Merge lp:~rvb/maas/logout-fix-1.2 into lp:maas/1.2

[Raphaël Badin]

Backport revision 2219: Add a "logout confirmation" page. Using this, the logout action is protected against CSRF attacks because it uses a POST request, in conjunction with Django's CSRF protection feature.

[Julian Edwards (julian-edwards)]

review: Approve

[lp:~rvb/maas/logout-fix-1.2]

1387. By Raphaël Badin on 2014-04-14

Fix 1.2 incompatibility.

=== added file 'src/maasserver/templates/maasserver/logout_confirm.html'
--- src/maasserver/templates/maasserver/logout_confirm.html	1970-01-01 00:00:00 +0000
+++ src/maasserver/templates/maasserver/logout_confirm.html	2014-04-14 14:00:37 +0000
@@ -0,0 +1,21 @@
+{% extends "maasserver/base.html" %}
+
+{% block nav-active-settings %}active{% endblock %}
+{% block title %}Logout{% endblock %}
+{% block page-title %}Logout{% endblock %}
+
+{% block content %}
+    <div class="block auto-width">
+        <h2>
+          Are you sure you want to log out?
+        </h2>
+        <p>
+          <form action="." method="post">{% csrf_token %}
+            <input type="hidden" name="post" value="yes" />
+            <input type="submit" value="Log out" class="right" />
+            <a href="{% url 'index' %}">Cancel</a>
+          </form>
+        </p>
+    </div>
+{% endblock %}
+

=== modified file 'src/maasserver/tests/test_views_account.py'
--- src/maasserver/tests/test_views_account.py	2012-06-25 13:59:23 +0000
+++ src/maasserver/tests/test_views_account.py	2014-04-14 14:00:37 +0000
@@ -1,4 +1,4 @@
-# Copyright 2012 Canonical Ltd.  This software is licensed under the
+# Copyright 2012-2014 Canonical Ltd.  This software is licensed under the
 # GNU Affero General Public License version 3 (see the file LICENSE).
 
 """Test maasserver account views."""
@@ -13,9 +13,15 @@
 __all__ = []
 
 from django.conf import settings
+from django.contrib.auth import SESSION_KEY
+from django.core.urlresolvers import reverse
 from lxml.html import fromstring
+from maasserver.testing import get_content_links
 from maasserver.testing.factory import factory
-from maasserver.testing.testcase import TestCase
+from maasserver.testing.testcase import (
+    LoggedInTestCase,
+    TestCase,
+    )
 
 
 class TestLogin(TestCase):
@@ -34,3 +40,20 @@
         response = self.client.get('/accounts/login/')
         self.assertTrue(response.context['no_users'])
         self.assertEqual(path, response.context['create_command'])
+
+
+class TestLogout(LoggedInTestCase):
+
+    def test_logout_link_present_on_homepage(self):
+        response = self.client.get(reverse('index'))
+        logout_link = reverse('logout')
+        self.assertIn(
+            logout_link,
+            get_content_links(response, element='#user-options'))
+
+    def test_loggout_uses_POST(self):
+        # Using POST for logging out, along with Django's csrf_token
+        # tag, guarantees that we're protected against CSRF attacks on
+        # the loggout page.
+        self.client.post(reverse('logout'))
+        self.assertNotIn(SESSION_KEY, self.client.session.keys())

=== modified file 'src/maasserver/views/account.py'
--- src/maasserver/views/account.py	2012-06-25 13:59:23 +0000
+++ src/maasserver/views/account.py	2014-04-14 14:00:37 +0000
@@ -15,6 +15,7 @@
     "logout",
     ]
 
+from django import forms
 from django.conf import settings as django_settings
 from django.contrib import messages
 from django.contrib.auth.views import (
@@ -22,6 +23,8 @@
     logout as dj_logout,
     )
 from django.core.urlresolvers import reverse
+from django.shortcuts import render_to_response
+from django.template import RequestContext
 from maasserver.models import UserProfile
 
 
@@ -33,6 +36,25 @@
     return dj_login(request, extra_context=extra_context)
 
 
+class LogoutForm(forms.Form):
+    """Log-out confirmation form.
+
+    There is nothing interesting in this form, but it's needed in order
+    to get Django's CSRF protection during logout.
+    """
+
+
 def logout(request):
-    messages.info(request, "You have been logged out.")
-    return dj_logout(request, next_page=reverse('login'))
+    if request.method == 'POST':
+        form = LogoutForm(request.POST)
+        if form.is_valid():
+            messages.info(request, "You have been logged out.")
+            return dj_logout(request, next_page=reverse('login'))
+    else:
+        form = LogoutForm()
+
+    return render_to_response(
+        'maasserver/logout_confirm.html',
+        {'form': form},
+        context_instance=RequestContext(request),
+    )