made admin uploads more secure

VERSION

@@ -1 +1 @@
-Version 2.00.0 (2012-07-28 20:19:12) dev
+Version 2.00.0 (2012-07-28 20:51:14) dev

applications/admin/controllers/default.py

@@ -11,6 +11,7 @@ if EXPERIMENTAL_STUFF:
 import re
 from gluon.admin import *
 from gluon.fileutils import abspath, read_file, write_file
+from gluon.utils import web2py_uuid
 from glob import glob
 import shutil
 import platform
@@ -40,6 +41,9 @@ if FILTER_APPS and request.args(0) and not request.args(0) in FILTER_APPS:
     session.flash = T('disabled in demo mode')
     redirect(URL('site'))
 
+
+if not session.token: session.token = web2py_uuid()
+
 def count_lines(data):
     return len([line for line in data.split('\n') if line.strip() and not line.startswith('#')])
 
@@ -862,6 +866,9 @@ def design():
         msg = T('ATTENTION: you cannot edit the running application!')
         response.flash = msg
 
+    if request.vars and not request.vars.token==session.token:
+        redirect(URL('logout'))
+
     if request.vars.pluginfile!=None and not isinstance(request.vars.pluginfile,str):
         filename=os.path.basename(request.vars.pluginfile.filename)
         if plugin_install(app, request.vars.pluginfile.file,
@@ -1113,6 +1120,8 @@ def plugin():
 
 def create_file():
     """ Create files handler """
+    if request.vars and not request.vars.token==session.token:
+        redirect(URL('logout'))
     try:
         anchor='#'+request.vars.id if request.vars.id else ''
         if request.vars.app:
@@ -1260,6 +1269,8 @@ def create_file():
 
 def upload_file():
     """ File uploading handler """
+    if request.vars and not request.vars.token==session.token:
+        redirect(URL('logout'))
     try:
         filename = None
         app = get_app(name=request.vars.location.split('/')[0])
@@ -1639,7 +1650,9 @@ def git_pull():
     if not have_git:
         session.flash = GIT_MISSING
         redirect(URL('site'))
-    if 'pull' in request.vars:
+    dialog = FORM.confim(T('Pull'),
+                         {T('Cancel'):URL('site')})    
+    if dialog.accepted:
         try:
             repo = Repo(os.path.join(apath(r=request),app))
             origin = repo.remotes.origin
@@ -1667,7 +1680,7 @@ def git_pull():
             redirect(URL('site'))
     elif 'cancel' in request.vars:
         redirect(URL('site'))
-    return dict(app=app)
+    return dict(app=app,dialog=dialog)
 
 
 def git_push():

applications/admin/views/default/design.html

@@ -19,6 +19,7 @@ def file_upload_form(location, anchor=None):
               INPUT(_type="file",_name="file")," ",T("and rename it:")," ",
               INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
               INPUT(_type="hidden",_name="location",_value=location),
+              INPUT(_type="hidden",_name="token",_value=session.token),
               INPUT(_type="hidden",_name="sender",_value=URL('design',args=app, anchor=anchor)),
               INPUT(_type="submit",_value=T("upload")),_action=URL('upload_file'))
     return form
@@ -27,6 +28,7 @@ def file_create_form(location, anchor=None):
               INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
               INPUT(_type="hidden",_name="location",_value=location),
               INPUT(_type="hidden",_name="sender",_value=URL('design',args=app)),
+              INPUT(_type="hidden",_name="token",_value=session.token),
               INPUT(_type="hidden",_name="id",_value=anchor),
               INPUT(_type="submit",_value=T("Create")),_action=URL('create_file'))
     return form
@@ -34,6 +36,7 @@ def upload_plugin_form(app, anchor=None):
     form=FORM(T("upload plugin file:")," ",
               INPUT(_type="file",_name="pluginfile"),
               INPUT(_type="hidden",_name="id",_value=anchor),
+              INPUT(_type="hidden",_name="token",_value=session.token),
               INPUT(_type="submit",_value=T("upload")))
     return form
 def deletefile(arglist, vars={}):

applications/admin/views/default/git_pull.html

@@ -1,9 +1,5 @@
 {{extend 'layout.html'}}
 
-<center>
+<div class="center">
 <h2>{{=T('This will pull changes from the remote repo for application "%s"?', app)}}</h2>
-<table><tr>
-<td>{{=FORM(INPUT(_type='submit',_name='cancel',_value=T('Cancel')))}}</td>
-<td>{{=FORM(INPUT(_type='submit',_name='pull',_value=T('Pull')))}}</td>
-</tr></table>
-</center>
+{{=dialog}}

applications/admin/views/default/plugin.html

@@ -16,6 +16,7 @@ def file_upload_form(location):
               INPUT(_type="file",_name="file")," ",T("and rename it:")," ",
               INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
               INPUT(_type="hidden",_name="location",_value=location),
+              INPUT(_type="hidden",_name="token",_value=session.token),
               INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)),
               INPUT(_type="submit",_value=T("submit")),_action=URL('upload_file'))
     return form
@@ -23,14 +24,10 @@ def file_create_form(location):
     form=FORM(T("create file with filename:")," ",
               INPUT(_type="text",_name="filename",requires=IS_NOT_EMPTY),
               INPUT(_type="hidden",_name="location",_value=location),
+              INPUT(_type="hidden",_name="token",_value=session.token),
               INPUT(_type="hidden",_name="sender",_value=URL('design/'+app)),
               INPUT(_type="submit",_value=T("submit")),_action=URL('create_file'))
     return form
-def upload_plugin_form(app):
-    form=FORM(T("upload plugin file:")," ",
-              INPUT(_type="file",_name="pluginfile"),
-              INPUT(_type="submit",_value=T("submit")))
-    return form
 def deletefile(arglist):
   return A(TAG[''](IMG(_src=URL('static', 'images/delete_icon.png')), SPAN(T('Delete this file (you will be asked to confirm deletion)'))), _class='icon delete tooltip', _href=URL('delete',args=arglist,vars=dict(sender=request.function+'/'+app)))
 }}