You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by kl...@apache.org on 2015/08/18 17:42:11 UTC
[1/4] couchdb commit: updated refs/heads/couchdb-peruser to 3d722bb
Repository: couchdb
Updated Branches:
refs/heads/couchdb-peruser 837c27f80 -> 3d722bb63 (forced update)
Use POST requests to verify CSRF
Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/68e83c23
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/68e83c23
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/68e83c23
Branch: refs/heads/couchdb-peruser
Commit: 68e83c23b0ac24f7f3245894a3765a5649718880
Parents: b3c5367
Author: Robert Newson <rn...@apache.org>
Authored: Mon Aug 10 20:11:47 2015 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Mon Aug 10 20:11:47 2015 +0100
----------------------------------------------------------------------
test/javascript/tests/csrf.js | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb/blob/68e83c23/test/javascript/tests/csrf.js
----------------------------------------------------------------------
diff --git a/test/javascript/tests/csrf.js b/test/javascript/tests/csrf.js
index 9baef82..9799d6f 100644
--- a/test/javascript/tests/csrf.js
+++ b/test/javascript/tests/csrf.js
@@ -11,12 +11,17 @@
// the License.
couchTests.csrf = function(debug) {
+ var db = new CouchDB("test_suite_db", {"X-Couch-Full-Commit":"false"});
+ db.deleteDb();
+ db.createDb();
+
if (debug) debugger;
// Handy function to cause CouchDB to delete the CSRF cookie
var deleteCsrf = function() {
- var xhr = CouchDB.request("GET", "/",
- {headers: {'X-CouchDB-CSRF': 'foo', 'Cookie': 'CouchDB-CSRF=foo'}});
+ var xhr = CouchDB.request("POST", "/test_suite_db/_all_docs", {
+ body: '{"keys": []}',
+ headers: {'X-CouchDB-CSRF': 'foo', 'Cookie': 'CouchDB-CSRF=foo'}});
TEquals(403, xhr.status);
};
@@ -26,7 +31,9 @@ couchTests.csrf = function(debug) {
TEquals(200, xhr.status);
// Matching but invalid cookie/header should 403
- xhr = CouchDB.request("GET", "/", {headers: {'X-CouchDB-CSRF': 'foo', 'Cookie': 'CouchDB-CSRF=foo'}});
+ xhr = CouchDB.request("POST", "/test_suite_db/_all_docs", {
+ body: '{"keys": []}',
+ headers: {'X-CouchDB-CSRF': 'foo', 'Cookie': 'CouchDB-CSRF=foo'}});
TEquals(403, xhr.status);
TEquals(null, xhr.getResponseHeader("X-CouchDB-CSRF-Valid"), "We sent invalid cookie and header");
@@ -36,17 +43,19 @@ couchTests.csrf = function(debug) {
T(cookie, "Should receive cookie");
// If I have a cookie, do I get a 403 if I don't send the header?
- xhr = CouchDB.request("GET", "/");
+ xhr = CouchDB.request("POST", "/test_suite_db/_all_docs", {body: '{"keys": []}'});
TEquals(403, xhr.status);
TEquals(null, xhr.getResponseHeader("X-CouchDB-CSRF-Valid"), "We didn't send the header");
// If I have a cookie, do I get a 200 if I send a matching header?
- xhr = CouchDB.request("GET", "/", {headers: {"X-CouchDB-CSRF": cookie[1]}});
+ xhr = CouchDB.request("POST", "/test_suite_db/_all_docs", {body: '{"keys": []}',
+ headers: {"X-CouchDB-CSRF": cookie[1]}});
TEquals(200, xhr.status);
TEquals("true", xhr.getResponseHeader("X-CouchDB-CSRF-Valid"), "Server should have sent this");
// How about the wrong header?
- xhr = CouchDB.request("GET", "/", {headers: {'X-CouchDB-CSRF': 'foo'}});
+ xhr = CouchDB.request("POST", "/test_suite_db/_all_docs", {body: '{"keys": []}',
+ headers: {'X-CouchDB-CSRF': 'foo'}});
TEquals(403, xhr.status);
TEquals(null, xhr.getResponseHeader("X-CouchDB-CSRF-Valid"), "We sent a mismatched header");
[4/4] couchdb commit: updated refs/heads/couchdb-peruser to 3d722bb
Posted by kl...@apache.org.
Add couchdb_peruser
Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/3d722bb6
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/3d722bb6
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/3d722bb6
Branch: refs/heads/couchdb-peruser
Commit: 3d722bb638d1a562efaeb33a7b8f80852bb31f2f
Parents: eb34513
Author: Klaus Trainer <kl...@apache.org>
Authored: Mon Aug 10 22:22:52 2015 +0200
Committer: Klaus Trainer <kl...@apache.org>
Committed: Tue Aug 18 10:36:59 2015 +0200
----------------------------------------------------------------------
rebar.config.script | 1 +
rel/overlay/etc/default.ini | 11 +++++++++++
rel/overlay/etc/local.ini | 10 ++++++++++
rel/reltool.config | 2 ++
4 files changed, 24 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb/blob/3d722bb6/rebar.config.script
----------------------------------------------------------------------
diff --git a/rebar.config.script b/rebar.config.script
index 374425c..55881b9 100644
--- a/rebar.config.script
+++ b/rebar.config.script
@@ -30,6 +30,7 @@ DepDescs = [
{couch_plugins, "couch-plugins", {branch, "master"}},
{couch_event, "couch-event", {branch, "master"}},
{couch_stats, "couch-stats", {branch, "master"}},
+ {couchdb_peruser, "peruser", {branch, "master"}},
{docs, "documentation", {branch, "master"}, [raw]},
{ddoc_cache, "ddoc-cache", {branch, "master"}},
{ets_lru, "ets-lru", {branch, "master"}},
http://git-wip-us.apache.org/repos/asf/couchdb/blob/3d722bb6/rel/overlay/etc/default.ini
----------------------------------------------------------------------
diff --git a/rel/overlay/etc/default.ini b/rel/overlay/etc/default.ini
index 9e18a32..ea442e8 100644
--- a/rel/overlay/etc/default.ini
+++ b/rel/overlay/etc/default.ini
@@ -45,6 +45,16 @@ checkpoint_after = 5242880 ; checkpoint after every N bytes were written
; larger buffer sizes can originate smaller files
keyvalue_buffer_size = 2097152 ; value in bytes
+[couchdb_peruser]
+; If enabled, couchdb_peruser ensures that a private per-user database
+; exists for each document in _users. These databases are writable only
+; by the corresponding user. Databases are in the following form:
+; userdb-{hex encoded username}
+enable = false
+; If set to true and a user is deleted, the respective database gets
+; deleted as well.
+delete_dbs = false
+
[httpd]
port = {{backend_port}}
bind_address = 127.0.0.1
@@ -157,6 +167,7 @@ uuids={couch_uuids, start, []}
auth_cache={couch_auth_cache, start_link, []}
os_daemons={couch_os_daemons, start_link, []}
compaction_daemon={couch_compaction_daemon, start_link, []}
+couchdb_peruser={couchdb_peruser, start_link, []}
[indexers]
couch_mrview = true
http://git-wip-us.apache.org/repos/asf/couchdb/blob/3d722bb6/rel/overlay/etc/local.ini
----------------------------------------------------------------------
diff --git a/rel/overlay/etc/local.ini b/rel/overlay/etc/local.ini
index 5877eb4..3427d73 100644
--- a/rel/overlay/etc/local.ini
+++ b/rel/overlay/etc/local.ini
@@ -7,6 +7,16 @@
[couchdb]
;max_document_size = 4294967296 ; bytes
+[couchdb_peruser]
+; If enabled, couchdb_peruser ensures that a private per-user database
+; exists for each document in _users. These databases are writable only
+; by the corresponding user. Databases are in the following form:
+; userdb-{hex encoded username}
+;enable = true
+; If set to true and a user is deleted, the respective database gets
+; deleted as well.
+;delete_dbs = true
+
[httpd]
;port = 5984
;bind_address = 127.0.0.1
http://git-wip-us.apache.org/repos/asf/couchdb/blob/3d722bb6/rel/reltool.config
----------------------------------------------------------------------
diff --git a/rel/reltool.config b/rel/reltool.config
index a52d037..d42c555 100644
--- a/rel/reltool.config
+++ b/rel/reltool.config
@@ -41,6 +41,7 @@
couch_replicator,
couch_stats,
couch_event,
+ couchdb_peruser,
ddoc_cache,
ets_lru,
fabric,
@@ -97,6 +98,7 @@
{app, couch_replicator, [{incl_cond, include}]},
{app, couch_stats, [{incl_cond, include}]},
{app, couch_event, [{incl_cond, include}]},
+ {app, couchdb_peruser, [{incl_cond, include}]},
{app, ddoc_cache, [{incl_cond, include}]},
{app, ets_lru, [{incl_cond, include}]},
{app, fabric, [{incl_cond, include}]},
[3/4] couchdb commit: updated refs/heads/couchdb-peruser to 3d722bb
Posted by kl...@apache.org.
Fix compatibility with Python 3.x
Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/eb345133
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/eb345133
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/eb345133
Branch: refs/heads/couchdb-peruser
Commit: eb3451332e549c2ec30a8f9121130e623d4f9a6c
Parents: 587646f
Author: Alexander Shorin <kx...@apache.org>
Authored: Mon Aug 17 16:17:02 2015 +0300
Committer: Alexander Shorin <kx...@apache.org>
Committed: Mon Aug 17 16:17:02 2015 +0300
----------------------------------------------------------------------
dev/run | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb/blob/eb345133/dev/run
----------------------------------------------------------------------
diff --git a/dev/run b/dev/run
index 81993b5..dc9785a 100755
--- a/dev/run
+++ b/dev/run
@@ -203,7 +203,7 @@ def find_haproxy():
)
(res, _) = p.communicate()
if res.strip():
- return res.strip()
+ return res.strip().decode()
return "/usr/sbin/haproxy"
[2/4] couchdb commit: updated refs/heads/couchdb-peruser to 3d722bb
Posted by kl...@apache.org.
boot haproxy in dev/run
Project: http://git-wip-us.apache.org/repos/asf/couchdb/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb/commit/587646f1
Tree: http://git-wip-us.apache.org/repos/asf/couchdb/tree/587646f1
Diff: http://git-wip-us.apache.org/repos/asf/couchdb/diff/587646f1
Branch: refs/heads/couchdb-peruser
Commit: 587646f1fec6f665f70c97c24f3eef95780b409a
Parents: 68e83c2
Author: Robert Newson <rn...@apache.org>
Authored: Mon Aug 17 13:56:41 2015 +0100
Committer: Robert Newson <rn...@apache.org>
Committed: Mon Aug 17 13:56:41 2015 +0100
----------------------------------------------------------------------
dev/run | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb/blob/587646f1/dev/run
----------------------------------------------------------------------
diff --git a/dev/run b/dev/run
index 74c51b0..81993b5 100755
--- a/dev/run
+++ b/dev/run
@@ -31,6 +31,7 @@ from pbkdf2 import pbkdf2_hex
COMMON_SALT = uuid.uuid4().hex
COMMON_CSRF_SECRET = uuid.uuid4().hex
+HAPROXY_PORT = os.environ.get("HAPROXY_PORT", "5984")
try:
from urllib import urlopen
@@ -193,6 +194,41 @@ def write_config(ctx, node, env):
handle.write(content)
+def find_haproxy():
+ p = sp.Popen(
+ ["which", "haproxy"],
+ stdin=sp.PIPE,
+ stdout=sp.PIPE,
+ stderr=sp.STDOUT
+ )
+ (res, _) = p.communicate()
+ if res.strip():
+ return res.strip()
+ return "/usr/sbin/haproxy"
+
+
+def boot_haproxy(ctx):
+ config = os.path.join(ctx['rootdir'], "rel", "haproxy.cfg")
+ cmd = [
+ find_haproxy(),
+ "-f",
+ config
+ ]
+ logfname = os.path.join(ctx['devdir'], "logs", "haproxy.log")
+ log = open(logfname, "w")
+ env = os.environ.copy()
+ if "HAPROXY_PORT" not in env:
+ env["HAPROXY_PORT"] = HAPROXY_PORT
+ return sp.Popen(
+ " ".join(cmd),
+ shell=True,
+ stdin=sp.PIPE,
+ stdout=log,
+ stderr=sp.STDOUT,
+ env=env
+ )
+
+
def hack_default_ini(ctx, node, content):
# Replace log file
logfile = os.path.join(ctx['devdir'], "logs", "%s.log" % node)
@@ -275,6 +311,7 @@ def kill_processes(ctx):
def boot_nodes(ctx):
for node in ctx['nodes']:
ctx['procs'].append(boot_node(ctx, node))
+ ctx['procs'].append(boot_haproxy(ctx))
def ensure_all_nodes_alive(ctx):