Skip to content

E
erp5
Commit ee05c9c4 authored by Jérome Perrin's avatar Jérome Perrin
Browse files
Options

Cleanup google and facebook login and cookie management 

First,  cleanup `testERPSecurity`, moving related tests in sub-classes instead of big classes with lots of tests (diff is big, because methods are moved around)

Change google and facebook login to reuse `portal.setAuthCookie`, which is the central point to set a cookie securely so that it can be used for authentication.

Refactor management of oauth keys to fix [#20181121-1A36AE2](https://nexedi.erp5.net/bug_module/20181121-1A36AE2).

Some minor fixes in business template definition.

/reviewed-on nexedi/erp5!803
parents bab963e4 05deeb26
Expand all Hide whitespace changes
Inline Side-by-side
Showing with 466 additions and 553 deletions
bt5/erp5_oauth_facebook_login/ExtensionTemplateItem/portal_components/extension.erp5.FacebookLoginUtility.py
View file @ ee05c9c4
import facebook
from ZTUtils import make_query
from Products.ERP5Security.ERP5ExternalOauth2ExtractionPlugin import getFacebookUserEntry
def _getFacebookClientIdAndSecretKey(portal, reference="default"):
"""Returns facebook client id and secret key.
Internal function.
"""
result_list = portal.portal_catalog.unrestrictedSearchResults(
portal_type="Facebook Connector",
reference=reference,
validation_state="validated",
limit=2,
)
assert result_list, "Facebook Connector not found"
if len(result_list) == 2:
raise ValueError("Impossible to select one Facebook Connector")
facebook_connector = result_list[0]
return facebook_connector.getClientId(), facebook_connector.getSecretKey()
def redirectToFacebookLoginPage(self, came_from=None):
client_id, _ = _getFacebookClientIdAndSecretKey(self.getPortalObject())
query = make_query({
# Call at he context of the appropriate web_service.
'client_id': client_id,
'redirect_uri': "{0}/ERP5Site_callbackFacebookLogin".format(came_from or self.absolute_url()),
'scope': 'email'
})
return self.REQUEST.RESPONSE.redirect("https://www.facebook.com/v2.10/dialog/oauth?{}".format(query))
def getAccessTokenFromCode(self, code, redirect_uri):
client_id, secret_key = self.ERP5Site_getFacebookClientIdAndSecretKey()
client_id, secret_key = _getFacebookClientIdAndSecretKey(self.getPortalObject())
return facebook.GraphAPI(version="2.7").get_access_token_from_code(
code=code, redirect_uri=redirect_uri,
app_id=client_id, app_secret=secret_key)
......
bt5/erp5_oauth_facebook_login/SkinTemplateItem/portal_skins/erp5_oauth_facebook_login/ERP5Site_callbackFacebookLogin.py
View file @ ee05c9c4
import time
request = container.REQUEST
response = request.RESPONSE
def handleError(error):
context.Base_redirect(
'login_form',
......@@ -21,7 +24,7 @@ elif code is not None:
access_token = response_dict['access_token'].encode('utf-8')
hash_str = context.Base_getHMAC(access_token, access_token)
context.REQUEST.RESPONSE.setCookie('__ac_facebook_hash', hash_str, path='/')
context.setAuthCookie(response, '__ac_facebook_hash', hash_str)
# store timestamp in second since the epoch in UTC is enough
response_dict["response_timestamp"] = time.time()
......@@ -45,7 +48,7 @@ elif code is not None:
# https://developers.facebook.com/support/bugs/318390728250352/?disable_redirect=0
# https://stackoverflow.com/questions/7131909/facebook-callback-appends-to-return-url/33257076#33257076
# https://lab.nexedi.com/nexedi/erp5/merge_requests/417#note_64365
came_from = context.REQUEST.get("came_from", portal.absolute_url() + "#")
return context.REQUEST.RESPONSE.redirect(came_from)
came_from = request.get("came_from", portal.absolute_url() + "#")
return response.redirect(came_from)
return handleError('')
bt5/erp5_oauth_facebook_login/SkinTemplateItem/portal_skins/erp5_oauth_facebook_login/ERP5Site_getFacebookClientIdAndSecretKey.py deleted 100644 → 0
View file @ bab963e4
if REQUEST is not None:
raise ValueError("This script can't be called in the URL")
result_list = context.getPortalObject().portal_catalog(
portal_type="Facebook Connector",
reference=reference,
validation_state="validated",
limit=2,
)
assert result_list, "Facebook Connector not found"
if len(result_list) == 2:
raise ValueError("Impossible to select one Facebook Connector")
facebook_connector = result_list[0]
return facebook_connector.getClientId(), facebook_connector.getSecretKey()
bt5/erp5_oauth_facebook_login/SkinTemplateItem/portal_skins/erp5_oauth_facebook_login/ERP5Site_getFacebookClientIdAndSecretKey.xml deleted 100644 → 0
View file @ bab963e4
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>Script_magic</string> </key>
<value> <int>3</int> </value>
</item>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_container</string> </key>
<value> <string>container</string> </value>
</item>
<item>
<key> <string>name_context</string> </key>
<value> <string>context</string> </value>
</item>
<item>
<key> <string>name_m_self</string> </key>
<value> <string>script</string> </value>
</item>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_params</string> </key>
<value> <string>reference="default", REQUEST=None</string> </value>
</item>
<item>
<key> <string>_proxy_roles</string> </key>
<value>
<tuple>
<string>Manager</string>
</tuple>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>ERP5Site_getFacebookClientIdAndSecretKey</string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_oauth_facebook_login/SkinTemplateItem/portal_skins/erp5_oauth_facebook_login/ERP5Site_redirectToFacebookLoginPage.py deleted 100644 → 0
View file @ bab963e4
from ZTUtils import make_query
client_id, _ = context.ERP5Site_getFacebookClientIdAndSecretKey()
query = make_query({
# Call at he context of the appropriate web_service.
'client_id': client_id,
'redirect_uri': "{0}/ERP5Site_callbackFacebookLogin".format(came_from or context.absolute_url()),
'scope': 'email'
})
login_url = "https://www.facebook.com/v2.10/dialog/oauth"
if "?" not in login_url:
login_url += "?"
return context.REQUEST.RESPONSE.redirect("{0}{1}".format(login_url, query))
bt5/erp5_oauth_facebook_login/SkinTemplateItem/portal_skins/erp5_oauth_facebook_login/ERP5Site_redirectToFacebookLoginPage.xml
View file @ ee05c9c4
......@@ -2,68 +2,26 @@
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
<global name="ExternalMethod" module="Products.ExternalMethod.ExternalMethod"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>Script_magic</string> </key>
<value> <int>3</int> </value>
<key> <string>_function</string> </key>
<value> <string>redirectToFacebookLoginPage</string> </value>
</item>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_container</string> </key>
<value> <string>container</string> </value>
</item>
<item>
<key> <string>name_context</string> </key>
<value> <string>context</string> </value>
</item>
<item>
<key> <string>name_m_self</string> </key>
<value> <string>script</string> </value>
</item>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_params</string> </key>
<value> <string>came_from=None</string> </value>
</item>
<item>
<key> <string>_proxy_roles</string> </key>
<value>
<tuple>
<string>Auditor</string>
</tuple>
</value>
<key> <string>_module</string> </key>
<value> <string>FacebookLoginUtility</string> </value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>ERP5Site_redirectToFacebookLoginPage</string> </value>
</item>
<item>
<key> <string>title</string> </key>
<value> <string></string> </value>
</item>
</dictionary>
</pickle>
</record>
......
bt5/erp5_oauth_facebook_login/TestTemplateItem/portal_components/test.erp5.testFacebookLogin.py
View file @ ee05c9c4
......@@ -74,7 +74,6 @@ class TestFacebookLogin(ERP5TypeTestCase):
FacebookLoginUtility.getUserEntry = getUserEntry
self.dummy_connector_id = "test_facebook_connector"
person_module = self.portal.person_module
portal_catalog = self.portal.portal_catalog
for obj in portal_catalog(portal_type=["Facebook Login", "Person"],
reference=getUserId(None),
......@@ -112,6 +111,17 @@ class TestFacebookLogin(ERP5TypeTestCase):
self.assertNotIn("secret_key=", location)
self.assertIn("ERP5Site_callbackFacebookLogin", location)
def test_auth_cookie(self):
request = self.portal.REQUEST
response = request.RESPONSE
# (the secure flag is only set if we accessed through https)
request.setServerURL('https', 'example.com')
self.portal.ERP5Site_callbackFacebookLogin(code=CODE)
ac_cookie, = [v for (k, v) in response.listHeaders() if k.lower() == 'set-cookie' and '__ac_facebook_hash=' in v]
self.assertIn('; Secure', ac_cookie)
self.assertIn('; HTTPOnly', ac_cookie)
def test_create_user_in_ERP5Site_createFacebookUserToOAuth(self):
"""
Check if ERP5 set cookie properly after receive code from external service
......
bt5/erp5_oauth_facebook_login/TestTemplateItem/portal_components/test.erp5.testFacebookLogin.xml
View file @ ee05c9c4
......@@ -45,9 +45,7 @@
<item>
<key> <string>text_content_warning_message</string> </key>
<value>
<tuple>
<string>W: 77, 4: Unused variable \'person_module\' (unused-variable)</string>
</tuple>
<tuple/>
</value>
</item>
<item>
......
bt5/erp5_oauth_facebook_login/bt/template_test_id_list
View file @ ee05c9c4
test.erp5.testFacebookLogin
test.erp5.testFacebookLogin
\ No newline at end of file
bt5/erp5_oauth_google_login/ExtensionTemplateItem/portal_components/extension.erp5.GoogleLoginUtility.py
View file @ ee05c9c4
......@@ -5,8 +5,27 @@ from Products.ERP5Security.ERP5ExternalOauth2ExtractionPlugin import getGoogleUs
SCOPE_LIST = ['https://www.googleapis.com/auth/userinfo.profile',
'https://www.googleapis.com/auth/userinfo.email']
def _getGoogleClientIdAndSecretKey(portal, reference="default"):
"""Returns google client id and secret key.
Internal function.
"""
result_list = portal.portal_catalog.unrestrictedSearchResults(
portal_type="Google Connector",
reference=reference,
validation_state="validated",
limit=2,
)
assert result_list, "Google Connector not found"
if len(result_list) == 2:
raise ValueError("Impossible to select one Google Connector")
google_connector = result_list[0].getObject()
return google_connector.getClientId(), google_connector.getSecretKey()
def redirectToGoogleLoginPage(self):
client_id, secret_key = self.ERP5Site_getGoogleClientIdAndSecretKey()
client_id, secret_key = _getGoogleClientIdAndSecretKey(self.getPortalObject())
flow = oauth2client.client.OAuth2WebServerFlow(
client_id=client_id,
client_secret=secret_key,
......@@ -18,8 +37,7 @@ def redirectToGoogleLoginPage(self):
self.REQUEST.RESPONSE.redirect(flow.step1_get_authorize_url())
def getAccessTokenFromCode(self, code, redirect_uri):
portal = self.getPortalObject()
client_id, secret_key = portal.ERP5Site_getGoogleClientIdAndSecretKey()
client_id, secret_key = _getGoogleClientIdAndSecretKey(self.getPortalObject())
flow = oauth2client.client.OAuth2WebServerFlow(
client_id=client_id,
client_secret=secret_key,
......
bt5/erp5_oauth_google_login/PortalTypePropertySheetTemplateItem/property_sheet_list.xml
View file @ ee05c9c4
......@@ -5,4 +5,4 @@
<portal_type id="Template Tool">
<item>TemplateToolERP5GoogleExtractionPluginConstraint</item>
</portal_type>
</property_sheet_list>
</property_sheet_list>
\ No newline at end of file
bt5/erp5_oauth_google_login/SkinTemplateItem/portal_skins/erp5_oauth_google_login/ERP5Site_getGoogleClientIdAndSecretKey.py deleted 100644 → 0
View file @ bab963e4
if REQUEST is not None:
raise ValueError("This script can't be called in the URL")
result_list = context.getPortalObject().portal_catalog(
portal_type="Google Connector",
reference=reference,
validation_state="validated",
limit=2,
)
assert result_list, "Google Connector not found"
if len(result_list) == 2:
raise ValueError("Impossible to select one Google Connector")
google_connector = result_list[0].getObject()
return google_connector.getClientId(), google_connector.getSecretKey()
bt5/erp5_oauth_google_login/SkinTemplateItem/portal_skins/erp5_oauth_google_login/ERP5Site_getGoogleClientIdAndSecretKey.xml deleted 100644 → 0
View file @ bab963e4
<?xml version="1.0"?>
<ZopeData>
<record id="1" aka="AAAAAAAAAAE=">
<pickle>
<global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
</pickle>
<pickle>
<dictionary>
<item>
<key> <string>Script_magic</string> </key>
<value> <int>3</int> </value>
</item>
<item>
<key> <string>_bind_names</string> </key>
<value>
<object>
<klass>
<global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
</klass>
<tuple/>
<state>
<dictionary>
<item>
<key> <string>_asgns</string> </key>
<value>
<dictionary>
<item>
<key> <string>name_container</string> </key>
<value> <string>container</string> </value>
</item>
<item>
<key> <string>name_context</string> </key>
<value> <string>context</string> </value>
</item>
<item>
<key> <string>name_m_self</string> </key>
<value> <string>script</string> </value>
</item>
<item>
<key> <string>name_subpath</string> </key>
<value> <string>traverse_subpath</string> </value>
</item>
</dictionary>
</value>
</item>
</dictionary>
</state>
</object>
</value>
</item>
<item>
<key> <string>_params</string> </key>
<value> <string>reference="default", REQUEST=None</string> </value>
</item>
<item>
<key> <string>_proxy_roles</string> </key>
<value>
<tuple>
<string>Manager</string>
</tuple>
</value>
</item>
<item>
<key> <string>id</string> </key>
<value> <string>ERP5Site_getGoogleClientIdAndSecretKey</string> </value>
</item>
</dictionary>
</pickle>
</record>
</ZopeData>
bt5/erp5_oauth_google_login/SkinTemplateItem/portal_skins/erp5_oauth_google_login/ERP5Site_receiveGoogleCallback.py
View file @ ee05c9c4
import time
request = container.REQUEST
response = request.RESPONSE
def handleError(error):
context.Base_redirect(
'login_form',
......@@ -19,7 +22,7 @@ elif code is not None:
if response_dict is not None:
access_token = response_dict['access_token'].encode('utf-8')
hash_str = context.Base_getHMAC(access_token, access_token)
context.REQUEST.RESPONSE.setCookie('__ac_google_hash', hash_str, path='/')
context.setAuthCookie(response, '__ac_google_hash', hash_str)
# store timestamp in second since the epoch in UTC is enough
response_dict["response_timestamp"] = time.time()
context.Base_setBearerToken(hash_str,
......@@ -33,7 +36,6 @@ elif code is not None:
method = getattr(context, "ERP5Site_createGoogleUserToOAuth", None)
if method is not None:
method(user_reference, user_dict)
return context.REQUEST.RESPONSE.redirect(
context.REQUEST.get("came_from") or context.absolute_url())
return response.redirect(request.get("came_from") or context.absolute_url())
return handleError('')
bt5/erp5_oauth_google_login/TestTemplateItem/portal_components/test.erp5.testGoogleLogin.py
View file @ ee05c9c4
......@@ -111,7 +111,6 @@ class TestGoogleLogin(ERP5TypeTestCase):
GoogleLoginUtility.getUserEntry = getUserEntry
self.dummy_connector_id = "test_google_connector"
person_module = self.portal.person_module
portal_catalog = self.portal.portal_catalog
for obj in portal_catalog(portal_type=["Google Login", "Person"],
reference=getUserId(None),
......@@ -149,6 +148,17 @@ class TestGoogleLogin(ERP5TypeTestCase):
self.assertNotIn("secret_key=", location)
self.assertIn("ERP5Site_receiveGoogleCallback", location)
def test_auth_cookie(self):
request = self.portal.REQUEST
response = request.RESPONSE
# (the secure flag is only set if we accessed through https)
request.setServerURL('https', 'example.com')
self.portal.ERP5Site_receiveGoogleCallback(code=CODE)
ac_cookie, = [v for (k, v) in response.listHeaders() if k.lower() == 'set-cookie' and '__ac_google_hash=' in v]
self.assertIn('; Secure', ac_cookie)
self.assertIn('; HTTPOnly', ac_cookie)
def test_create_user_in_ERP5Site_createGoogleUserToOAuth(self):
"""
Check if ERP5 set cookie properly after receive code from external service
......
bt5/erp5_oauth_google_login/bt/template_action_path_list
View file @ ee05c9c4
Google Connector | view
Google Login | view
Google Login | view
\ No newline at end of file
bt5/erp5_oauth_google_login/bt/template_portal_type_property_sheet_list
View file @ ee05c9c4
Google Connector | OAuthClient
Template Tool | TemplateToolERP5GoogleExtractionPluginConstraint
Template Tool | TemplateToolERP5GoogleExtractionPluginConstraint
\ No newline at end of file
bt5/erp5_oauth_google_login/bt/template_property_sheet_id_list 0 → 100644
View file @ ee05c9c4
TemplateToolERP5GoogleExtractionPluginConstraint
\ No newline at end of file
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7