file-store: don't response with cookies on file-store download.

rhodecode/apps/file_store/views.py

@@ -1,174 +1,177 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2019 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 import logging
 
 from pyramid.view import view_config
 from pyramid.response import FileResponse
 from pyramid.httpexceptions import HTTPFound, HTTPNotFound
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.apps.file_store import utils
 from rhodecode.apps.file_store.exceptions import (
     FileNotAllowedException, FileOverSizeException)
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     CSRFRequired, NotAnonymous, HasRepoPermissionAny, HasRepoGroupPermissionAny,
     LoginRequired)
 from rhodecode.model.db import Session, FileStore, UserApiKeys
 
 log = logging.getLogger(__name__)
 
 
 class FileStoreView(BaseAppView):
     upload_key = 'store_file'
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         self.storage = utils.get_file_storage(self.request.registry.settings)
         return c
 
     def _serve_file(self, file_uid):
 
         if not self.storage.exists(file_uid):
             store_path = self.storage.store_path(file_uid)
             log.debug('File with FID:%s not found in the store under `%s`',
                       file_uid, store_path)
             raise HTTPNotFound()
 
         db_obj = FileStore().query().filter(FileStore.file_uid == file_uid).scalar()
         if not db_obj:
             raise HTTPNotFound()
 
         # private upload for user
         if db_obj.check_acl and db_obj.scope_user_id:
             log.debug('Artifact: checking scope access for bound artifact user: `%s`',
                       db_obj.scope_user_id)
             user = db_obj.user
             if self._rhodecode_db_user.user_id != user.user_id:
                 log.warning('Access to file store object forbidden')
                 raise HTTPNotFound()
 
         # scoped to repository permissions
         if db_obj.check_acl and db_obj.scope_repo_id:
             log.debug('Artifact: checking scope access for bound artifact repo: `%s`',
                       db_obj.scope_repo_id)
             repo = db_obj.repo
             perm_set = ['repository.read', 'repository.write', 'repository.admin']
             has_perm = HasRepoPermissionAny(*perm_set)(repo.repo_name, 'FileStore check')
             if not has_perm:
                 log.warning('Access to file store object `%s` forbidden', file_uid)
                 raise HTTPNotFound()
 
         # scoped to repository group permissions
         if db_obj.check_acl and db_obj.scope_repo_group_id:
             log.debug('Artifact: checking scope access for bound artifact repo group: `%s`',
                       db_obj.scope_repo_group_id)
             repo_group = db_obj.repo_group
             perm_set = ['group.read', 'group.write', 'group.admin']
             has_perm = HasRepoGroupPermissionAny(*perm_set)(repo_group.group_name, 'FileStore check')
             if not has_perm:
                 log.warning('Access to file store object `%s` forbidden', file_uid)
                 raise HTTPNotFound()
 
         FileStore.bump_access_counter(file_uid)
 
         file_path = self.storage.store_path(file_uid)
         return FileResponse(file_path)
+        # For file store we don't submit any session data, this logic tells the
+        # Session lib to skip it
+        setattr(self.request, '_file_response', True)
 
     @LoginRequired()
     @NotAnonymous()
     @CSRFRequired()
     @view_config(route_name='upload_file', request_method='POST', renderer='json_ext')
     def upload_file(self):
         self.load_default_context()
         file_obj = self.request.POST.get(self.upload_key)
 
         if file_obj is None:
             return {'store_fid': None,
                     'access_path': None,
                     'error': '{} data field is missing'.format(self.upload_key)}
 
         if not hasattr(file_obj, 'filename'):
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'filename cannot be read from the data field'}
 
         filename = file_obj.filename
 
         metadata = {
             'user_uploaded': {'username': self._rhodecode_user.username,
                               'user_id': self._rhodecode_user.user_id,
                               'ip': self._rhodecode_user.ip_addr}}
         try:
             store_uid, metadata = self.storage.save_file(
                 file_obj.file, filename, extra_metadata=metadata)
         except FileNotAllowedException:
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} is not allowed.'.format(filename)}
 
         except FileOverSizeException:
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} is exceeding allowed limit.'.format(filename)}
 
         try:
             entry = FileStore.create(
                 file_uid=store_uid, filename=metadata["filename"],
                 file_hash=metadata["sha256"], file_size=metadata["size"],
                 file_description=u'upload attachment',
                 check_acl=False, user_id=self._rhodecode_user.user_id
             )
             Session().add(entry)
             Session().commit()
             log.debug('Stored upload in DB as %s', entry)
         except Exception:
             log.exception('Failed to store file %s', filename)
             return {'store_fid': None,
                     'access_path': None,
                     'error': 'File {} failed to store in DB.'.format(filename)}
 
         return {'store_fid': store_uid,
                 'access_path': h.route_path('download_file', fid=store_uid)}
 
     # ACL is checked by scopes, if no scope the file is accessible to all
     @view_config(route_name='download_file')
     def download_file(self):
         self.load_default_context()
         file_uid = self.request.matchdict['fid']
         log.debug('Requesting FID:%s from store %s', file_uid, self.storage)
         return self._serve_file(file_uid)
 
     # in addition to @LoginRequired ACL is checked by scopes
     @LoginRequired(auth_token_access=[UserApiKeys.ROLE_ARTIFACT_DOWNLOAD])
     @NotAnonymous()
     @view_config(route_name='download_file_by_token')
     def download_file_by_token(self):
         """
         Special view that allows to access the download file by special URL that
         is stored inside the URL.
 
         http://example.com/_file_store/token-download/TOKEN/FILE_UID
         """
         self.load_default_context()
         file_uid = self.request.matchdict['fid']
         return self._serve_file(file_uid)

rhodecode/lib/rc_beaker.py

@@ -1,200 +1,204 b''
 # Copyright (c) 2010 Agendaless Consulting and Contributors.
 # (http://www.agendaless.com), All Rights Reserved
 # License: BSD-derived (http://www.repoze.org/LICENSE.txt)
 # With Patches from RhodeCode GmBH
 
 
 import os
 
 from beaker import cache
 from beaker.session import SessionObject
 from beaker.util import coerce_cache_params
 from beaker.util import coerce_session_params
 
 from pyramid.interfaces import ISession
 from pyramid.settings import asbool
 from zope.interface import implementer
 
 from binascii import hexlify
 
 
 def BeakerSessionFactoryConfig(**options):
     """ Return a Pyramid session factory using Beaker session settings
     supplied directly as ``**options``"""
 
     class PyramidBeakerSessionObject(SessionObject):
         _options = options
         _cookie_on_exception = _options.pop('cookie_on_exception', True)
         _constant_csrf_token = _options.pop('constant_csrf_token', False)
 
         def __init__(self, request):
             SessionObject.__init__(self, request.environ, **self._options)
 
             def session_callback(request, response):
                 exception = getattr(request, 'exception', None)
-                if (exception is None or self._cookie_on_exception) and self.accessed():
+                file_response = getattr(request, '_file_response', None)
+
+                if file_response is None \
+                        and (exception is None or self._cookie_on_exception) \
+                        and self.accessed():
                     self.persist()
                     headers = self.__dict__['_headers']
-                    if headers['set_cookie'] and headers['cookie_out']:
+                    if headers.get('set_cookie') and headers.get('cookie_out'):
                         response.headerlist.append(('Set-Cookie', headers['cookie_out']))
             request.add_response_callback(session_callback)
 
         # ISession API
 
         @property
         def id(self):
             # this is as inspected in SessionObject.__init__
             if self.__dict__['_params'].get('type') != 'cookie':
                 return self._session().id
             return None
 
         @property
         def new(self):
             return self.last_accessed is None
 
         changed = SessionObject.save
 
         # modifying dictionary methods
 
         @call_save
         def clear(self):
             return self._session().clear()
 
         @call_save
         def update(self, d, **kw):
             return self._session().update(d, **kw)
 
         @call_save
         def setdefault(self, k, d=None):
             return self._session().setdefault(k, d)
 
         @call_save
         def pop(self, k, d=None):
             return self._session().pop(k, d)
 
         @call_save
         def popitem(self):
             return self._session().popitem()
 
         __setitem__ = call_save(SessionObject.__setitem__)
         __delitem__ = call_save(SessionObject.__delitem__)
 
         # Flash API methods
         def flash(self, msg, queue='', allow_duplicate=True):
             storage = self.setdefault('_f_' + queue, [])
             if allow_duplicate or (msg not in storage):
                 storage.append(msg)
 
         def pop_flash(self, queue=''):
             storage = self.pop('_f_' + queue, [])
             return storage
 
         def peek_flash(self, queue=''):
             storage = self.get('_f_' + queue, [])
             return storage
 
         # CSRF API methods
         def new_csrf_token(self):
             token = (self._constant_csrf_token
                      or hexlify(os.urandom(20)).decode('ascii'))
             self['_csrft_'] = token
             return token
 
         def get_csrf_token(self):
             token = self.get('_csrft_', None)
             if token is None:
                 token = self.new_csrf_token()
             return token
 
     return implementer(ISession)(PyramidBeakerSessionObject)
 
 
 def call_save(wrapped):
     """ By default, in non-auto-mode beaker badly wants people to
     call save even though it should know something has changed when
     a mutating method is called.  This hack should be removed if
     Beaker ever starts to do this by default. """
     def save(session, *arg, **kw):
         value = wrapped(session, *arg, **kw)
         session.save()
         return value
     save.__doc__ = wrapped.__doc__
     return save
 
 
 def session_factory_from_settings(settings):
     """ Return a Pyramid session factory using Beaker session settings
     supplied from a Paste configuration file"""
     prefixes = ('session.', 'beaker.session.')
     options = {}
 
     # Pull out any config args meant for beaker session. if there are any
     for k, v in settings.items():
         for prefix in prefixes:
             if k.startswith(prefix):
                 option_name = k[len(prefix):]
                 if option_name == 'cookie_on_exception':
                     v = asbool(v)
                 options[option_name] = v
 
     options = coerce_session_params(options)
     return BeakerSessionFactoryConfig(**options)
 
 
 def set_cache_regions_from_settings(settings):
     """ Add cache support to the Pylons application.
 
     The ``settings`` passed to the configurator are used to setup
     the cache options. Cache options in the settings should start
     with either 'beaker.cache.' or 'cache.'.
 
     """
     cache_settings = {'regions': []}
     for key in settings.keys():
         for prefix in ['beaker.cache.', 'cache.']:
             if key.startswith(prefix):
                 name = key.split(prefix)[1].strip()
                 cache_settings[name] = settings[key].strip()
 
     if ('expire' in cache_settings
             and isinstance(cache_settings['expire'], basestring)
             and cache_settings['expire'].lower() in ['none', 'no']):
         cache_settings['expire'] = None
 
     coerce_cache_params(cache_settings)
 
     if 'enabled' not in cache_settings:
         cache_settings['enabled'] = True
 
     regions = cache_settings['regions']
     if regions:
         for region in regions:
             if not region:
                 continue
 
             region_settings = {
                 'data_dir': cache_settings.get('data_dir'),
                 'lock_dir': cache_settings.get('lock_dir'),
                 'expire': cache_settings.get('expire', 60),
                 'enabled': cache_settings['enabled'],
                 'key_length': cache_settings.get('key_length', 250),
                 'type': cache_settings.get('type'),
                 'url': cache_settings.get('url'),
             }
             region_prefix = '%s.' % region
             region_len = len(region_prefix)
             for key in list(cache_settings.keys()):
                 if key.startswith(region_prefix):
                     region_settings[key[region_len:]] = cache_settings.pop(key)
 
             if (isinstance(region_settings['expire'], basestring)
                     and region_settings['expire'].lower() in ['none', 'no']):
                 region_settings['expire'] = None
             coerce_cache_params(region_settings)
             cache.cache_regions[region] = region_settings
 
 
 def includeme(config):
     session_factory = session_factory_from_settings(config.registry.settings)
     config.set_session_factory(session_factory)
     set_cache_regions_from_settings(config.registry.settings)