yudaike/openSUSE-release-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

obs_operator: do not require session for OPTIONS method.

Browse Source 
The CORS pre-flight OPTIONS calls do not include the session headers,
but should validate everything else bsides the session.
This commit is contained in:
Jimmy Berry 2019-05-13 16:53:26 -05:00
parent f246043497
commit 5f94ac9eaa
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
obs_operator.py
View File

@ -40,7 +40,7 @@ class RequestHandler(BaseHTTPRequestHandler):
def do_OPTIONS(self): def do_OPTIONS(self):
try: try:
with OSCRequestEnvironment(self) as oscrc_file: with OSCRequestEnvironment(self, require_session=False) as oscrc_file:
self.send_header('Access-Control-Allow-Methods', 'GET, POST') self.send_header('Access-Control-Allow-Methods', 'GET, POST')
self.send_header('Access-Control-Allow-Headers', 'Access-Control-Allow-Origin, Content-Type, X-Requested-With') self.send_header('Access-Control-Allow-Headers', 'Access-Control-Allow-Origin, Content-Type, X-Requested-With')
except OSCRequestEnvironmentException as e: except OSCRequestEnvironmentException as e:
@ -286,9 +286,10 @@ class RequestHandler(BaseHTTPRequestHandler):
yield command yield command
class OSCRequestEnvironment(object): class OSCRequestEnvironment(object):
def __init__(self, handler, user=None): def __init__(self, handler, user=None, require_session=True):
self.handler = handler self.handler = handler
self.user = user self.user = user
self.require_session = require_session
def __enter__(self): def __enter__(self):
apiurl = self.handler.apiurl_get() apiurl = self.handler.apiurl_get()
@ -302,7 +303,7 @@ class OSCRequestEnvironment(object):
raise OSCRequestEnvironmentException('origin does not match host domain') raise OSCRequestEnvironmentException('origin does not match host domain')
session = self.handler.session_get() session = self.handler.session_get()
if not session: if self.require_session and not session:
self.handler.send_response(401) self.handler.send_response(401)
self.handler.end_headers() self.handler.end_headers()
raise OSCRequestEnvironmentException('unable to determine session') raise OSCRequestEnvironmentException('unable to determine session')