365         attachment.author = req.args.get('author', '') 
     365        attachment.author = get_reporter_id(req, 'author') 
    366366        attachment.ipnr = req.remote_addr 
    367367        if req.args.get('replace'): 
    368368            try: 

  • trac/ticket/web_ui.py

     
    106106 
    107107        ticket = Ticket(self.env, db=db) 
    108108        ticket.populate(req.args) 
    109         ticket.values.setdefault('reporter', get_reporter_id(req)) 
     109        ticket.values['reporter'] = get_reporter_id(req, 'reporter') 
    110110 
    111111        if ticket.values.has_key('description'): 
    112112            description = wiki_to_html(ticket['description'], self.env, req, db) 
    … …  
    159159            raise TracError('Tickets must contain a summary.') 
    160160 
    161161        ticket = Ticket(self.env, db=db) 
    162         ticket.values.setdefault('reporter', get_reporter_id(req)) 
    163162        ticket.populate(req.args) 
     163        ticket.values['reporter'] = get_reporter_id(req, 'reporter') 
    164164        self._validate_ticket(req, ticket) 
    165165 
    166166        ticket.insert(db=db) 
    … …  
    249249        id = int(req.args.get('id')) 
    250250 
    251251        ticket = Ticket(self.env, id, db=db) 
    252         reporter_id = get_reporter_id(req) 
    253252 
    254253        if req.method == 'POST': 
    255254            if not req.args.has_key('preview'): 
    … …  
    264263                req.hdf['ticket.reassign_owner'] = req.args.get('reassign_owner') \ 
    265264                                                   or req.authname 
    266265                req.hdf['ticket.resolve_resolution'] = req.args.get('resolve_resolution') 
    267                 reporter_id = req.args.get('author') 
    268266                comment = req.args.get('comment') 
    269267                if comment: 
    270268                    req.hdf['ticket.comment'] = comment 
    … …  
    276274            # Store a timestamp in order to detect "mid air collisions" 
    277275            req.hdf['ticket.ts'] = ticket.time_changed 
    278276 
    279         self._insert_ticket_data(req, db, ticket, reporter_id) 
     277        self._insert_ticket_data(req, db, ticket, 
     278                                 get_reporter_id(req, 'author')) 
    280279 
    281280        mime = Mimeview(self.env) 
    282281        format = req.args.get('format') 
    … …  
    516515        internal_cnum = cnum 
    517516        if cnum and replyto: # record parent.child relationship 
    518517            internal_cnum = '%s.%s' % (replyto, cnum) 
    519         ticket.save_changes(req.args.get('author', req.authname), 
     518        ticket.save_changes(get_reporter_id(req, 'author'), 
    520519                            req.args.get('comment'), when=now, db=db, 
    521520                            cnum=internal_cnum) 
    522521        db.commit() 

  • trac/wiki/web_ui.py

     
    207207        for manipulator in self.page_manipulators: 
    208208            manipulator.validate_wiki_page(req, page) 
    209209 
    210         page.save(req.args.get('author'), req.args.get('comment'), 
     210        page.save(get_reporter_id(req, 'author'), req.args.get('comment'), 
    211211                  req.remote_addr) 
    212212        req.redirect(req.href.wiki(page.name)) 
    213213 
    … …  
    307307        if preview: 
    308308            page.readonly = req.args.has_key('readonly') 
    309309 
    310         author = req.args.get('author', get_reporter_id(req)) 
     310        author = get_reporter_id(req, 'author') 
    311311        comment = req.args.get('comment', '') 
    312312        editrows = req.args.get('editrows') 
    313313        if editrows: 

  • trac/util/__init__.py

     
    3939 
    4040# -- req/session utils 
    4141 
    42 def get_reporter_id(req): 
     42def get_reporter_id(req, arg_name=None): 
     43    if req.authname != 'anonymous': 
     44        return req.authname 
     45    if arg_name: 
     46        r = req.args.get(arg_name) 
     47        if r: 
     48            return r 
    4349    name = req.session.get('name', None) 
    4450    email = req.session.get('email', None) 
    45      
    46     if req.authname != 'anonymous': 
    47         return req.authname 
    48     elif name and email: 
     51    if name and email: 
    4952        return '%s <%s>' % (name, email) 
    50     elif not name and email: 
     53    if not name and email: 
    5154        return email 
    52     else: 
    53         return req.authname 
     55    return req.authname # == 'anonymous' 
    5456 
    5557 
    5658# -- algorithmic utilities