paul@1 | 1 | # -*- coding: iso-8859-1 -*- |
paul@1 | 2 | """ |
paul@1 | 3 | MoinMoin - ApproveChanges library |
paul@1 | 4 | |
paul@4 | 5 | This library relies on the existence of a user (by default |
paul@4 | 6 | "ApprovalQueueUser") who has sufficient privileges to write pages with ACLs |
paul@4 | 7 | to an approval queue (ACL permissions "write,admin"). |
paul@4 | 8 | |
paul@4 | 9 | If users other than the superuser are to be able to edit pages freely, they |
paul@4 | 10 | must be present in a group (by default "ApprovedGroup"), and if they are to |
paul@4 | 11 | be allowed to review changes, they must be present in a different group (by |
paul@4 | 12 | default "PageReviewersGroup"). |
paul@4 | 13 | |
paul@1 | 14 | @copyright: 2011 by Paul Boddie <paul@boddie.org.uk> |
paul@1 | 15 | @license: GNU GPL (v2 or later), see COPYING.txt for details. |
paul@1 | 16 | """ |
paul@1 | 17 | |
paul@4 | 18 | from MoinMoin import user |
paul@1 | 19 | import re |
paul@4 | 20 | import base64 |
paul@4 | 21 | import md5 |
paul@4 | 22 | import hmac |
paul@4 | 23 | |
paul@4 | 24 | try: |
paul@4 | 25 | from hashlib import sha1 |
paul@4 | 26 | except ImportError: |
paul@4 | 27 | from sha import new as sha1 |
paul@4 | 28 | |
paul@4 | 29 | acl_pattern = re.compile(ur"^#acl .*$", re.UNICODE | re.MULTILINE) |
paul@1 | 30 | |
paul@1 | 31 | __version__ = "0.1" |
paul@1 | 32 | |
paul@3 | 33 | def get_queued_changes_page(request): |
paul@3 | 34 | return getattr(request.cfg, "queued_changes_page", "ApprovalQueue") |
paul@1 | 35 | |
paul@1 | 36 | def get_approved_editors_group(request): |
paul@1 | 37 | return getattr(request.cfg, "approved_editors_group", "ApprovedGroup") |
paul@1 | 38 | |
paul@4 | 39 | def get_page_reviewers_group(request): |
paul@4 | 40 | return getattr(request.cfg, "reviewers_group", "PageReviewersGroup") |
paul@4 | 41 | |
paul@4 | 42 | def get_queued_changes_user(request): |
paul@4 | 43 | return getattr(request.cfg, "queued_changes_user", "ApprovalQueueUser") |
paul@4 | 44 | |
paul@4 | 45 | def get_secret_key(request): |
paul@4 | 46 | return request.cfg.secrets["wikiutil/tickets"] |
paul@4 | 47 | |
paul@4 | 48 | def is_reviewer(request): |
paul@4 | 49 | return request.user.valid and ( |
paul@4 | 50 | request.dicts.has_member(get_approved_editors_group(request), request.user.name) or \ |
paul@4 | 51 | request.user.isSuperUser()) |
paul@4 | 52 | |
paul@4 | 53 | def is_approved(request): |
paul@4 | 54 | return request.user.valid and ( |
paul@4 | 55 | request.dicts.has_member(get_approved_editors_group(request), request.user.name) or \ |
paul@4 | 56 | request.user.isSuperUser()) |
paul@4 | 57 | |
paul@3 | 58 | def is_queued_changes_page(request, pagename): |
paul@1 | 59 | |
paul@3 | 60 | "Return whether 'pagename' is a queued changes page by testing its name." |
paul@1 | 61 | |
paul@1 | 62 | parts = pagename.split("/") |
paul@3 | 63 | return len(parts) > 1 and parts[-1] == get_queued_changes_page(request) |
paul@1 | 64 | |
paul@1 | 65 | def get_target_page_name(pagename): |
paul@1 | 66 | |
paul@3 | 67 | "Return the target page name for the given queued changes 'pagename'." |
paul@1 | 68 | |
paul@3 | 69 | return "/".join(pagename.split("/")[:-1]) |
paul@1 | 70 | |
paul@4 | 71 | def get_user_for_saving(request): |
paul@4 | 72 | |
paul@4 | 73 | "Return a user that can save pages with ACLs." |
paul@4 | 74 | |
paul@4 | 75 | username = get_queued_changes_user(request) |
paul@4 | 76 | uid = user.getUserId(request, username) |
paul@4 | 77 | |
paul@4 | 78 | # If the user does not exist, just return the existing user. |
paul@4 | 79 | |
paul@4 | 80 | if not uid: |
paul@4 | 81 | return request.user |
paul@4 | 82 | |
paul@4 | 83 | # Otherwise, return the privileged user. |
paul@4 | 84 | |
paul@4 | 85 | return user.User(request, uid) |
paul@4 | 86 | |
paul@4 | 87 | def add_access_control(request, body): |
paul@4 | 88 | |
paul@4 | 89 | """ |
paul@4 | 90 | Using the 'request', add an ACL to the page 'body' in order to prevent |
paul@4 | 91 | anyone other than reviewers from seeing it in the queue. |
paul@4 | 92 | """ |
paul@4 | 93 | |
paul@4 | 94 | # Find existing ACLs. |
paul@4 | 95 | |
paul@4 | 96 | match = acl_pattern.search(body) |
paul@4 | 97 | if match: |
paul@4 | 98 | start, end = match.span() |
paul@4 | 99 | |
paul@4 | 100 | # Comment out existing ACLs. |
paul@4 | 101 | |
paul@4 | 102 | parts = [] |
paul@4 | 103 | parts.append(body[:start]) |
paul@4 | 104 | parts.append("#") |
paul@4 | 105 | parts.append(body[start:]) |
paul@4 | 106 | else: |
paul@4 | 107 | parts = [body] |
paul@4 | 108 | |
paul@4 | 109 | # Add the ACL. |
paul@4 | 110 | |
paul@4 | 111 | parts.insert(0, "#acl %s:read,write,delete,revert,admin %s:write All:\n" % ( |
paul@4 | 112 | get_approved_editors_group(request), get_queued_changes_user(request))) |
paul@4 | 113 | return "".join(parts) |
paul@4 | 114 | |
paul@4 | 115 | def remove_access_control(request, body): |
paul@4 | 116 | |
paul@4 | 117 | "Using the 'request', remove any added ACL to the page 'body'." |
paul@4 | 118 | |
paul@4 | 119 | lines = body.split("\n") |
paul@4 | 120 | |
paul@4 | 121 | try: |
paul@4 | 122 | directive = lines[0].split()[0] |
paul@4 | 123 | if directive == "#acl": |
paul@4 | 124 | return "\n".join(lines[1:]) |
paul@4 | 125 | except ValueError: |
paul@4 | 126 | pass |
paul@4 | 127 | |
paul@4 | 128 | return body |
paul@4 | 129 | |
paul@4 | 130 | def get_page_signature(request, body): |
paul@4 | 131 | |
paul@4 | 132 | """ |
paul@4 | 133 | Using the 'request', return a signature/digest for the given page 'body' |
paul@4 | 134 | using a secret known only by the server. |
paul@4 | 135 | """ |
paul@4 | 136 | |
paul@4 | 137 | secret_key = get_secret_key(request) |
paul@4 | 138 | hash = hmac.new(secret_key, body.encode("utf-8"), sha1) |
paul@4 | 139 | return base64.standard_b64encode(hash.digest()) |
paul@4 | 140 | |
paul@4 | 141 | def sign_page(request, body): |
paul@4 | 142 | |
paul@4 | 143 | """ |
paul@4 | 144 | Using the 'request', sign the page 'body' using a secret known only by the |
paul@4 | 145 | server. |
paul@4 | 146 | """ |
paul@4 | 147 | |
paul@4 | 148 | return "#signature %s\n%s" % (get_page_signature(request, body), body) |
paul@4 | 149 | |
paul@4 | 150 | def check_page(request, body): |
paul@4 | 151 | |
paul@4 | 152 | """ |
paul@4 | 153 | Using the 'request', find and check the signature in the page 'body', |
paul@4 | 154 | returning the original page or None (if no valid signature is found). |
paul@4 | 155 | """ |
paul@4 | 156 | |
paul@4 | 157 | lines = body.split("\n") |
paul@4 | 158 | body = "\n".join(lines[1:]) |
paul@4 | 159 | |
paul@4 | 160 | try: |
paul@4 | 161 | directive, signature = lines[0].split() |
paul@4 | 162 | if directive == "#signature" and signature == get_page_signature(request, body): |
paul@4 | 163 | return body |
paul@4 | 164 | except ValueError: |
paul@4 | 165 | pass |
paul@4 | 166 | |
paul@4 | 167 | return None |
paul@4 | 168 | |
paul@1 | 169 | # Utility classes and associated functions. |
paul@1 | 170 | # NOTE: These are a subset of EventAggregatorSupport. |
paul@1 | 171 | |
paul@1 | 172 | class Form: |
paul@1 | 173 | |
paul@1 | 174 | """ |
paul@1 | 175 | A wrapper preserving MoinMoin 1.8.x (and earlier) behaviour in a 1.9.x |
paul@1 | 176 | environment. |
paul@1 | 177 | """ |
paul@1 | 178 | |
paul@1 | 179 | def __init__(self, form): |
paul@1 | 180 | self.form = form |
paul@1 | 181 | |
paul@1 | 182 | def get(self, name, default=None): |
paul@1 | 183 | values = self.form.getlist(name) |
paul@1 | 184 | if not values: |
paul@1 | 185 | return default |
paul@1 | 186 | else: |
paul@1 | 187 | return values |
paul@1 | 188 | |
paul@1 | 189 | def __getitem__(self, name): |
paul@1 | 190 | return self.form.getlist(name) |
paul@1 | 191 | |
paul@1 | 192 | class ActionSupport: |
paul@1 | 193 | |
paul@1 | 194 | """ |
paul@1 | 195 | Work around disruptive MoinMoin changes in 1.9, and also provide useful |
paul@1 | 196 | convenience methods. |
paul@1 | 197 | """ |
paul@1 | 198 | |
paul@1 | 199 | def get_form(self): |
paul@1 | 200 | return get_form(self.request) |
paul@1 | 201 | |
paul@1 | 202 | def get_form(request): |
paul@1 | 203 | |
paul@1 | 204 | "Work around disruptive MoinMoin changes in 1.9." |
paul@1 | 205 | |
paul@1 | 206 | if hasattr(request, "values"): |
paul@1 | 207 | return Form(request.values) |
paul@1 | 208 | else: |
paul@1 | 209 | return request.form |
paul@1 | 210 | |
paul@1 | 211 | # vim: tabstop=4 expandtab shiftwidth=4 |