[hg] galaxy 2463: Fix deleted user access bug discovered by Piet...

7 Jul 2009

details:   http://www.bx.psu.edu/hg/galaxy/rev/3a4561684257
changeset: 2463:3a4561684257
user:      Nate Coraor <nate@bx.psu.edu>
date:      Mon Jul 06 20:41:24 2009 -0400
description:
Fix deleted user access bug discovered by Pieter Neerincx

2 file(s) affected in this change:

lib/galaxy/web/framework/__init__.py
static/user_disabled.html

diffs (74 lines):

diff -r 8ad73e08978e -r 3a4561684257 lib/galaxy/web/framework/__init__.py

--- a/lib/galaxy/web/framework/__init__.py	Mon Jun 29 17:04:18 2009 -0400
+++ b/lib/galaxy/web/framework/__init__.py	Mon Jul 06 20:41:24 2009 -0400
@@ -147,6 +147,9 @@
         self.workflow_building_mode = False
         # Always have a valid galaxy session
         self.__ensure_valid_session( session_cookie )
+        # Prevent deleted users from accessing Galaxy
+        if self.app.config.use_remote_user and self.galaxy_session.user.deleted:
+            self.response.send_redirect( url_for( '/static/user_disabled.html' ) )
         if self.app.config.require_login:
             self.__ensure_logged_in_user( environ )
     def setup_i18n( self ):
@@ -279,6 +282,9 @@
                 invalidate_existing_session = True
                 log.warning( "User '%s' is an external user with an existing session, invalidating session since external auth is disabled",
                              galaxy_session.user.email )
+            elif galaxy_session is not None and galaxy_session.user is not None and galaxy_session.user.deleted:
+                invalidate_existing_session = True
+                log.warning( "User '%s' is marked deleted, invalidating session" % galaxy_session.user.email )
         # Do we need to invalidate the session for some reason?
         if invalidate_existing_session:
             prev_galaxy_session = galaxy_session
@@ -300,6 +306,9 @@
             if prev_galaxy_session:
                 objects_to_flush.append( prev_galaxy_session )            
             sa_session.flush( objects_to_flush )
+        # If the old session was invalid, get a new history with our new session
+        if invalidate_existing_session:
+            self.new_history()
     def __ensure_logged_in_user( self, environ ):
         allowed_paths = (
             url_for( controller='root', action='index' ),
@@ -368,8 +377,6 @@
             # We set default user permissions, before we log in and set the default history permissions
             self.app.security_agent.user_set_default_permissions( user )
             #self.log_event( "Automatically created account '%s'", user.email )
-        elif user.deleted:
-            return self.show_error_message( "Your account is no longer valid, contact your Galaxy administrator to activate your account." )
         return user
     def __update_session_cookie( self, name='galaxysession' ):
         """
diff -r 8ad73e08978e -r 3a4561684257 static/user_disabled.html
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/static/user_disabled.html	Mon Jul 06 20:41:24 2009 -0400
@@ -0,0 +1,28 @@
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+<html lang="en">
+    <head>
+        <title>Galaxy</title>
+        <style type="text/css">
+        body {
+            min-width: 500px;
+            text-align: center;
+        }
+        .errormessage {
+            font: 75%% verdana, "Bitstream Vera Sans", geneva, arial, helvetica, helve, sans-serif;
+            padding: 10px;
+            margin: 100px auto;
+            min-height: 32px;
+            max-width: 500px;
+            border: 1px solid #AA6666;
+            background-color: #FFCCCC;
+            text-align: left;
+        }
+        </style>
+    </head>
+    <body>
+        <div class="errormessage">
+            <h4>Account Disabled</h4>
+            <p>Your account is no longer valid, contact your Galaxy administrator to activate your account.</p>
+        </div>
+    </body>
+</html>

    

Nate Coraor

tags

participants (1)