Merge lp:~pfalcon/linaro-android-frontend/csrf-support into lp:linaro-android-frontend

[Paul Sokolovsky]

Add support for working with API when CSRF protection is enabled in Jenkins. Based on previous work by Danilo on linaro-android-build-tools.

[Milo Casagrande (milo)]

Paul,

thanks for quickly working on this!
It looks good to me.

review: Approve

=== modified file 'android_build/frontend/api.py'
--- android_build/frontend/api.py	2013-04-03 15:32:25 +0000
+++ android_build/frontend/api.py	2013-07-01 16:21:03 +0000
@@ -3,6 +3,7 @@
 import subprocess
 import urllib2
 import hashlib
+import json
 import logging
 
 from django.conf import settings
@@ -50,6 +51,14 @@
     resp = urllib2.urlopen(req)
     return resp.read()
 
+def get_csrf_headers():
+    try:
+        crumb_data = _authJenkins('crumbIssuer/api/json')
+    except urllib2.HTTPError:
+        # Ignore errors in case CSRF protection is not enabled
+        return {}
+    data = json.loads(crumb_data)
+    return {data['crumbRequestField']: data['crumb']}
 
 def messageFromJenkinsErrorPage(page_text):
     """Try to extract a reasonable error message from a Jenkins error page.
@@ -114,9 +123,12 @@
     return etree.tostring(doc_root)
 
 
-def postConfig(url, configXml):
+def postConfig(url, configXml, extra_headers=None):
+    headers = {'Content-Type': 'text/xml'}
+    if extra_headers:
+        headers.update(extra_headers)
     try:
-        _authJenkins(url, configXml, {'Content-Type': 'text/xml'})
+        _authJenkins(url, configXml, headers)
         return None
     except urllib2.HTTPError, e:
         return HttpResponse(
@@ -154,8 +166,9 @@
 def build_now(request):
     job_name = request.POST['build'][1:].replace('/', '_', 1)
     log.info("Scheduling build of job: %s", job_name)
+    csrf_headers = get_csrf_headers()
     try:
-        _authJenkins('job/' + job_name + '/buildWithParameters?delay=0sec', '')
+        _authJenkins('job/' + job_name + '/buildWithParameters?delay=0sec', '', csrf_headers)
     except urllib2.HTTPError, e:
         log.exception("Exception scheduling build:")
         return HttpResponse(
@@ -167,7 +180,8 @@
 
 @editor_required
 def delete(request):
-    _authJenkins('job/' + job_name_from_request(request) + '/doDelete', {})
+    csrf_headers = get_csrf_headers()
+    _authJenkins('job/' + job_name_from_request(request) + '/doDelete', {}, csrf_headers)
     return HttpResponse(status=200)
 
 
@@ -177,7 +191,8 @@
     new_text = request.POST['newText']
     oldConfig = getJobConfig(job_name)
     newConfig = replaceConfigDefault(oldConfig, new_text)
-    resp = postConfig('job/' + job_name + '/config.xml', newConfig)
+    csrf_headers = get_csrf_headers()
+    resp = postConfig('job/' + job_name + '/config.xml', newConfig, csrf_headers)
     if resp:
         return resp
     return HttpResponse(status=200)
@@ -200,11 +215,12 @@
         if isinstance(xml_base, HttpResponse):
             return xml_base
         new_config = replaceConfigDefault(xml_base, request.POST['config'])
-        resp = postConfig('createItem?name=' + new_job_name, new_config)
+        csrf_headers = get_csrf_headers()
+        resp = postConfig('createItem?name=' + new_job_name, new_config, csrf_headers)
         if resp:
             return resp
         if request.POST.get('buildNow', False):
-            _authJenkins('job/' + new_job_name + '/buildWithParameters?delay=0sec')
+            _authJenkins('job/' + new_job_name + '/buildWithParameters?delay=0sec', '', csrf_headers)
         return HttpResponse(
             '~%s/%s' % (ownerName, buildName),
             status=200)
@@ -251,7 +267,8 @@
         triggers[0][:] = [etree.XML(daily_trigger % (minute, hour))]
     else:
         triggers[0][:] = []
-    resp = postConfig('job/' + job_name + '/config.xml', etree.tostring(tree))
+    csrf_headers = get_csrf_headers()
+    resp = postConfig('job/' + job_name + '/config.xml', etree.tostring(tree), csrf_headers)
     if resp:
         return resp
     return HttpResponse('foo')