Merge lp:~leonardr/launchpadlib/529348-fix into lp:launchpadlib

[Leonard Richardson]

This branch ensures that when launchpadlib communicates with the Launchpad website (as opposed to the web service), it always sets the Referer header. In a very long time (once the versions of Ubuntu containing earlier versions of launchpadlib are at end-of-life) this will let us get rid of special hacks allowing clients to POST to certain URLs without specifying the Referer header.

[Gary Poster (gary)]

review: Approve

[Gary Poster (gary)]

gary_poster: leonardr: do I understand correctly that this will change nothing about the change needed now for 529348 in launchpad, because of legacy?
leonardr: gary: yes, this is 1) to get the tests passing, and 2) to simplify the 529348 fix a little bit many years from now
gary_poster: leonardr: right. Getting the test to pass this way is expedient. We actually have an explicit test to show the hack needed in launchpad. Understood. Approving branch.

=== modified file 'src/launchpadlib/NEWS.txt'
--- src/launchpadlib/NEWS.txt	2010-03-04 19:28:37 +0000
+++ src/launchpadlib/NEWS.txt	2010-03-16 21:22:17 +0000
@@ -2,6 +2,13 @@
 NEWS for launchpadlib
 =====================
 
+1.5.7 (2010-03-16)
+==================
+
+- Send a Referer header whenever making requests to the Launchpad
+  website (as opposed to the web service) to avoid falling afoul of
+  new cross-site-request-forgery countermeasures.
+
 1.5.6 (2010-03-04)
 ==================
 

=== modified file 'src/launchpadlib/__init__.py'
--- src/launchpadlib/__init__.py	2010-03-03 18:38:17 +0000
+++ src/launchpadlib/__init__.py	2010-03-16 21:22:17 +0000
@@ -14,4 +14,4 @@
 # You should have received a copy of the GNU Lesser General Public License
 # along with launchpadlib. If not, see <http://www.gnu.org/licenses/>.
 
-__version__ = '1.5.6'
+__version__ = '1.5.7'

=== modified file 'src/launchpadlib/credentials.py'
--- src/launchpadlib/credentials.py	2009-12-17 16:52:54 +0000
+++ src/launchpadlib/credentials.py	2010-03-16 21:22:17 +0000
@@ -92,7 +92,7 @@
             oauth_signature_method='PLAINTEXT',
             oauth_signature='&')
         url = web_root + request_token_page
-        headers = {}
+        headers = {'Referer' : web_root}
         if token_format == self.DICT_TOKEN_FORMAT:
             headers['Accept'] = 'application/json'
         response, content = httplib2.Http().request(
@@ -135,8 +135,9 @@
             oauth_token=self._request_token.key,
             oauth_signature='&%s' % self._request_token.secret)
         url = web_root + access_token_page
+        headers = {'Referer' : web_root}
         response, content = httplib2.Http().request(
-            url, method='POST', body=urlencode(params))
+            url, method='POST', headers=headers, body=urlencode(params))
         if response.status != 200:
             raise HTTPError(response, content)
         self.access_token = AccessToken.from_string(content)
@@ -215,7 +216,8 @@
         # We can't use httplib2's add_credentials, because Launchpad
         # doesn't respond to credential-less access with a 401
         # response code.
-        headers = {'Accept' : 'application/json'}
+        headers = {'Accept' : 'application/json',
+                   'Referer' : self.web_root}
         headers['Authorization'] = self._auth_header(username, password)
         response, content = self.http.request(url, headers=headers)
         # Detect common error conditions and set the response code
@@ -232,7 +234,8 @@
     def grant_access(self, username, password, request_token, access_level,
                      context=None):
         """Grant a level of access to an application on behalf of a user."""
-        headers = {'Content-type' : 'application/x-www-form-urlencoded'}
+        headers = {'Content-type' : 'application/x-www-form-urlencoded',
+                   'Referer' : self.web_root}
         headers['Authorization'] = self._auth_header(username, password)
         body = "oauth_token=%s&field.actions.%s=True" % (
             quote(request_token), quote(access_level))