arno/isso
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Reject actual logins when admin is disabled.

Browse Source
This commit is contained in:
Jelmer Vernooij 2018-11-11 16:20:23 +00:00
parent 5d811e3a51
commit afc90a05cc
No known key found for this signature in database
GPG Key ID: 579C160D4C9E23E8
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
MANIFEST.in
View File

@ -11,6 +11,7 @@ include isso/js/count.dev.js
include isso/defaults.ini include isso/defaults.ini
include isso/templates/admin.html include isso/templates/admin.html
include isso/templates/disabled.html
include isso/templates/login.html include isso/templates/login.html
include isso/css/admin.css include isso/css/admin.css
include isso/css/isso.css include isso/css/isso.css

5
isso/views/comments.py
View File

@ -1067,6 +1067,8 @@ class API(object):
) )
def login(self, env, req): def login(self, env, req):
if not self.isso.conf.getboolean("admin", "enabled"):
return render_template('disabled.html')
data = req.form data = req.form
password = self.isso.conf.get("admin", "password") password = self.isso.conf.get("admin", "password")
if data['password'] and data['password'] == password: if data['password'] and data['password'] == password:
@ -1088,8 +1090,7 @@ class API(object):
def admin(self, env, req): def admin(self, env, req):
isso_host_script = self.isso.conf.get("server", "public-endpoint") or local.host isso_host_script = self.isso.conf.get("server", "public-endpoint") or local.host
if not self.isso.conf.getboolean("admin", "enabled"): if not self.isso.conf.getboolean("admin", "enabled"):
return render_template( return render_template('disabled.html')
'disabled.html', isso_host_script=isso_host_script)
try: try:
data = self.isso.unsign(req.cookies.get('admin-session', ''), data = self.isso.unsign(req.cookies.get('admin-session', ''),
max_age=60 * 60 * 24) max_age=60 * 60 * 24)

2
share/isso.conf
View File

@ -63,7 +63,7 @@ gravatar-url = https://www.gravatar.com/avatar/{}?d=identicon
enabled = false enabled = false
# Admin access password # Admin access password
_password = please_choose_a_strong_password password = please_choose_a_strong_password
[moderation] [moderation]
# enable comment moderation queue. This option only affects new comments. # enable comment moderation queue. This option only affects new comments.