external/mailinabox
1
0
Fork 0
mirror of https://github.com/mail-in-a-box/mailinabox.git synced 2025-05-07 05:36:55 +00:00
Code Issues Releases Wiki Activity

Always assign token if user does not have a valid one

Browse Source
This commit is contained in:
NewbieOrange 2021-07-28 22:43:52 +08:00
parent 41e07e56e9
commit aaf46df039
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
management/auth.py
View File

@ -143,7 +143,7 @@ class KeyAuthService:
def validate_user_token(self, email, request, env): def validate_user_token(self, email, request, env):
# Check whether the provided token in request cookie matches the one we stored for the user. # Check whether the provided token in request cookie matches the one we stored for the user.
return self.check_user_token(email, request.cookies.get("token"), request, env) return self.check_user_token(email, request.cookies.get("miab-cp-token"), request, env)
def create_user_key(self, email, env): def create_user_key(self, email, env):
# Create a user API key, which is a shared secret that we can re-generate from # Create a user API key, which is a shared secret that we can re-generate from

12
management/daemon.py
View File

@ -51,7 +51,7 @@ def authorized_personnel_only(viewfunc):
privs = [] privs = []
try: try:
email, privs, _ = auth_service.authenticate(request, env) email, privs, token = auth_service.authenticate(request, env)
except ValueError as e: except ValueError as e:
# Write a line in the log recording the failed login # Write a line in the log recording the failed login
log_failed_login(request) log_failed_login(request)
@ -67,7 +67,13 @@ def authorized_personnel_only(viewfunc):
request.user_privs = privs request.user_privs = privs
# Call view func. # Call view func.
return viewfunc(*args, **kwargs) resp = viewfunc(*args, **kwargs)
# Set authentication token for admin munin routes.
if token:
resp.set_cookie("miab-cp-token", value=token, secure=True, httponly=True, samesite='Lax')
return resp
if not error: if not error:
error = "You are not an administrator." error = "You are not an administrator."
@ -163,7 +169,7 @@ def me():
resp = json_response(resp) resp = json_response(resp)
# Set authentication token for admin munin routes. # Set authentication token for admin munin routes.
if "admin" in privs and token: if "admin" in privs and token:
resp.set_cookie("token", value=token, secure=True, httponly=True, samesite='Lax') resp.set_cookie("miab-cp-token", value=token, secure=True, httponly=True, samesite='Lax')
# Return. # Return.
return resp return resp