Merge lp:~rvb/maas/1.5-bug-1298790 into lp:maas/1.5

[Raphaël Badin]

Backport revision 2219: Add a "logout confirmation" page. Using this, the logout action is protected against CSRF attacks because it uses a POST request, in conjunction with Django's CSRF protection feature.

[Raphaël Badin (rvb)]

Simple backport: self-approving.

=== added file 'src/maasserver/templates/maasserver/logout_confirm.html'
--- src/maasserver/templates/maasserver/logout_confirm.html	1970-01-01 00:00:00 +0000
+++ src/maasserver/templates/maasserver/logout_confirm.html	2014-04-02 09:48:49 +0000
@@ -0,0 +1,21 @@
+{% extends "maasserver/base.html" %}
+
+{% block nav-active-settings %}active{% endblock %}
+{% block title %}Logout{% endblock %}
+{% block page-title %}Logout{% endblock %}
+
+{% block content %}
+    <div class="block auto-width">
+        <h2>
+          Are you sure you want to log out?
+        </h2>
+        <p>
+          <form action="." method="post">{% csrf_token %}
+            <input type="hidden" name="post" value="yes" />
+            <input type="submit" value="Log out" class="right" />
+            <a href="{% url 'index' %}">Cancel</a>
+          </form>
+        </p>
+    </div>
+{% endblock %}
+

=== modified file 'src/maasserver/views/account.py'
--- src/maasserver/views/account.py	2013-10-07 09:12:40 +0000
+++ src/maasserver/views/account.py	2014-04-02 09:48:49 +0000
@@ -17,6 +17,7 @@
     "logout",
     ]
 
+from django import forms
 from django.conf import settings as django_settings
 from django.contrib import messages
 from django.contrib.auth.views import (
@@ -25,6 +26,8 @@
     )
 from django.core.urlresolvers import reverse
 from django.http import HttpResponseRedirect
+from django.shortcuts import render_to_response
+from django.template import RequestContext
 from maasserver.models import UserProfile
 
 
@@ -39,6 +42,25 @@
         return dj_login(request, extra_context=extra_context)
 
 
+class LogoutForm(forms.Form):
+    """Log-out confirmation form.
+
+    There is nothing interesting in this form, but it's needed in order
+    to get Django's CSRF protection during logout.
+    """
+
+
 def logout(request):
-    messages.info(request, "You have been logged out.")
-    return dj_logout(request, next_page=reverse('login'))
+    if request.method == 'POST':
+        form = LogoutForm(request.POST)
+        if form.is_valid():
+            messages.info(request, "You have been logged out.")
+            return dj_logout(request, next_page=reverse('login'))
+    else:
+        form = LogoutForm()
+
+    return render_to_response(
+        'maasserver/logout_confirm.html',
+        {'form': form},
+        context_instance=RequestContext(request),
+    )

=== modified file 'src/maasserver/views/tests/test_account.py'
--- src/maasserver/views/tests/test_account.py	2014-02-11 22:00:31 +0000
+++ src/maasserver/views/tests/test_account.py	2014-04-02 09:48:49 +0000
@@ -15,8 +15,13 @@
 __all__ = []
 
 from django.conf import settings
+from django.contrib.auth import SESSION_KEY
+from django.core.urlresolvers import reverse
 from lxml.html import fromstring
-from maasserver.testing import extract_redirect
+from maasserver.testing import (
+    extract_redirect,
+    get_content_links,
+    )
 from maasserver.testing.factory import factory
 from maasserver.testing.testcase import MAASServerTestCase
 
@@ -44,3 +49,22 @@
         self.client.login(username=user.username, password=password)
         response = self.client.get('/accounts/login/')
         self.assertEqual('/', extract_redirect(response))
+
+
+class TestLogout(MAASServerTestCase):
+
+    def test_logout_link_present_on_homepage(self):
+        self.client_log_in()
+        response = self.client.get(reverse('index'))
+        logout_link = reverse('logout')
+        self.assertIn(
+            logout_link,
+            get_content_links(response, element='#user-options'))
+
+    def test_loggout_uses_POST(self):
+        # Using POST for logging out, along with Django's csrf_token
+        # tag, guarantees that we're protected against CSRF attacks on
+        # the loggout page.
+        self.client_log_in()
+        self.client.post(reverse('logout'))
+        self.assertNotIn(SESSION_KEY, self.client.session.keys())