Fix dummy login target.

[pithos] / pithos / middleware / auth.py

diff --git a/pithos/middleware/auth.py b/pithos/middleware/auth.py
index 154e635..16afee7 100644 (file)
--- a/pithos/middleware/auth.py
+++ b/pithos/middleware/auth.py
@@ -32,35 +32,40 @@
 # or implied, of GRNET S.A.
 
 from time import time, mktime
-
-from django.conf import settings
+from urllib import quote, unquote
 
 from pithos.im.models import User
 
 
+def get_user_from_token(token):
+    try:
+        return User.objects.get(auth_token=token)
+    except User.DoesNotExist:
+        return None
+
+
 class AuthMiddleware(object):
     def process_request(self, request):
         request.user = None
         request.user_uniq = None
         
         # Try to find token in a parameter, in a request header, or in a cookie.
-        token = request.GET.get('X-Auth-Token', None)
-        if not token:
-            token = request.META.get('HTTP_X_AUTH_TOKEN', None)
-        if not token:
-            token = request.COOKIES.get('X-Auth-Token', None)
-        if not token: # Back from an im login target.
+        user = get_user_from_token(request.GET.get('X-Auth-Token'))
+        if not user:
+            user = get_user_from_token(request.META.get('HTTP_X_AUTH_TOKEN'))
+        if not user:
+            # Back from an im login target.
             if request.GET.get('user', None):
                 token = request.GET.get('token', None)
                 if token:
                     request.set_auth_cookie = True
-        if not token:
-            return
-        
-        # Token was found, retrieve user from backing store.
-        try:
-            user = User.objects.get(auth_token=token)
-        except:
+                user = get_user_from_token(token)
+            if not user:
+                cookie_value = unquote(request.COOKIES.get('_pithos2_a', ''))
+                if cookie_value and '|' in cookie_value:
+                    token = cookie_value.split('|', 1)[1]
+                    user = get_user_from_token(token)
+        if not user:
             return
         
         # Check if the is active.
@@ -73,9 +78,10 @@ class AuthMiddleware(object):
         
         request.user = user
         request.user_uniq = user.uniq
-
+    
     def process_response(self, request, response):
         if getattr(request, 'user', None) and getattr(request, 'set_auth_cookie', False):
             expire_fmt = request.user.auth_token_expires.strftime('%a, %d-%b-%Y %H:%M:%S %Z')
-            response.set_cookie('X-Auth-Token', value=request.user.auth_token, expires=expire_fmt, path='/')
+            cookie_value = quote(request.user.uniq + '|' + request.user.auth_token)
+            response.set_cookie('_pithos2_a', value=cookie_value, expires=expire_fmt, path='/')
         return response