Преглед изворни кода

[core] Add custom 403 and CSRF view

Jenny Kim пре 10 година
родитељ
комит
efd7d84

+ 3 - 0
desktop/core/src/desktop/settings.py

@@ -218,6 +218,9 @@ FILE_UPLOAD_HANDLERS = (
   'django.core.files.uploadhandler.TemporaryFileUploadHandler',
 )
 
+# Custom CSRF Failure View
+CSRF_FAILURE_VIEW = 'desktop.views.csrf_failure'
+
 ############################################################
 # Part 4: Installation of apps
 ############################################################

+ 37 - 0
desktop/core/src/desktop/templates/403.mako

@@ -0,0 +1,37 @@
+## Licensed to Cloudera, Inc. under one
+## or more contributor license agreements.  See the NOTICE file
+## distributed with this work for additional information
+## regarding copyright ownership.  Cloudera, Inc. licenses this file
+## to you under the Apache License, Version 2.0 (the
+## "License"); you may not use this file except in compliance
+## with the License.  You may obtain a copy of the License at
+##
+##     http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing, software
+## distributed under the License is distributed on an "AS IS" BASIS,
+## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+## See the License for the specific language governing permissions and
+## limitations under the License.
+
+<%!
+from django.utils.translation import ugettext as _
+from desktop.views import commonheader, commonfooter
+%>
+${ commonheader(_('Access Forbidden'), "", user) | n,unicode }
+
+  <div class="container-fluid">
+    <div class="row-fluid">
+      <div class="span12 well">
+        <div class="hero-unit">
+          <h1>${_('Access Forbidden (403)')}</h1>
+          <br>
+          <p>${_("Sorry, you don't have permissions to access the page, or your session has expired.")}</p>
+          <br>
+          <p><a class="btn" onclick="history.back()">${ _('Go Back') }</a></p>
+        </div>
+      </div>
+    </div>
+  </div>
+
+${ commonfooter(messages) | n,unicode }

+ 37 - 0
desktop/core/src/desktop/templates/403_csrf.mako

@@ -0,0 +1,37 @@
+## Licensed to Cloudera, Inc. under one
+## or more contributor license agreements.  See the NOTICE file
+## distributed with this work for additional information
+## regarding copyright ownership.  Cloudera, Inc. licenses this file
+## to you under the Apache License, Version 2.0 (the
+## "License"); you may not use this file except in compliance
+## with the License.  You may obtain a copy of the License at
+##
+##     http://www.apache.org/licenses/LICENSE-2.0
+##
+## Unless required by applicable law or agreed to in writing, software
+## distributed under the License is distributed on an "AS IS" BASIS,
+## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+## See the License for the specific language governing permissions and
+## limitations under the License.
+
+<%!
+from django.utils.translation import ugettext as _
+from desktop.views import commonheader, commonfooter
+%>
+${ commonheader(_('CSRF Error'), "", user) | n,unicode }
+
+  <div class="container-fluid">
+    <div class="row-fluid">
+      <div class="span12 well">
+        <div class="hero-unit">
+          <h1>${_('CSRF Error (403)')}</h1>
+          <br>
+          <p>${_("Sorry, your session is invalid or has expired. Please go back, refresh the page, and try your submission again.")}</p>
+          <br>
+          <p><a class="btn" onclick="history.back()">${ _('Go Back') }</a></p>
+        </div>
+      </div>
+    </div>
+  </div>
+
+${ commonfooter(messages) | n,unicode }

+ 1 - 0
desktop/core/src/desktop/urls.py

@@ -41,6 +41,7 @@ from desktop import metrics
 # Django expects handler404 and handler500 to be defined.
 # django.conf.urls provides them. But we want to override them.
 # Also see http://code.djangoproject.com/ticket/5350
+handler403 = 'desktop.views.serve_403_error'
 handler404 = 'desktop.views.serve_404_error'
 handler500 = 'desktop.views.serve_500_error'
 

+ 10 - 0
desktop/core/src/desktop/views.py

@@ -284,6 +284,16 @@ def index(request):
   else:
     return home(request)
 
+def csrf_failure(request, reason=None):
+  """Registered handler for CSRF."""
+  access_warn(request, reason)
+  return render("403_csrf.mako", request, dict(uri=request.build_absolute_uri()), status=403)
+
+def serve_403_error(request, *args, **kwargs):
+  """Registered handler for 403. We just return a simple error"""
+  access_warn(request, "403 access forbidden")
+  return render("403.mako", request, dict(uri=request.build_absolute_uri()), status=403)
+
 def serve_404_error(request, *args, **kwargs):
   """Registered handler for 404. We just return a simple error"""
   access_warn(request, "404 not found")