Revision 2a496ad8
Von Moritz Bunkus vor mehr als 4 Jahren hinzugefügt
| SL/Auth.pm | ||
|---|---|---|
| 1237 | 1237 |
} |
| 1238 | 1238 |
|
| 1239 | 1239 |
if (!$dont_abort) {
|
| 1240 |
$::dispatcher->reply_with_json_error(error => 'access') if $::request->type eq 'json'; |
|
| 1241 |
|
|
| 1240 | 1242 |
delete $::form->{title};
|
| 1241 | 1243 |
$::form->show_generic_error($::locale->text("You do not have the permissions to access this function."));
|
| 1242 | 1244 |
} |
| SL/Controller/Base.pm | ||
|---|---|---|
| 75 | 75 |
header => 1, |
| 76 | 76 |
layout => 1, |
| 77 | 77 |
process => 1, |
| 78 |
status => '200 ok', |
|
| 78 | 79 |
); |
| 79 | 80 |
$options->{$_} //= $defaults{$_} for keys %defaults;
|
| 80 | 81 |
$options->{type} = lc $options->{type};
|
| ... | ... | |
| 131 | 132 |
: 'application/json'; |
| 132 | 133 |
|
| 133 | 134 |
print $::form->create_http_response(content_type => $content_type, |
| 134 |
charset => 'UTF-8'); |
|
| 135 |
charset => 'UTF-8', |
|
| 136 |
(status => $options->{status}) x !!$options->{status});
|
|
| 135 | 137 |
} |
| 136 | 138 |
} |
| 137 | 139 |
|
| SL/Dispatcher.pm | ||
|---|---|---|
| 291 | 291 |
if ( (($script eq 'login') && !$action) |
| 292 | 292 |
|| ($script eq 'admin') |
| 293 | 293 |
|| (SL::Auth::SESSION_EXPIRED() == $session_result)) {
|
| 294 |
$self->redirect_to_login(script => $script, error => 'session');
|
|
| 294 |
$self->handle_login_error(script => $script, error => 'session');
|
|
| 295 | 295 |
|
| 296 | 296 |
} |
| 297 | 297 |
|
| ... | ... | |
| 360 | 360 |
$::lxdebug->leave_sub; |
| 361 | 361 |
} |
| 362 | 362 |
|
| 363 |
sub redirect_to_login {
|
|
| 363 |
sub reply_with_json_error {
|
|
| 364 | 364 |
my ($self, %params) = @_; |
| 365 |
|
|
| 366 |
my %errors = ( |
|
| 367 |
session => { code => '401 Unauthorized', text => 'session expired' },
|
|
| 368 |
password => { code => '401 Unauthorized', text => 'incorrect username or password' },
|
|
| 369 |
action => { code => '400 Bad request', text => 'incorrect or missing action' },
|
|
| 370 |
access => { code => '403 Forbidden', text => 'no permissions for accessing this function' },
|
|
| 371 |
_default => { code => '500 Internal server error', text => 'general server-side error' },
|
|
| 372 |
); |
|
| 373 |
|
|
| 374 |
my $error = $errors{$params{error}} // $errors{_default};
|
|
| 375 |
my $reply = SL::JSON::to_json({ status => 'failed', error => $error->{text} });
|
|
| 376 |
|
|
| 377 |
print $::request->cgi->header( |
|
| 378 |
-type => 'application/json', |
|
| 379 |
-charset => 'utf-8', |
|
| 380 |
-status => $error->{code},
|
|
| 381 |
); |
|
| 382 |
|
|
| 383 |
print $reply; |
|
| 384 |
|
|
| 385 |
$self->end_request; |
|
| 386 |
} |
|
| 387 |
|
|
| 388 |
sub handle_login_error {
|
|
| 389 |
my ($self, %params) = @_; |
|
| 390 |
|
|
| 391 |
return $self->reply_with_json_error(error => $params{error}) if $::request->type eq 'json';
|
|
| 392 |
|
|
| 365 | 393 |
my $action = ($params{script} // '') =~ m/^admin/i ? 'Admin/login' : 'LoginScreen/user_login';
|
| 366 | 394 |
$action .= '&error=' . $params{error} if $params{error};
|
| 367 | 395 |
|
| ... | ... | |
| 432 | 460 |
eval {
|
| 433 | 461 |
# Redirect simple requests to controller.pl without any GET/POST |
| 434 | 462 |
# param to the login page. |
| 435 |
$self->redirect_to_login(error => 'action') if !$::form->{action};
|
|
| 463 |
$self->handle_login_error(error => 'action') if !$::form->{action};
|
|
| 436 | 464 |
|
| 437 | 465 |
# Show an error if the »action« parameter doesn't match the |
| 438 | 466 |
# pattern »Controller/action«. |
| SL/Dispatcher/AuthHandler/User.pm | ||
|---|---|---|
| 46 | 46 |
my $self = shift; |
| 47 | 47 |
|
| 48 | 48 |
$::auth->punish_wrong_login; |
| 49 |
$::dispatcher->handle_login_error(error => 'password'); |
|
| 49 | 50 |
|
| 50 |
require SL::Controller::Base; |
|
| 51 |
SL::Controller::Base->new->redirect_to('controller.pl?action=LoginScreen/user_login&error=password');
|
|
| 52 | 51 |
return 0; |
| 53 | 52 |
} |
| 54 | 53 |
|
| SL/Form.pm | ||
|---|---|---|
| 397 | 397 |
$cgi_params{'-charset'} = $params{charset} if ($params{charset});
|
| 398 | 398 |
$cgi_params{'-cookie'} = $session_cookie if ($session_cookie);
|
| 399 | 399 |
|
| 400 |
map { $cgi_params{'-' . $_} = $params{$_} if exists $params{$_} } qw(content_disposition content_length);
|
|
| 400 |
map { $cgi_params{'-' . $_} = $params{$_} if exists $params{$_} } qw(content_disposition content_length status);
|
|
| 401 | 401 |
|
| 402 | 402 |
my $output = $cgi->header(%cgi_params); |
| 403 | 403 |
|
Auch abrufbar als: Unified diff
Auth: fehlerhafte JSON-Requests mit JSON und richtigem HTTP-Response-Code beantworten