ynerant/django-cas-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Protect the auth view with a shared secret

Browse Source
This commit is contained in:
Valentin Samir
2015-06-03 18:32:15 +02:00
parent cb84936b6c
commit 603b4a8063
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
cas_server/views.py
View File

@ -294,9 +294,13 @@ class Auth(View):
username = request.POST.get('username')
password = request.POST.get('password')
service = request.POST.get('service')
secret = request.POST.get('secret')
if not settings.CAS_AUTH_SHARED_SECRET:
return HttpResponse("no\nplease set CAS_AUTH_SHARED_SECRET", content_type="text/plain")
if secret != settings.CAS_AUTH_SHARED_SECRET:
return HttpResponse("no\n", content_type="text/plain")
if not username or not password or not service:
print "not username or service or password"
return HttpResponse("no\n", content_type="text/plain")
form = forms.UserCredential(
request.POST,