8000 Security fix. Announcement forthcoming. · django/django@7e0972b · GitHub
[go: up one dir, main page]
Skip to content

Commit 7e0972b

Browse files
jacobianjacobian
committed
Security fix. Announcement forthcoming.
git-svn-id: http://code.djangoproject.com/svn/django/branches/0.96-bugfixes@8877 bcc190cf-cafb-0310-a4f2-bffc1f526a37
1 parent 3ca5a05 commit 7e0972b

File tree

2 files changed

+3
-40
lines changed

2 files changed

+3
-40
lines changed

‎django/contrib/admin/templates/admin/login.html‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
<div class="form-row">
2020
<label for="id_password">{% trans 'Password:' %}</label> <input type="password" name="password" id="id_password" />
2121
<input type="hidden" name="this_is_the_login_form" value="1" />
22-
<input type="hidden" name="post_data" value="{{ post_data }}" /> {#<span class="help">{% trans 'Have you <a href="/password_reset/">forgotten your password</a>?' %}</span>#}
2322
</div>
2423
<div class="submit-row">
2524
<label>&nbsp;</label><input type="submit" value="{% trans 'Log in' %}" />

‎django/contrib/admin/views/decorators.py‎

Lines changed: 3 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -5,42 +5,19 @@
55
from django.shortcuts import render_to_response
66
from django.utils.html import escape
77
from django.utils.translation import gettext_lazy
8-
import base64, datetime, md5
9-
import cPickle as pickle
8+
import base64, datetime
109

1110
ERROR_MESSAGE = gettext_lazy("Please enter a correct username and password. Note that both fields are case-sensitive.")
1211
LOGIN_FORM_KEY = 'this_is_the_login_form'
1312

1413
def _display_login_form(request, error_message=''):
1514
request.session.set_test_cookie()
16-
if request.POST and request.POST.has_key('post_data'):
17-
# User has failed login BUT has previously saved post data.
18-
post_data = request.POST['post_data']
19-
elif request.POST:
20-
# User's session must have expired; save their post data.
21-
post_data = _encode_post_data(request.POST)
22-
else:
23-
post_data = _encode_post_data({})
2415
return render_to_response('admin/login.html', {
2516
'title': _('Log in'),
2617
'app_path': escape(request.path),
27-
'post_data': post_data,
2818
'error_message': error_message
2919
}, context_instance=template.RequestContext(request))
3020

31-
def _encode_post_data(post_data):
32-
pickled = pickle.dumps(post_data)
33-
pickled_md5 = md5.new(pickled + settings.SECRET_KEY).hexdigest()
34-
return base64.encodestring(pickled + pickled_md5)
35-
36-
def _decode_post_data(encoded_data):
37-
encoded_data = base64.decodestring(encoded_data)
38-
pickled, tamper_check = encoded_data[:-32], encoded_data[-32:]
39-
if md5.new(pickled + settings.SECRET_KEY).hexdigest() != tamper_check:
40-
from django.core.exceptions import SuspiciousOperation
41-
raise SuspiciousOperation, "User may have tampered with session cookie."
42-
return pickle.loads(pickled)
43-
4421
def staff_member_required(view_func):
4522
"""
4623
Decorator for views that checks that the user is logged in and is a staff
@@ -49,18 +26,14 @@ def staff_member_required(view_func):
4926
def _checklogin(request, *args, **kwargs):
5027
if request.user.is_authenticated() and request.user.is_staff:
5128
# The user is valid. Continue to the admin page.
52-
if request.POST.has_key('post_data'):
53-
# User must have re-authenticated through a different window
54-
# or tab.
55-
request.POST = _decode_post_data(request.POST['post_data'])
5629
return view_func(request, *args, **kwargs)
5730

5831
assert hasattr(request, 'session'), "The Django admin requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'."
5932

6033
# If this isn't already the login page, display it.
6134
if not request.POST.has_key(LOGIN_FORM_KEY):
6235
if request.POST:
63-
message = _("Please log in again, because your session has expired. Don't worry: Your submission has been saved.")
36+
message = _("Please log in again, because your session has expired.")
6437
else:
6538
message = ""
6639
return _display_login_form(request, message)
@@ -93,16 +66,7 @@ def _checklogin(request, *args, **kwargs):
9366
# TODO: set last_login with an event.
9467
user.last_login = datetime.datetime.now()
9568
user.save()
96-
if request.POST.has_key('post_data'):
97-
post_data = _decode_post_data(request.POST['post_data'])
98-
if post_data and not post_data.has_key(LOGIN_FORM_KEY):
99-
# overwrite request.POST with the saved post_data, and continue
100-
request.POST = post_data
101-
request.user = user
102-
return view_func(request, *args, **kwargs)
103-
else:
104-
request.session.delete_test_cookie()
105-
return http.HttpResponseRedirect(request.path)
69+
return http.HttpResponseRedirect(request.path)
10670
else:
10771
return _display_login_form(request, ERROR_MESSAGE)
10872

0 commit comments

Comments
 (0)
0