Merge lp:~gmb/maas/login-form-auto-complete-bug-1298781 into lp:~maas-committers/maas/trunk

[Graham Binns]

Turn autocomplete off for the login form when not running in debug mode. Previously autocomplete was always on, which netcraft has warned against.

[Jeroen T. Vermeulen (jtv)]

It'd be nice to have the reason for this tweak embedded in the code somewhere, so that future readers won't think it frivolous.

review: Approve

=== modified file 'docs/conf.py'
--- docs/conf.py	2014-04-06 08:12:50 +0000
+++ docs/conf.py	2014-04-07 10:43:10 +0000
@@ -13,6 +13,8 @@
 
 # Import maas' settings.
 from os import environ
+
+
 environ.setdefault("DJANGO_SETTINGS_MODULE", "maas.settings")
 
 # If extensions (or modules to document with autodoc) are in another directory,

=== modified file 'src/maasserver/context_processors.py'
--- src/maasserver/context_processors.py	2014-03-27 04:15:45 +0000
+++ src/maasserver/context_processors.py	2014-04-07 10:43:10 +0000
@@ -80,5 +80,6 @@
         ],
         'global_options': {
             'site_name': Config.objects.get_config('maas_name'),
-        }
+        },
+        'debug': settings.DEBUG,
     }

=== modified file 'src/maasserver/templates/registration/login.html'
--- src/maasserver/templates/registration/login.html	2014-02-03 08:17:56 +0000
+++ src/maasserver/templates/registration/login.html	2014-04-07 10:43:10 +0000
@@ -33,7 +33,12 @@
     <p class="form-errors">Your username and password didn't match. Please try again.</p>
   {% endif %}
 
-  <form method="post" action="{% url 'login' %}">{% csrf_token %}
+  {% comment %}
+  We turn off autocompletion of the login form in production
+  environments. Autocompletion, in combination with cross-site scripting
+  attacks, can potentially allow remote attackers to steal credentials.
+  {% endcomment %}
+  <form method="post" {% if not debug %}autocomplete="off"{% endif %} action="{% url 'login' %}">{% csrf_token %}
     <input type="hidden" name="next" value="{{ next }}" />
     <ul>
         {% for field in form %}

=== modified file 'src/maasserver/views/tests/test_account.py'
--- src/maasserver/views/tests/test_account.py	2014-04-02 08:57:30 +0000
+++ src/maasserver/views/tests/test_account.py	2014-04-07 10:43:10 +0000
@@ -17,7 +17,10 @@
 from django.conf import settings
 from django.contrib.auth import SESSION_KEY
 from django.core.urlresolvers import reverse
-from lxml.html import fromstring
+from lxml.html import (
+    fromstring,
+    tostring,
+    )
 from maasserver.testing import (
     extract_redirect,
     get_content_links,
@@ -50,6 +53,21 @@
         response = self.client.get('/accounts/login/')
         self.assertEqual('/', extract_redirect(response))
 
+    def test_login_sets_autocomplete_off_in_production(self):
+        self.patch(settings, 'DEBUG', False)
+        factory.make_user()
+        response = self.client.get('/accounts/login/')
+        doc = fromstring(response.content)
+        form = doc.cssselect("form")[0]
+        self.assertIn('autocomplete="off"', tostring(form))
+
+    def test_login_sets_autocomplete_on_in_debug_mode(self):
+        self.patch(settings, 'DEBUG', True)
+        factory.make_user()
+        response = self.client.get('/accounts/login/')
+        doc = fromstring(response.content)
+        form = doc.cssselect("form")[0]
+        self.assertNotIn('autocomplete="off"', tostring(form))
 
 class TestLogout(MAASServerTestCase):
 

=== modified file 'src/provisioningserver/custom_hardware/seamicro.py'
--- src/provisioningserver/custom_hardware/seamicro.py	2014-04-04 21:05:54 +0000
+++ src/provisioningserver/custom_hardware/seamicro.py	2014-04-07 10:43:10 +0000
@@ -24,12 +24,8 @@
 import urlparse
 
 import provisioningserver.custom_hardware.utils as utils
-from seamicroclient.v2 import (
-    client as seamicro_client,
-    )
-from seamicroclient import (
-    exceptions as seamicro_exceptions,
-    )
+from seamicroclient import exceptions as seamicro_exceptions
+from seamicroclient.v2 import client as seamicro_client
 
 
 logger = logging.getLogger(__name__)