Skip to content

Z
Zope
Commit 0719961b authored by Tres Seaver's avatar Tres Seaver
Browse files
Options

Issue #2294: 'requestmethod' protection for DOS-able ControlPanel methods.

parent d8573ace
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 1 deletion
lib/python/App/ApplicationManager.py
View file @ 0719961b
...@@ -33,6 +33,7 @@ from Products.PageTemplates.PageTemplateFile import PageTemplateFile ...@@ -33,6 +33,7 @@ from Products.PageTemplates.PageTemplateFile import PageTemplateFile
from cgi import escape from cgi import escape
import zLOG import zLOG
import Lifetime import Lifetime
from AccessControl.requestmethod import postonly
try: import thread try: import thread
except: get_ident=lambda: 0 except: get_ident=lambda: 0
...@@ -400,8 +401,9 @@ class ApplicationManager(Folder,CacheManager): ...@@ -400,8 +401,9 @@ class ApplicationManager(Folder,CacheManager):
</head> </head>
<body>Zope is restarting</body></html> <body>Zope is restarting</body></html>
""" % escape(URL1, 1) """ % escape(URL1, 1)
manage_restart = postonly(manage_restart)
def manage_shutdown(self): def manage_shutdown(self, REQUEST=None):
"""Shut down the application""" """Shut down the application"""
try: try:
user = '"%s"' % getSecurityManager().getUser().getUserName() user = '"%s"' % getSecurityManager().getUser().getUserName()
...@@ -416,6 +418,7 @@ class ApplicationManager(Folder,CacheManager): ...@@ -416,6 +418,7 @@ class ApplicationManager(Folder,CacheManager):
</head> </head>
<body>Zope is shutting down</body></html> <body>Zope is shutting down</body></html>
""" """
manage_shutdown = postonly(manage_shutdown)
def manage_pack(self, days=0, REQUEST=None): def manage_pack(self, days=0, REQUEST=None):
"""Pack the database""" """Pack the database"""
...@@ -428,6 +431,7 @@ class ApplicationManager(Folder,CacheManager): ...@@ -428,6 +431,7 @@ class ApplicationManager(Folder,CacheManager):
REQUEST['RESPONSE'].redirect( REQUEST['RESPONSE'].redirect(
REQUEST['URL1']+'/manage_workspace') REQUEST['URL1']+'/manage_workspace')
return t return t
manage_pack = postonly(manage_pack)
def revert_points(self): return () def revert_points(self): return ()
...@@ -478,6 +482,7 @@ class ApplicationManager(Folder,CacheManager): ...@@ -478,6 +482,7 @@ class ApplicationManager(Folder,CacheManager):
db.commitVersion(v) db.commitVersion(v)
if REQUEST is not None: if REQUEST is not None:
REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main') REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main')
manage_saveVersions = postonly(manage_saveVersions)
def manage_discardVersions(self, versions, REQUEST=None): def manage_discardVersions(self, versions, REQUEST=None):
"Discard some versions" "Discard some versions"
...@@ -486,6 +491,7 @@ class ApplicationManager(Folder,CacheManager): ...@@ -486,6 +491,7 @@ class ApplicationManager(Folder,CacheManager):
db.abortVersion(v) db.abortVersion(v)
if REQUEST is not None: if REQUEST is not None:
REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main') REQUEST['RESPONSE'].redirect(REQUEST['URL1']+'/manage_main')
manage_discardVersions = postonly(manage_discardVersions)
def getSOFTWARE_HOME(self): def getSOFTWARE_HOME(self):
return getConfiguration().softwarehome return getConfiguration().softwarehome
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7