Zixuan James Li 7dbd98d25c rest: Restrict access to json views via basic auth. ...

Previously, test cases or clients accessing /json/ views using HTTP
Basic Auth would be accepted, while we intended to only allow clients
authenticated with a session cookie to access these views.

This adds a check on the accessed path to avoid this possibility.

It seems unlikely that any API clients clients were taking advantage
of this unintended quirk; so we're not going to bother documenting
this bug fix as an API change. In any case, it should be trivial for
anyone affected to consult the documentation and then switch their
/json/foo URL to a correct /api/v1/foo URL.

Signed-off-by: Zixuan James Li <p359101898@gmail.com>

2022-11-04 14:44:07 -07:00

..

actions

ruff: Fix C416 Unnecessary set comprehension (rewrite using set()).

2022-11-03 12:10:15 -07:00

data_import

slack: Skip files where file_access: file_not_found.

2022-10-25 12:18:20 -07:00

integration_fixtures/nagios

…

lib

rest: Restrict access to json views via basic auth.

2022-11-04 14:44:07 -07:00

management

delete_realm: Use Message.realm column for message count.

2022-10-31 09:57:42 -07:00

migrations

migrations: Add migration to migrate pronouns custom profile fields.

2022-11-04 14:31:18 -07:00

openapi

requirements: Upgrade Python requirements.

2022-11-03 14:08:58 -07:00

tests

rest: Restrict access to json views via basic auth.

2022-11-04 14:44:07 -07:00

tornado

register: Handle "Pronouns" type fields for older mobile clients.

2022-11-04 14:31:18 -07:00

views

register: Handle "Pronouns" type fields for older mobile clients.

2022-11-04 14:31:18 -07:00

webhooks

ruff: Fix C414 Unnecessary list call within sorted().

2022-11-03 12:10:15 -07:00

worker

python: Use format string for logging str(obj).

2022-10-10 08:32:29 -07:00

__init__.py

…

apps.py

sentry: Initialize sentry in AppConfig ready hook.

2022-09-26 12:42:36 -07:00

context_processors.py

templates: Rename OPEN_GRAPH variables to PAGE or PAGE_METADATA.

2022-09-06 14:57:06 -07:00

decorator.py

python: Clean up getattr, setattr, delattr calls with literal names.

2022-10-10 08:40:28 -07:00

filters.py

…

forms.py

forms: Fix another 500 error on realm creation with invalid email.

2022-09-19 14:12:32 -07:00

logging_handlers.py

python: Use Python 3.8 typing.{Protocol,TypedDict}.

2022-04-27 12:57:49 -07:00

middleware.py

python: Clean up getattr, setattr, delattr calls with literal names.

2022-10-10 08:40:28 -07:00

models.py

ruff: Fix C413 Unnecessary list call around sorted().

2022-11-03 12:10:15 -07:00

signals.py

requirements: Upgrade to Django 4.0.

2022-07-13 16:07:17 -07:00