diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 933cf08..06a3c1c 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -46,7 +46,7 @@ build_docker: build_wheel: stage: build script: - - python3.6 setup.py egg_info bdist_wheel + - python3.7 setup.py egg_info bdist_wheel - cd dist - sha256sum *.whl > SHA256SUMS artifacts: @@ -71,16 +71,16 @@ build_debian: - gzip -9n package/debian/matemat/usr/share/doc/matemat/changelog - cp -r static/ package/debian/matemat/usr/lib/matemat/static/ - cp -r templates/ package/debian/matemat/usr/lib/matemat/templates/ - - python3.6 setup.py egg_info install --root=package/debian/matemat/ --prefix=/usr --optimize=1 + - python3.7 setup.py egg_info install --root=package/debian/matemat/ --prefix=/usr --optimize=1 - cd package/debian - mkdir -p matemat/usr/lib/python3/dist-packages/ - - rsync -a matemat/usr/lib/python3.6/site-packages/ matemat/usr/lib/python3/dist-packages/ - - rm -rf matemat/usr/lib/python3.6/ + - rsync -a matemat/usr/lib/python3.7/site-packages/ matemat/usr/lib/python3/dist-packages/ + - rm -rf matemat/usr/lib/python3.7/ - find matemat/usr/lib/python3/dist-packages -name __pycache__ -exec rm -r {} \; 2>/dev/null || true - find matemat/usr/lib/python3/dist-packages -name '*.pyc' -exec rm {} \; - mv matemat/usr/bin/matemat matemat/usr/lib/matemat/matemat - rm -rf matemat/usr/bin - - sed -re 's$#!/usr/local/bin/python3.6$#!/usr/bin/python3$' -i matemat/usr/lib/matemat/matemat + - sed -re 's$#!/usr/local/bin/python3.7$#!/usr/bin/python3$' -i matemat/usr/lib/matemat/matemat - find matemat -type f -exec chmod 0644 {} \; - find matemat -type d -exec chmod 755 {} \; - chmod +x matemat/usr/lib/matemat/matemat matemat/DEBIAN/postinst matemat/DEBIAN/prerm matemat/DEBIAN/postrm @@ -99,7 +99,7 @@ build_archlinux: stage: build image: archlinux/base:latest # Use an archlinux image instead of the customized debian image. script: - - pacman -Sy --noconfirm python python-setuptools python-pip python-wheel python-jinja python-pillow python-magic base-devel + - pacman -Sy --noconfirm python python-setuptools python-pip python-wheel python-bottle python-jinja python-pillow python-magic base-devel - export MATEMAT_VERSION=$(python -c 'import matemat; print(matemat.__version__)') - cp -r static/ package/archlinux/matemat/usr/lib/matemat/static/ - cp -r templates/ package/archlinux/matemat/usr/lib/matemat/templates/ diff --git a/CHANGELOG.md b/CHANGELOG.md index c9a2aed..3569157 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,44 @@ # Matemat Changelog + +## Version 0.2.3 + +Bugfix fix release + +### Changes + + +- Fix: Session timeout lead to 500 error + + + + + +## Version 0.2.2 + +Security fix release + +### Changes + + +- Fix: Sessions were shared between clients + + + + + +## Version 0.2.1 + +Hotfix release + +### Changes + + +- Fix: Properly load config + + + + ## Version 0.2 diff --git a/matemat/__init__.py b/matemat/__init__.py index c1ae7f9..12dad7e 100644 --- a/matemat/__init__.py +++ b/matemat/__init__.py @@ -1,2 +1,2 @@ -__version__ = '0.2' +__version__ = '0.2.3' diff --git a/matemat/__main__.py b/matemat/__main__.py index 5da5ea8..a5cbe0b 100644 --- a/matemat/__main__.py +++ b/matemat/__main__.py @@ -7,7 +7,7 @@ import bottle from matemat.db import MatematDatabase from matemat.webserver import cron from matemat.webserver.logger import Logger -from matemat.webserver.config import get_config, parse_config_file +from matemat.webserver.config import get_config, get_app_config, parse_config_file from matemat.webserver.template import init as template_init # Those imports are actually needed, as they implicitly register pagelets. @@ -18,41 +18,41 @@ from matemat.webserver.pagelets import * def _init(config: Dict[str, Any]): logger = Logger.instance() # Set default values for missing config items - if 'InstanceName' not in config: - config['InstanceName'] = 'Matemat' + if 'InstanceName' not in config['pagelet_variables']: + config['pagelet_variables']['InstanceName'] = 'Matemat' logger.warning('Property \'InstanceName\' not set, using \'Matemat\'') - if 'UploadDir' not in config: - config['UploadDir'] = './static/upload/' + if 'UploadDir' not in config['pagelet_variables']: + config['pagelet_variables']['UploadDir'] = './static/upload/' logger.warning('Property \'UploadDir\' not set, using \'./static/upload/\'') - if 'DatabaseFile' not in config: - config['DatabaseFile'] = './matemat.db' + if 'DatabaseFile' not in config['pagelet_variables']: + config['pagelet_variables']['DatabaseFile'] = './matemat.db' logger.warning('Property \'DatabaseFile\' not set, using \'./matemat.db\'') - if 'SmtpSendReceipts' not in config: - config['SmtpSendReceipts'] = '0' + if 'SmtpSendReceipts' not in config['pagelet_variables']: + config['pagelet_variables']['SmtpSendReceipts'] = '0' logger.warning('Property \'SmtpSendReceipts\' not set, using \'0\'') - if config['SmtpSendReceipts'] == '1': - if 'SmtpFrom' not in config: + if config['pagelet_variables']['SmtpSendReceipts'] == '1': + if 'SmtpFrom' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpFrom\' missing.') raise KeyError() - if 'SmtpSubj' not in config: + if 'SmtpSubj' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpSubj\' missing.') raise KeyError() - if 'SmtpHost' not in config: + if 'SmtpHost' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpHost\' missing.') raise KeyError() - if 'SmtpPort' not in config: + if 'SmtpPort' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpPort\' missing.') raise KeyError() - if 'SmtpUser' not in config: + if 'SmtpUser' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpUser\' missing.') raise KeyError() - if 'SmtpPass' not in config: + if 'SmtpPass' not in config['pagelet_variables']: logger.fatal('\'SmtpSendReceipts\' set to \'1\', but \'SmtpPass\' missing.') raise KeyError() - if 'SmtpEnforceTLS' not in config: + if 'SmtpEnforceTLS' not in config['pagelet_variables']: config['SmtpEnforceTLS'] = '1' logger.warning('Property \'SmtpEnforceTLS\' not set, using \'1\'') - with MatematDatabase(config['DatabaseFile']): + with MatematDatabase(config['pagelet_variables']['DatabaseFile']): # Connect to the database to create it and perform any schema migrations pass # Initialize Jinaj2 template system diff --git a/matemat/webserver/session/sessions.py b/matemat/webserver/session/sessions.py index 55f0549..a3d3672 100644 --- a/matemat/webserver/session/sessions.py +++ b/matemat/webserver/session/sessions.py @@ -23,15 +23,18 @@ def start() -> str: # Reference date for session timeout now = datetime.utcnow() # Read the client's session ID, if any - session_id = str(request.get_cookie(_COOKIE_NAME, secret=__key)) + session_id = request.get_cookie(_COOKIE_NAME, secret=__key) # If there is no active session, create a new session ID if session_id is None: session_id = str(uuid4()) + else: + session_id = str(session_id) # Check for session timeout if session_id in __session_vars and __session_vars[session_id][0] < now: end(session_id) - raise TimeoutError('Session timed out.') + # Create new session ID after terminating the previous session + session_id = str(uuid4()) # Update or initialize the session timeout if session_id not in __session_vars: __session_vars[session_id] = (now + timedelta(seconds=_SESSION_TIMEOUT)), dict() diff --git a/package/archlinux/PKGBUILD b/package/archlinux/PKGBUILD index 644b974..68994c7 100644 --- a/package/archlinux/PKGBUILD +++ b/package/archlinux/PKGBUILD @@ -2,7 +2,7 @@ # Maintainer: s3lph pkgname=matemat -pkgver=0.1 +pkgver=0.2.3 pkgrel=1 arch=('any') @@ -12,7 +12,7 @@ licence=('MIT') depends=( 'python' - 'ptyhon-bottle' + 'python-bottle' 'python-jinja' 'python-pillow' 'python-magic' diff --git a/package/debian/matemat/DEBIAN/control b/package/debian/matemat/DEBIAN/control index ae7a111..ad4b86d 100644 --- a/package/debian/matemat/DEBIAN/control +++ b/package/debian/matemat/DEBIAN/control @@ -1,5 +1,5 @@ Package: matemat -Version: 0.1 +Version: 0.2.3 Maintainer: s3lph Section: web Priority: optional