| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
|
|
Previously middlewares mostly gave up and acted as pass through when a
second start_response call occurred. Now they try to handle this
situation.
|
|
Not failing. :-)
|
|
This was basically a rewrite of the NoWriteCallableMiddleware, because
the wrong assumption of start_response not being called twice was used
in too many places.
|
|
Also set the returneddata attribute of the response object instead of
the request object.
|
|
|
|
|
|
Said RFC is quite precise on which values of a challenge are to be
quoted. I didn't honour those parts and many applications do not enforce
these requirements, so I didn't notice. Now I explain which values are
to be quoted in the hopes that it works with "Wget/1.10.2 (Red Hat
modified)".
|
|
* added a number of internal links (L{...})
* some fixes
* some additions
|
|
Conflicts:
wsgitools/digest.py
|
|
The method no longer receives a start_response and is no longer
responsible for calling self.app. Instead it returns a dictionary with
the result of the authentication.
|
|
This is the inverse of parse_digest_response and also supports escaping
of backslashes and quotes.
|
|
The previous version did not handle escapes at all. Now I added two test
cases for escaping and rewrote the function to meet all test cases.
|
|
This shrinks the possibility of raising something from start_response
and maybe enables to factor out this start_response modification later.
|
|
The BasicAuthMiddleware and AuthDigestMiddleware now derive from
AuthenticationMiddleware which provides common functionality.
|
|
The interface of this internal function has changed in a backwards
incompatible way. The last parameter is no longer the bool stale, but an
exception now, which encodes more information than the previous bool.
This was made possible by the previous commit. This exception can then
be used by the new method www_authenticate to generate a suitable
WWW-Authenticate header. The idea behind this change is that at some
point it should be possible to override authorization_required (still
internal now) to evaluate what condition lead to the failure and to
generate custom error pages.
|
|
Instead of randomly raising KeyErrors or ValueErrors we can now see more
meaningful ProtocolViolations and StaleNonces. Note that this change
should be invisible to users who do not mess with internals.
|
|
|
|
|
|
This is useful when used in combination with e.g. systemd.
|
|
|
|
|
|
|
|
Otherwise escape_string is not reversible.
|
|
It probably gained this bit later than shown in history due to darcs not
tracking execute bits. The bit was probably added for doc tests which
moved to a designated file later.
|
|
|
|
|
|
|
|
|
|
The exit status is now the number of failures.
|
|
AuthTokenGenerator gained a base class AbstractTokenGenerator. This
class provides an additional method check_password implementing the
interface required by BasicAuthMiddleware. In addition
AbstractTokenGenerator gained two subclasses HtdigestTokenGenerator and
UpdatingHtdigestTokenGenerator. They both read authentication
information from a apache htdigest file. The latter also checks the file
for updates.
|
|
|
|
|
|
|
|
It previously only checked for the validity of a header and now also
checks for the presence of a header.
|
|
|
|
|
|
as this is tried by BasicAuthMiddleware first.
|
|
|
|
This addresses a disputed denial of service condition described in
http://bugs.python.org/issue6706. Note that wsgitools is not hit as hard as
pyftplib.
|
|
|
|
PEP333 says that the headers list passed to start_response may be modified by
servers or middlewares. In fact this happens in DigestAuthMiddleware. The
StaticContent and CachingMiddleware classes did not take this into account and
returned the same headers list multiple times which is wrong and can lead to
denial of service.
|
|
|
|
|
|
|
|
|
|
|
|
|
