From 5fb6a912cd7cb0bcfa4512da5248baad1175faf5 Mon Sep 17 00:00:00 2001 From: Matthew Fernandez Date: Thu, 26 Oct 2017 20:31:21 -0700 Subject: remove --auth option from server commands The implementation of this option contained syntax errors and did not work. For more information, see https://gitlab.com/bugseverywhere/bugseverywhere/issues/7. --- libbe/command/serve_commands.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'libbe/command/serve_commands.py') diff --git a/libbe/command/serve_commands.py b/libbe/command/serve_commands.py index 30b4a69..7e8f57e 100644 --- a/libbe/command/serve_commands.py +++ b/libbe/command/serve_commands.py @@ -179,9 +179,8 @@ And in another terminal (or after backgrounding the server):: $ be --server http://localhost:8000/ list If you bind your server to a public interface, take a look at the -``--read-only`` option or the combined ``--ssl --auth FILE`` -options so other people can't mess with your repository. If you do use -authentication, you'll need to send in your username and password:: +``--read-only`` option so other people can't mess with your +repository. $ be --server http://username:password@localhost:8000/ list """ -- cgit From 4d88ff5b6cd8b97ad296a8cc47fd054692354a38 Mon Sep 17 00:00:00 2001 From: Matthew Fernandez Date: Thu, 26 Oct 2017 20:45:52 -0700 Subject: remove check_login from the WSGI server app AuthenticationApp (just removed) was the only code that had any interaction with this functionality. That is, check_login looked for an environment variable "be-auth.user" that was only ever set by AuthenticationApp. --- libbe/command/serve_commands.py | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'libbe/command/serve_commands.py') diff --git a/libbe/command/serve_commands.py b/libbe/command/serve_commands.py index 7e8f57e..c2a1be8 100644 --- a/libbe/command/serve_commands.py +++ b/libbe/command/serve_commands.py @@ -80,7 +80,6 @@ class ServerApp (libbe.util.wsgi.WSGI_AppObject, # handlers def run(self, environ, start_response): - self.check_login(environ) data = self.post_data(environ) source = 'post' try: @@ -113,15 +112,6 @@ class ServerApp (libbe.util.wsgi.WSGI_AppObject, def _parse_post(self, post): return libbe.storage.util.mapfile.parse(post) - def check_login(self, environ): - user = environ.get('be-auth.user', None) - if user is not None: # we're running under AuthenticationApp - if environ['REQUEST_METHOD'] == 'POST': - # TODO: better detection of commands requiring writes - if user == 'guest' or self.storage.is_writeable() == False: - raise _Unauthorized() # only non-guests allowed to write - # allow read-only commands for all users - def _notify(self, environ, command, id, params): message = self._format_notification(environ, command, id, params) self._submit_notification(message) -- cgit