From 70a713a8edb0d252130791b2d1136220b17ad870 Mon Sep 17 00:00:00 2001 From: yumoqing Date: Mon, 12 Jun 2023 10:38:00 +0800 Subject: [PATCH] bugfix --- ahserver/auth_api.py | 54 ++++---------------------------------------- changelog.txt | 3 +++ 2 files changed, 7 insertions(+), 50 deletions(-) create mode 100755 changelog.txt diff --git a/ahserver/auth_api.py b/ahserver/auth_api.py index 33faaf2..27cf0d5 100755 --- a/ahserver/auth_api.py +++ b/ahserver/auth_api.py @@ -34,7 +34,7 @@ class AuthAPI(AppLogger): # Create an auth ticket mechanism that expires after 1 minute (60 # seconds), and has a randomly generated secret. Also includes the # optional inclusion of the users IP address in the hash - policy = auth.SessionTktAuthentication(urandom(32), 60, + policy = auth.SessionTktAuthentication(urandom(32), 3600, include_ip=True) # setup aiohttp_auth.auth middleware in aiohttp fashion @@ -43,41 +43,6 @@ class AuthAPI(AppLogger): app.middlewares.append(self.checkAuth) app.router.add_route('GET', '/logout', self.logout) - async def checkLogin(self,request): - """ - authorization header has the format: - login_method:user_id:auth_code - """ - authinfo = request.headers.get('authorization') - if authinfo is None: - self.debug('header not include "authorization" info %s' % request.headers) - raise web.HTTPUnauthorized() - if isinstance(authinfo, str): - authinfo = authinfo.encode('ascii') - authinfo = base64.b64decode(authinfo) - authinfo = authinfo.decode('ascii') - - authdata = self.rsaDecode(authinfo) - # print('authdata=',authdata) - alist = authdata.split('::') - if len(alist) != 3: - self.debug('auth data format error %s' % authdata) - raise web.HTTPUnauthorized() - - login_method=alist[0] - user_id = alist[1] - password = alist[2] - if login_method == 'password': - if await self.checkUserPassword(user_id,password): - await auth.remember(request,user_id) - # print('auth success,',user_id, password) - return user_id - # print('auth failed') - raise web.HTTPUnauthorized() - else: - # print('auth method unrecognized------------------------') - raise web.HTTPUnauthorized() - async def logout(self,request): await auth.forget(request) return web.Response(body='OK'.encode('utf-8')) @@ -85,29 +50,18 @@ class AuthAPI(AppLogger): @web.middleware async def checkAuth(self,request,handler): path = request.path - # print(f'*****{path} checkAuth called********') if not await self.needAuth(path): return await handler(request) user = await auth.get_auth(request) - if user is None: - # print('-----------auth.get_auth() return None--------------') - user = await self.checkLogin(request) - #raise web.HTTPFound(f'/login_form?from_path={path}') is_ok = await self.checkUserPermission(user, path) if is_ok: return await handler(request) # print(f'**{path} forbidden**') raise web.HTTPForbidden() + async def checkUserPermission(user, path): + return True + async def needAuth(self,path): return False - async def getPermissionNeed(self,path): - return 'admin' - - async def checkUserPassword(self,user_id,password): - return True - - async def getUserPermissions(self,user): - return ['admin','view'] - diff --git a/changelog.txt b/changelog.txt new file mode 100755 index 0000000..0b6da10 --- /dev/null +++ b/changelog.txt @@ -0,0 +1,3 @@ +2023-06-12 +modify auth_api.py to with only needAuth(), checkUserPermission(user, path) method +