shaba/openuds
1
0
Fork 1
mirror of https://github.com/dkmstr/openuds.git synced 2025-03-11 00:58:39 +03:00
Code Issues Releases Wiki Activity

Security fixes from git

Browse Source
This commit is contained in:
Adolfo Gómez García 2024-04-11 16:31:45 +02:00
parent 871538f341
commit 8f17f2e545
No known key found for this signature in database
GPG Key ID: DD1ABF20724CDA23
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
server/src/uds/REST/handlers.py
View File

@ -36,13 +36,12 @@ import codecs
from django.contrib.sessions.backends.base import SessionBase
from django.contrib.sessions.backends.db import SessionStore
from uds.core import consts
from uds.core import consts, types
from uds.core.util.config import GlobalConfig
from uds.core.auths.auth import root_user
from uds.core.util import net
from uds.models import Authenticator, User
from uds.core.managers.crypto import CryptoManager
from uds.core.util.state import State
from ..core.exceptions.rest import AccessDenied
@ -145,10 +144,9 @@ class Handler:
# Maybe the user was deleted, so access is denied
raise AccessDenied() from e
else:
# self._user = User() # Empty user for non authenticated handlers
raise AccessDenied()
self._user = User() # Empty user for non authenticated handlers
if self._user and self._user.state != State.ACTIVE:
if self._user and self._user.state != types.states.State.ACTIVE:
raise AccessDenied()
def headers(self) -> dict[str, str]:

5
server/src/uds/middleware/request.py
View File

@ -37,13 +37,12 @@ from django.utils import timezone
from uds.core.util import os_detector as OsDetector
from uds.core.util.config import GlobalConfig
from uds.core import consts
from uds.core import consts, types
from uds.core.auths.auth import (
root_user,
web_logout,
)
from uds.models import User
from uds.core.util.state import State
from . import builder
@ -121,7 +120,7 @@ def _get_user(request: 'ExtendedHttpRequest') -> None:
user = User.objects.get(pk=user_id)
except User.DoesNotExist:
user = None
if user and user.state != State.ACTIVE:
if user and user.state != types.states.State.ACTIVE:
user = None
logger.debug('User at Middleware: %s %s', user_id, user)