[PATCH] move to WSGI and form-based login and authentication

[James Cammarata]

Pushed to my github:

https://github.com/jimi1283/cobbler/commit/07b5da0502a2a00709485f8328171a...
https://github.com/jimi1283/cobbler/commit/be4fc806637cf8cec275fea80b8921...

commit 07b5da0502a2a00709485f8328171a8ea8c2da1e
Author: James Cammarata <jimi(a)sngx.net&gt;
Date:   Sat Mar 26 17:39:34 2011 -0500

    Initial commit for form-based login and authentication

commit be4fc806637cf8cec275fea80b892182879580eb
Author: James Cammarata <jimi(a)sngx.net&gt;
Date:   Sat Mar 26 12:04:01 2011 -0500

    Convert webui to use WSGI instead of mod_python


These two commits are co-dependent, since doing basic auth with the
WSGI module is kind of a PITA. I've only tested this on my devel box,
so it really needs to be installed on a clean box to make sure I
didn't miss something.  I do a lot of django development on my system,
so it's possible I assumed something was good to go. I also have
django 1.2 on my system, so I may have unwittingly used a newer
language feature even though I tried to avoid doing so.

[James Cammarata]

Forgot a file:

https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...

commit 4ec3733b5ffbf8abd3059653fe4a4874ff99c781
Author: James Cammarata <jimi(a)sngx.net&gt;
Date:   Sat Mar 26 18:13:33 2011 -0500

    Minor fixes to cobbler.conf, since the AliasMatch was conflicting
with the WSGI script alias



On Sat, Mar 26, 2011 at 6:50 PM, James Cammarata <jimi(a)sngx.net&gt; wrote:
>  Pushed to my github:
>
>  https://github.com/jimi1283/cobbler/commit/07b5da0502a2a00709485f8328171a...
>  https://github.com/jimi1283/cobbler/commit/be4fc806637cf8cec275fea80b8921...
>
>  commit 07b5da0502a2a00709485f8328171a8ea8c2da1e
>  Author: James Cammarata <jimi(a)sngx.net&gt;
>  Date:   Sat Mar 26 17:39:34 2011 -0500
>
>     Initial commit for form-based login and authentication
>
>  commit be4fc806637cf8cec275fea80b892182879580eb
>  Author: James Cammarata <jimi(a)sngx.net&gt;
>  Date:   Sat Mar 26 12:04:01 2011 -0500
>
>     Convert webui to use WSGI instead of mod_python
>
>
>  These two commits are co-dependent, since doing basic auth with the
>  WSGI module is kind of a PITA. I've only tested this on my devel box,
>  so it really needs to be installed on a clean box to make sure I
>  didn't miss something.  I do a lot of django development on my system,
>  so it's possible I assumed something was good to go. I also have
>  django 1.2 on my system, so I may have unwittingly used a newer
>  language feature even though I tried to avoid doing so.
>

[Scott Henson]

On Sat, 26 Mar 2011 19:12:43 -0500, James Cammarata <jimi(a)sngx.net&gt; wrote:
>  Forgot a file:
>  
>  https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...
Merged, thanks.

-- 
Scott Henson
Red Hat CIS Operator
WVU Alum BSAE/BSME

[Jonathan Sabo]

On Mon, Mar 28, 2011 at 4:11 PM, Scott Henson <shenson(a)redhat.com&gt; wrote:
>  On Sat, 26 Mar 2011 19:12:43 -0500, James Cammarata
> <jimi(a)sngx.net&gt; wrote:
> > Forgot a file:
> >
> > https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...
>
>  Merged, thanks.
>
>  --
>  Scott Henson
>  Red Hat CIS Operator
>  WVU Alum BSAE/BSME
>
>  _______________________________________________
>  cobbler-devel mailing list
>  cobbler-devel(a)lists.fedorahosted.org
>  https://fedorahosted.org/mailman/listinfo/cobbler-devel
>
>  
It's throwing exceptions when you log in with the wrong username or
password.  Did you not see that when you tested it?

[James Cammarata]

Whoopsie... I didn't catch that. I'll send in a patch tonight, the
remote.login() call just needs to be wrapped in a try/except.
On Mar 30, 2011 12:55 PM, "Jonathan Sabo" <jsabo(a)criminal.org&gt; wrote:
>  On Mon, Mar 28, 2011 at 4:11 PM, Scott Henson
> <shenson(a)redhat.com&gt; wrote:
> > On Sat, 26 Mar 2011 19:12:43 -0500, James Cammarata <jimi(a)sngx.net&gt;
wrote:
> >> Forgot a file:
> >>
> >>
https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...
> >
> > Merged, thanks.
> >
> > --
> > Scott Henson
> > Red Hat CIS Operator
> > WVU Alum BSAE/BSME
> >
> > _______________________________________________
> > cobbler-devel mailing list
> > cobbler-devel(a)lists.fedorahosted.org
> > https://fedorahosted.org/mailman/listinfo/cobbler-devel
> >
> >
>
>  It's throwing exceptions when you log in with the wrong username or
>  password. Did you not see that when you tested it?

[Jonathan Sabo]

Can you also try and click on "edit" in the Cobbler kickstart
templates and see why that's throwing exceptions as well.   I'm not
positive it's related to these changes.  Here is the traceback.

Environment:

Request Method: GET
Request URL:
http://192.168.69.3/cobbler_web/ksfile/edit/var/lib/cobbler/kickstarts/ks...
Django Version: 1.1.1
Python Version: 2.4.3
Installed Applications:
['django.contrib.auth',
 'django.contrib.contenttypes',
 'django.contrib.sessions',
 'django.contrib.sites',
 'cobbler_web']
Installed Middleware:
('django.middleware.common.CommonMiddleware',
 'django.contrib.sessions.middleware.SessionMiddleware',
 'django.contrib.auth.middleware.AuthenticationMiddleware')


Traceback:
File "/usr/lib/python2.4/site-packages/django/core/handlers/base.py"
in get_response
  92.                 response = callback(request, *callback_args,
**callback_kwargs)
File "/usr/share/cobbler/web/cobbler_web/views.py" in ksfile_edit
  611.       ksdata =
remote.read_or_write_kickstart_template(ksfile_name, True, "",
request.session['token'])
File "/usr/lib64/python2.4/xmlrpclib.py" in __call__
  1096.         return self.__send(self.__name, args)
File "/usr/lib64/python2.4/xmlrpclib.py" in __request
  1383.             verbose=self.__verbose
File "/usr/lib64/python2.4/xmlrpclib.py" in request
  1147.         return self._parse_response(h.getfile(), sock)
File "/usr/lib64/python2.4/xmlrpclib.py" in _parse_response
  1286.         return u.close()
File "/usr/lib64/python2.4/xmlrpclib.py" in close
  744.             raise Fault(**self._stack[0])

Exception Type: Fault at
/ksfile/edit/var/lib/cobbler/kickstarts/ks-vmware-esxi4.1-x86_64
Exception Value: <Fault 1: "cobbler.cexceptions.CX:'tainted file
location'">


On Wed, Mar 30, 2011 at 3:02 PM, James Cammarata <jimi(a)sngx.net&gt; wrote:
>  Whoopsie... I didn't catch that. I'll send in a patch
> tonight, the
>  remote.login() call just needs to be wrapped in a try/except.
>
>  On Mar 30, 2011 12:55 PM, "Jonathan Sabo" <jsabo(a)criminal.org&gt; wrote:
> > On Mon, Mar 28, 2011 at 4:11 PM, Scott Henson <shenson(a)redhat.com&gt; wrote:
> >> On Sat, 26 Mar 2011 19:12:43 -0500, James Cammarata <jimi(a)sngx.net&gt;
> >> wrote:
> >>> Forgot a file:
> >>>
> >>>
> >>>
> https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...
> >>
> >> Merged, thanks.
> >>
> >> --
> >> Scott Henson
> >> Red Hat CIS Operator
> >> WVU Alum BSAE/BSME
> >>
> >> _______________________________________________
> >> cobbler-devel mailing list
> >> cobbler-devel(a)lists.fedorahosted.org
> >> https://fedorahosted.org/mailman/listinfo/cobbler-devel
> >>
> >>
> >
> > It's throwing exceptions when you log in with the wrong username or
> > password. Did you not see that when you tested it?
>

[James Cammarata]

Woah that's an odd one. Happens with snippets too. I'll add that to the
list.
On Mar 30, 2011 2:43 PM, "Jonathan Sabo" <jsabo(a)criminal.org&gt; wrote:
>  Can you also try and click on "edit" in the Cobbler
> kickstart
>  templates and see why that's throwing exceptions as well. I'm not
>  positive it's related to these changes. Here is the traceback.
>
>  Environment:
>
>  Request Method: GET
>  Request URL:
http://192.168.69.3/cobbler_web/ksfile/edit/var/lib/cobbler/kickstarts/ks...
>  Django Version: 1.1.1
>  Python Version: 2.4.3
>  Installed Applications:
>  ['django.contrib.auth',
>  'django.contrib.contenttypes',
>  'django.contrib.sessions',
>  'django.contrib.sites',
>  'cobbler_web']
>  Installed Middleware:
>  ('django.middleware.common.CommonMiddleware',
>  'django.contrib.sessions.middleware.SessionMiddleware',
>  'django.contrib.auth.middleware.AuthenticationMiddleware')
>
>
>  Traceback:
>  File "/usr/lib/python2.4/site-packages/django/core/handlers/base.py"
>  in get_response
>  92. response = callback(request, *callback_args,
>  **callback_kwargs)
>  File "/usr/share/cobbler/web/cobbler_web/views.py" in ksfile_edit
>  611. ksdata =
>  remote.read_or_write_kickstart_template(ksfile_name, True, "",
>  request.session['token'])
>  File "/usr/lib64/python2.4/xmlrpclib.py" in __call__
>  1096. return self.__send(self.__name, args)
>  File "/usr/lib64/python2.4/xmlrpclib.py" in __request
>  1383. verbose=self.__verbose
>  File "/usr/lib64/python2.4/xmlrpclib.py" in request
>  1147. return self._parse_response(h.getfile(), sock)
>  File "/usr/lib64/python2.4/xmlrpclib.py" in _parse_response
>  1286. return u.close()
>  File "/usr/lib64/python2.4/xmlrpclib.py" in close
>  744. raise Fault(**self._stack[0])
>
>  Exception Type: Fault at
>  /ksfile/edit/var/lib/cobbler/kickstarts/ks-vmware-esxi4.1-x86_64
>  Exception Value: <Fault 1: "cobbler.cexceptions.CX:'tainted file
location'">
>  On Wed, Mar 30, 2011 at 3:02 PM, James Cammarata <jimi(a)sngx.net&gt; wrote:
> > Whoopsie... I didn't catch that. I'll send in a patch tonight, the
> > remote.login() call just needs to be wrapped in a try/except.
> >
> > On Mar 30, 2011 12:55 PM, "Jonathan Sabo" <jsabo(a)criminal.org&gt;
> wrote:
> >> On Mon, Mar 28, 2011 at 4:11 PM, Scott Henson <shenson(a)redhat.com&gt;
wrote:
> >>> On Sat, 26 Mar 2011 19:12:43 -0500, James Cammarata
> <jimi(a)sngx.net&gt;
> >>> wrote:
> >>>> Forgot a file:
> >>>>
> >>>>
> >>>>
https://github.com/jimi1283/cobbler/commit/4ec3733b5ffbf8abd3059653fe4a48...
> >>>
> >>> Merged, thanks.
> >>>
> >>> --
> >>> Scott Henson
> >>> Red Hat CIS Operator
> >>> WVU Alum BSAE/BSME
> >>>
> >>> _______________________________________________
> >>> cobbler-devel mailing list
> >>> cobbler-devel(a)lists.fedorahosted.org
> >>> https://fedorahosted.org/mailman/listinfo/cobbler-devel
> >>>
> >>>
> >>
> >> It's throwing exceptions when you log in with the wrong username or
> >> password. Did you not see that when you tested it?
> >

[James Cammarata]

On Wed, Mar 30, 2011 at 3:16 PM, James Cammarata <jimi(a)sngx.net&gt; wrote:
>  Woah that's an odd one. Happens with snippets too. I'll add
> that to the
>  list.
>
>  On Mar 30, 2011 2:43 PM, "Jonathan Sabo" <jsabo(a)criminal.org&gt; wrote:
> > Can you also try and click on "edit" in the Cobbler kickstart
> > templates and see why that's throwing exceptions as well. I'm not
> > positive it's related to these changes. Here is the traceback. 
The code it throws up on is in remote.py:

        if snippet_file.find("..") != -1 or not
snippet_file.startswith("/"):
            utils.die(self.logger, "tainted file location")

The snippet name being passed in by the web code is (from my traceback
during testing):

 u'var/lib/cobbler/snippets/cobbler_register'

So it dislikes that the path doesn't start with a /. This may have
been due to the changes I made to urls.py for the WSGI stuff, but I
doubt it. Still looking into things trying to find where the breakage
is occuring...  The URL for this was
/cobbler_web/snippet/edit//var/lib/cobbler/snippets/cobbler_register,
so I don't see how my changes would have broken this without breaking
everything.