mirrors/calibre-web
1
0
Fork 0
mirror of https://github.com/janeczku/calibre-web synced 2024-12-26 01:50:31 +00:00
Code Issues Releases Wiki Activity

Sanitze username for logging

Browse Source
This commit is contained in:
Ozzie Isaacs 2024-01-06 16:07:43 +01:00
parent 977f07364b
commit f0cc93abd3
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
cps/web.py
View File

@ -1354,21 +1354,21 @@ def login():
@limiter.limit("3/minute", key_func=lambda: request.form.get('username', "").strip().lower()) @limiter.limit("3/minute", key_func=lambda: request.form.get('username', "").strip().lower())
def login_post(): def login_post():
form = request.form.to_dict() form = request.form.to_dict()
username = form.get('username', "").strip().lower().replace("\n","\\n").replace("\r","")
try: try:
limiter.check() limiter.check()
except RateLimitExceeded: except RateLimitExceeded:
flash(_(u"Please wait one minute before next login"), category="error") flash(_(u"Please wait one minute before next login"), category="error")
return render_login(form.get("username", ""), form.get("password", "")) return render_login(username, form.get("password", ""))
if current_user is not None and current_user.is_authenticated: if current_user is not None and current_user.is_authenticated:
return redirect(url_for('web.index')) return redirect(url_for('web.index'))
if config.config_login_type == constants.LOGIN_LDAP and not services.ldap: if config.config_login_type == constants.LOGIN_LDAP and not services.ldap:
log.error(u"Cannot activate LDAP authentication") log.error(u"Cannot activate LDAP authentication")
flash(_(u"Cannot activate LDAP authentication"), category="error") flash(_(u"Cannot activate LDAP authentication"), category="error")
user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == form.get('username', "").strip().lower()) \ user = ub.session.query(ub.User).filter(func.lower(ub.User.name) == username).first()
.first()
remember_me = bool(form.get('remember_me')) remember_me = bool(form.get('remember_me'))
if config.config_login_type == constants.LOGIN_LDAP and services.ldap and user and form['password'] != "": if config.config_login_type == constants.LOGIN_LDAP and services.ldap and user and form['password'] != "":
login_result, error = services.ldap.bind_user(form['username'], form['password']) login_result, error = services.ldap.bind_user(username, form['password'])
if login_result: if login_result:
log.debug(u"You are now logged in as: '{}'".format(user.name)) log.debug(u"You are now logged in as: '{}'".format(user.name))
return handle_login_user(user, return handle_login_user(user,
@ -1388,7 +1388,7 @@ def login_post():
flash(_(u"Could not login: %(message)s", message=error), category="error") flash(_(u"Could not login: %(message)s", message=error), category="error")
else: else:
ip_address = request.headers.get('X-Forwarded-For', request.remote_addr) ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
log.warning('LDAP Login failed for user "%s" IP-address: %s', form['username'], ip_address) log.warning('LDAP Login failed for user "%s" IP-address: %s', username, ip_address)
flash(_(u"Wrong Username or Password"), category="error") flash(_(u"Wrong Username or Password"), category="error")
else: else:
ip_address = request.headers.get('X-Forwarded-For', request.remote_addr) ip_address = request.headers.get('X-Forwarded-For', request.remote_addr)
@ -1397,7 +1397,7 @@ def login_post():
ret, __ = reset_password(user.id) ret, __ = reset_password(user.id)
if ret == 1: if ret == 1:
flash(_(u"New Password was send to your email address"), category="info") flash(_(u"New Password was send to your email address"), category="info")
log.info('Password reset for user "%s" IP-address: %s', form['username'], ip_address) log.info('Password reset for user "%s" IP-address: %s', username, ip_address)
else: else:
log.error(u"An unknown error occurred. Please try again later") log.error(u"An unknown error occurred. Please try again later")
flash(_(u"An unknown error occurred. Please try again later."), category="error") flash(_(u"An unknown error occurred. Please try again later."), category="error")
@ -1413,9 +1413,9 @@ def login_post():
_(u"You are now logged in as: '%(nickname)s'", nickname=user.name), _(u"You are now logged in as: '%(nickname)s'", nickname=user.name),
"success") "success")
else: else:
log.warning('Login failed for user "{}" IP-address: {}'.format(form['username'], ip_address)) log.warning('Login failed for user "{}" IP-address: {}'.format(username, ip_address))
flash(_(u"Wrong Username or Password"), category="error") flash(_(u"Wrong Username or Password"), category="error")
return render_login(form.get("username", ""), form.get("password", "")) return render_login(username, form.get("password", ""))
@web.route('/logout') @web.route('/logout')