OpenStack Dashboard (Horizon)

Merge lp:~corey.bryant/horizon/2014.2.1-2 into lp:~ubuntu-server-dev/horizon/juno

  1. 2014.2.1-2
  2. Merge into juno
Proposed by Corey Bryant
Status: Merged
Merged at revision: 214
Proposed branch: lp:~corey.bryant/horizon/2014.2.1-2
Merge into: lp:~ubuntu-server-dev/horizon/juno
Diff against target: 90 lines (+70/-0)
3 files modified
debian/changelog (+7/-0)
debian/patches/prevent_login_page_DOS.patch (+62/-0)
debian/patches/series (+1/-0)
To merge this branch: bzr merge lp:~corey.bryant/horizon/2014.2.1-2
Reviewer Review Type Date Requested Status
Ubuntu Server Developers Pending
Review via email: mp+244199@code.launchpad.net
To post a comment you must log in.

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
1=== modified file 'debian/changelog'
2--- debian/changelog 2014-12-08 18:22:58 +0000
3+++ debian/changelog 2014-12-09 18:52:08 +0000
4@@ -1,3 +1,10 @@
5+horizon (1:2014.2.1-0ubuntu2) UNRELEASED; urgency=medium
6+
7+ * d/p/prevent_login_page_DOS.patch: Cherry picked from
8+ https://review.openstack.org/#/c/140358/.
9+
10+ -- Corey Bryant <corey.bryant@canonical.com> Tue, 09 Dec 2014 13:34:26 -0500
11+
12 horizon (1:2014.2.1-0ubuntu1) utopic; urgency=medium
13
14 [ Corey Bryant ]
15
16=== added file 'debian/patches/prevent_login_page_DOS.patch'
17--- debian/patches/prevent_login_page_DOS.patch 1970-01-01 00:00:00 +0000
18+++ debian/patches/prevent_login_page_DOS.patch 2014-12-09 18:52:08 +0000
19@@ -0,0 +1,62 @@
20+From 09b8f8f6724dd7eb8b34fd4c2c2e66b0a3d0cab9 Mon Sep 17 00:00:00 2001
21+From: eric <eric.peterson1@twcable.com>
22+Date: Thu, 20 Nov 2014 08:49:09 -0700
23+Subject: [PATCH] Horizon login page contains DOS attack mechanism
24+
25+the horizon login page (really the middleware) accesses the session
26+too early in the login process, which will create session records
27+in the session backend. This is especially problematic when non-cookie
28+backends are used.
29+
30+Change-Id: I9d2c40403fb9b0cfb512f2ff45397cbe0b050c71
31+Closes-Bug: 1394370
32+---
33+ horizon/middleware.py | 10 ++++++----
34+ openstack_dashboard/views.py | 5 ++---
35+ 2 files changed, 8 insertions(+), 7 deletions(-)
36+
37+diff --git a/horizon/middleware.py b/horizon/middleware.py
38+index a0d9c3d..885489e 100644
39+--- a/horizon/middleware.py
40++++ b/horizon/middleware.py
41+@@ -90,16 +90,18 @@ class HorizonMiddleware(object):
42+ request.horizon = {'dashboard': None,
43+ 'panel': None,
44+ 'async_messages': []}
45++ if not hasattr(request, "user") or not request.user.is_authenticated():
46++ # proceed no further if the current request is already known
47++ # not to be authenticated
48++ # it is CRITICAL to perform this check as early as possible
49++ # to avoid creating too many sessions
50++ return None
51+
52+ # Check for session timeout if user is (or was) authenticated.
53+ has_timed_out, timestamp = self._check_has_timed_timeout(request)
54+ if has_timed_out:
55+ return self._logout(request, request.path, _("Session timed out."))
56+
57+- if not hasattr(request, "user") or not request.user.is_authenticated():
58+- # proceed no further if the current request is already known
59+- # not to be authenticated
60+- return None
61+ if request.is_ajax():
62+ # if the request is Ajax we do not want to proceed, as clients can
63+ # 1) create pages with constant polling, which can create race
64+diff --git a/openstack_dashboard/views.py b/openstack_dashboard/views.py
65+index 4ce55ff..0473279 100644
66+--- a/openstack_dashboard/views.py
67++++ b/openstack_dashboard/views.py
68+@@ -41,8 +41,7 @@ def splash(request):
69+ response = shortcuts.redirect(horizon.get_user_home(request.user))
70+ else:
71+ form = forms.Login(request)
72+- request.session.clear()
73+- request.session.set_test_cookie()
74+ response = shortcuts.render(request, 'splash.html', {'form': form})
75+- response.delete_cookie('logout_reason')
76++ if 'logout_reason' in request.COOKIES:
77++ response.delete_cookie('logout_reason')
78+ return response
79+--
80+2.1.0
81+
82
83=== modified file 'debian/patches/series'
84--- debian/patches/series 2014-10-07 16:59:32 +0000
85+++ debian/patches/series 2014-12-09 18:52:08 +0000
86@@ -1,3 +1,4 @@
87+prevent_login_page_DOS.patch
88 fix-dashboard-django-wsgi.patch
89 fix-dashboard-manage.patch
90 ubuntu_settings.patch

Subscribers

People subscribed via source and target branches