Changeset 2871

Timestamp:

03/09/07 13:57:18 (12 years ago)

Author:

lawrence

Message:

Better use of html response headers 400 and 401.

Location:

TI05-delivery/ows_framework/trunk/ows_server/ows_server/controllers

Files:

• login.py (modified) (7 diffs)
• retrieve.py (modified) (4 diffs)

TI05-delivery/ows_framework/trunk/ows_server/ows_server/controllers/login.py

@@ -31 +31 @@
         # Try request.params - above method skips 'r' when passed in a hidden
         # field in a HTTP POST
-        if 'r' in request.params:
-            c.returnTo = request.params['r']
-        else:
-            c.returnTo=''
+        c.returnTo=request.params.get('r','')
             
 
@@ -83 +80 @@
         
         self.__setup()
-        self.__securitySetup()
-
-        smURI = self.ndgCfg.get('NDG_SECURITY', 'sessionMgrURI')
-
-        # May be better as a 'g' global set-up at start-up?
-        #
-        # tracefile could be removed for production use
-        smClnt = SessionMgrClient(uri=smURI,
-                            sslCACertFilePathList=self.sslCACertFilePathList,
-                            sslPeerCertCN=self.sslPeerCertCN,
-                            signingCertFilePath=self.wssCertFilePath,
-                            signingPriKeyFilePath=self.wssPriKeyFilePath,
-                            signingPriKeyPwd=self.wssPriKeyPwd,
-                            caCertFilePathList=self.wssCACertFilePathList,
-                            tracefile=self.tracefile)       
-        
-        username = request.params['username']
-        passphrase = request.params['passphrase']
+        
+        try:
+            self.__securitySetup()
+    
+            smURI = self.ndgCfg.get('NDG_SECURITY', 'sessionMgrURI')
+    
+            # May be better as a 'g' global set-up at start-up?
+            #
+            # tracefile could be removed for production use
+            smClnt = SessionMgrClient(uri=smURI,
+                                sslCACertFilePathList=self.sslCACertFilePathList,
+                                sslPeerCertCN=self.sslPeerCertCN,
+                                signingCertFilePath=self.wssCertFilePath,
+                                signingPriKeyFilePath=self.wssPriKeyFilePath,
+                                signingPriKeyPwd=self.wssPriKeyPwd,
+                                caCertFilePathList=self.wssCACertFilePathList,
+                                tracefile=self.tracefile)
+                                
+            username = request.params['username']
+            passphrase = request.params['passphrase']                     
+                                
+        except Exception,e:
+            c.xml='Error establishing security context [%s]'%cgi.escape(e)
+            return Response(render('content'),code=400)
         
         # Connect to Session Manager
@@ -110 +113 @@
     "Error logging in.  Please check your username/pass-phrase and try again."
             log.error("Session Manager connect returned: %s" % e)
-            return render_response('login')
+            return Response(render('login'),code=401)
         
         # Cache user attributes in Session Manager
@@ -124 +127 @@
             log.info("Session expired getting Attribute Certificate: %s" % e)
             c.xml = "Session has expired, please re-login"
-            render_response('login')
+            return Response(render('login'),code=401)
             
         except AttributeRequestDenied, e:
@@ -130 +133 @@
             c.xml = "No authorisation roles are available for your " + \
                     "account.  Please check with your site administrator."
-            return render_response('login')
+            return Response(render('login'),code=401)
             
         except Exception, e:
@@ -136 +139 @@
             c.xml = "An internal error occured.  Please report this to " + \
                     "your site administrator."
-            return render_response('login')
+            return Response(render('login'),code=400)
 
         # Make session
@@ -213 +216 @@
             h.redirect_to(cc)
         else:
+            c.xml='<p> Logged in </p>'
             return render_response('content')

TI05-delivery/ows_framework/trunk/ows_server/ows_server/controllers/retrieve.py

@@ -40 +40 @@
         if status:
             c.xml='<p>%s</p>'%status
-            return render_response('error')
+            return Response(render('error'),code=400)
+        
         status,x=interface.GetXML(uri,outputSchema=self.outputSchema)
-        
         if status:
             #(the return object x is an xmlHandler object)
@@ -48 +48 @@
             return Response(c.xml,'application/xml')
         else:
-            return Response(x) 
+            e=404
+            if x.startswith('<p> Access'): e=401
+            return Response(render('error'),code=e)
         
     def view(self,uri):
@@ -57 +59 @@
         if status:
             c.xml='<p>%s</p>'%status 
-            return render_response('error')
+            return Response(render('error'),code=400)
         status,x=interface.GetXML(uri,outputSchema=self.outputSchema)
         c.title='Viewing [%s]'%self.uri
@@ -117 +119 @@
                     session['history']=rb.tolist()
             session.save()
-        else: 
+            code=200
+        else:
+            if x.startswith('<p> Access Denied'):
+                code=401
+            else: code=400
             c.xml='<div class="error">%s</div>'%x
             r='error'
-        
+            print c.xml
+            
         if r=='content':
             #we're showing an xml document ... but it could go wrong if
             #we have crap content ...
             try:
-                resp=render_response(r)
+                resp=render(r)
             except ExpatError,e:
                 c.xml='<p> XML content is not well formed </p>'
                 c.doc=str(x)
-                resp=render_response('error')
+                resp=render('error')
+                code=400
+            resp=Response(resp,code=code)
         else:
             try:
-                resp=render_response(r)
+                resp=Response(render(r),code=code)
             except Exception,e:
                 c.xml='<p> Unexpected error [%s] viewing [%s] </p>'%(str(e),uri)
                 c.doc=''
-                resp=render_response('error')
+                code=400
+                resp=Reponse(render('error'),code=code)
         return resp