oss/Radicale
oss/Radicale
1
0
Fork 0
mirror of https://github.com/Kozea/Radicale.git synced 2025-06-26 16:45:52 +00:00
Code Wiki Activity

Now rights can be add to user groups too.

Browse source
This commit is contained in:
Peter Varkoly 2022-02-21 17:15:21 +01:00
parent eda8309a04
commit 8d19fd7a64
4 changed files with 27 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

5
radicale/app/__init__.py
View file

@ -237,6 +237,11 @@ class Application(ApplicationPartDelete, ApplicationPartHead,
authorization.encode("ascii"))).split(":", 1) authorization.encode("ascii"))).split(":", 1)
user = self._auth.login(login, password) or "" if login else "" user = self._auth.login(login, password) or "" if login else ""
try:
logger.debug("Groups %r",",".join(self._auth._ldap_groups))
self._rights._user_groups = self._auth._ldap_groups
except AttributeError:
pass
if user and login == user: if user and login == user:
logger.info("Successful login: %r", user) logger.info("Successful login: %r", user)
elif user: elif user:

2
radicale/auth/__init__.py
View file

@ -44,6 +44,8 @@ def load(configuration: "config.Configuration") -> "BaseAuth":
class BaseAuth: class BaseAuth:
_ldap_groups: set
def __init__(self, configuration: "config.Configuration") -> None: def __init__(self, configuration: "config.Configuration") -> None:
"""Initialize BaseAuth. """Initialize BaseAuth.

3
radicale/auth/ldap.py
View file

@ -35,7 +35,6 @@ class Auth(auth.BaseAuth):
_ldap_secret: str _ldap_secret: str
_ldap_filter: str _ldap_filter: str
_ldap_load_groups: bool _ldap_load_groups: bool
_ldap_groups = set
def __init__(self, configuration: config.Configuration) -> None: def __init__(self, configuration: config.Configuration) -> None:
super().__init__(configuration) super().__init__(configuration)
@ -88,5 +87,3 @@ class Auth(auth.BaseAuth):
return login return login
except ldap.INVALID_CREDENTIALS: except ldap.INVALID_CREDENTIALS:
return "" return ""

38
radicale/rights/from_file.py
View file

@ -34,7 +34,7 @@ Leading or ending slashes are trimmed from collection's path.
""" """
import configparser from configparser import ConfigParser
import re import re
from radicale import config, pathutils, rights from radicale import config, pathutils, rights
@ -44,15 +44,17 @@ from radicale.log import logger
class Rights(rights.BaseRights): class Rights(rights.BaseRights):
_filename: str _filename: str
_rights_config _rights_config: ConfigParser
_user_groups: set
def __init__(self, configuration: config.Configuration) -> None: def __init__(self, configuration: config.Configuration) -> None:
super().__init__(configuration) super().__init__(configuration)
self._filename = configuration.get("rights", "file") self._filename = configuration.get("rights", "file")
_rights_config = configparser.ConfigParser() self._rights_config = ConfigParser()
try: try:
with open(self._filename, "r") as f: with open(self._filename, "r") as f:
_rights_config.read_file(f) self._rights_config.read_file(f)
logger.debug("Rights were read")
except Exception as e: except Exception as e:
raise RuntimeError("Failed to load rights file %r: %s" % raise RuntimeError("Failed to load rights file %r: %s" %
(self._filename, e)) from e (self._filename, e)) from e
@ -62,40 +64,40 @@ class Rights(rights.BaseRights):
sane_path = pathutils.strip_path(path) sane_path = pathutils.strip_path(path)
# Prevent "regex injection" # Prevent "regex injection"
escaped_user = re.escape(user) escaped_user = re.escape(user)
logger.debug("authorization called %r %r",user,path)
for section in _rights_config.sections(): for section in self._rights_config.sections():
user_match = False
group_match = [] group_match = []
collection_match = False
try: try:
collection_pattern = _rights_config.get(section, "collection") collection_pattern = self._rights_config.get(section, "collection")
user_pattern = _rights_config.get(section, "user", fallback = "") user_pattern = self._rights_config.get(section, "user", fallback = "")
groups = _rights_config.get(section, "groups", fallback = "").split(",") groups = self._rights_config.get(section, "groups", fallback = "").split(",")
try: try:
group_match = self._auth._ldap_groups & set(groups) group_match = self._user_groups & set(groups)
except NameError: logger.debug("Groups %r, %r",",".join(group_match),";".join(groups))
except:
pass pass
# Use empty format() for harmonized handling of curly braces # Use empty format() for harmonized handling of curly braces
user_match = re.fullmatch(user_pattern.format(), user) user_match = re.fullmatch(user_pattern.format(), user)
collection_match = re.fullmatch( u_collection_match = user_match and re.fullmatch(
collection_pattern.format( collection_pattern.format(
*(re.escape(s) for s in user_match.groups()), *(re.escape(s) for s in user_match.groups()),
user=escaped_user), sane_path) user=escaped_user), sane_path)
g_collection_match = re.fullmatch( collection_pattern.format(user=escaped_user), sane_path)
except Exception as e: except Exception as e:
raise RuntimeError("Error in section %r of rights file %r: " raise RuntimeError("Error in section %r of rights file %r: "
"%s" % (section, self._filename, e)) from e "%s" % (section, self._filename, e)) from e
if user_match and collection_match: if user_match and u_collection_match:
logger.debug("User rule %r:%r matches %r:%r from section %r", logger.debug("User rule %r:%r matches %r:%r from section %r",
user, sane_path, user_pattern, user, sane_path, user_pattern,
collection_pattern, section) collection_pattern, section)
return _rights_config.get(section, "permissions") return self._rights_config.get(section, "permissions")
if len(group_match) > 0 and collection_match: if len(group_match) > 0 and g_collection_match:
logger.debug("Group rule %r:%r matches %r from section %r", logger.debug("Group rule %r:%r matches %r from section %r",
group_match, sane_path, group_match, sane_path,
collection_pattern, section) collection_pattern, section)
return _rights_config.get(section, "permissions") return self._rights_config.get(section, "permissions")
logger.debug("Rule %r:%r doesn't match %r:%r from section %r", logger.debug("Rule %r:%r doesn't match %r:%r from section %r",
user, sane_path, user_pattern, collection_pattern, user, sane_path, user_pattern, collection_pattern,
section) section)