oss/Radicale
oss/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-06-26 16:45:52 +00:00
Code Wiki Activity

Fix the auth checking algorithm

Browse source
This commit is contained in:
Guillaume Ayoub 2012-08-09 14:15:20 +02:00
parent e33ee8ea7c
commit 4fa53d15b3
1 changed files with 11 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

23
radicale/__init__.py
View file

@ -198,19 +198,18 @@ class Application(object):
# Get function corresponding to method # Get function corresponding to method
function = getattr(self, environ["REQUEST_METHOD"].lower()) function = getattr(self, environ["REQUEST_METHOD"].lower())
# Check rights # Ask authentication backend to check rights
if items and function != self.options: authorization = environ.get("HTTP_AUTHORIZATION", None)
# Ask authentication backend to check rights
authorization = environ.get("HTTP_AUTHORIZATION", None)
if authorization: if authorization:
auth = authorization.lstrip("Basic").strip().encode("ascii") auth = authorization.lstrip("Basic").strip().encode("ascii")
user, password = self.decode( user, password = self.decode(
base64.b64decode(auth), environ).split(":") base64.b64decode(auth), environ).split(":")
else: else:
user = password = None user = password = None
if access.is_authenticated(user, password): if not items or function == self.options or \
access.is_authenticated(user, password):
last_collection_allowed = None last_collection_allowed = None
allowed_items = [] allowed_items = []
for item in items: for item in items:
@ -226,7 +225,7 @@ class Application(object):
user, item.name or "/")) user, item.name or "/"))
last_collection_allowed = False last_collection_allowed = False
else: else:
# item is not a colleciton, it's the child of the last # item is not a collection, it's the child of the last
# collection we've met in the loop. Only add this item # collection we've met in the loop. Only add this item
# if this last collection was allowed. # if this last collection was allowed.
if last_collection_allowed: if last_collection_allowed: