Skip to content

Commit 952f8e5

Browse files
jbureljburel
committed
SV commits
1 parent 9a545ba commit 952f8e5

File tree

13 files changed

+84
-132
lines changed

13 files changed

+84
-132
lines changed

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@
2222
- Fix partial loading of annotations ([#256](https://github.com/ome/omero-web/pull/256))
2323
- Fix ignored limit in webgateway/table endpoint ([#268](https://github.com/ome/omero-web/pull/268))
2424

25+
- Security vulnerability fixes for
26+
[2021-SV1](https://www.openmicroscopy.org/security/advisories/2021-SV1-user-context/),
27+
[2021-SV2](https://www.openmicroscopy.org/security/advisories/2021-SV2-url-validation/)
28+
2529
5.8.1 (September 2020)
2630
----------------------
2731

‎omeroweb/decorators.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -582,7 +582,8 @@ def __getattr__(self, name):
582582

583583
def prepare_context(self, request, context, *args, **kwargs):
584584
""" Hook for adding additional data to the context dict """
585-
pass
585+
context["html"] = context.get("html", {})
586+
context["html"]["meta_referrer"] = settings.HTML_META_REFERRER
586587

587588
def __call__(ctx, f):
588589
""" Here we wrap the view method f and return the wrapped method """

‎omeroweb/settings.py‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -508,6 +508,12 @@ def leave_none_unset_int(s):
508508
leave_none_unset,
509509
"The name to use for session cookies",
510510
],
511+
"omero.web.session_cookie_path": [
512+
"SESSION_COOKIE_PATH",
513+
None,
514+
leave_none_unset,
515+
"The path to use for session cookies",
516+
],
511517
"omero.web.session_cookie_secure": [
512518
"SESSION_COOKIE_SECURE",
513519
"false",
@@ -866,6 +872,16 @@ def leave_none_unset_int(s):
866872
' {"experimenter": -1}}\'``'
867873
),
868874
],
875+
"omero.web.redirect_allowed_hosts": [
876+
"REDIRECT_ALLOWED_HOSTS",
877+
"[]",
878+
json.loads,
879+
(
880+
"If you wish to allow redirects to an external site, "
881+
"the domains must be listed here. "
882+
'For example ["openmicroscopy.org"].'
883+
),
884+
],
869885
"omero.web.login.show_client_downloads": [
870886
"SHOW_CLIENT_DOWNLOADS",
871887
"true",
@@ -1022,6 +1038,20 @@ def leave_none_unset_int(s):
10221038
"will be authorized to make cross-site HTTP requests."
10231039
),
10241040
],
1041+
"omero.web.html_meta_referrer": [
1042+
"HTML_META_REFERRER",
1043+
"origin-when-crossorigin",
1044+
str,
1045+
(
1046+
"Default content for the HTML Meta referrer tag. "
1047+
"See https://www.w3.org/TR/referrer-policy/#referrer-policies for "
1048+
"allowed values and https://caniuse.com/#feat=referrer-policy for "
1049+
"browser compatibility. "
1050+
"Warning: Internet Explorer 11 does not support the default value "
1051+
'of this setting, you may want to change this to "origin" after '
1052+
"reviewing the linked documentation."
1053+
),
1054+
],
10251055
"omero.web.x_frame_options": [
10261056
"X_FRAME_OPTIONS",
10271057
"SAMEORIGIN",

‎omeroweb/webclient/decorators.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@
3535

3636
from omeroweb.webclient.forms import GlobalSearchForm
3737
from omeroweb.utils import reverse_with_params
38-
from omeroweb.webgateway.marshal import eventContextMarshal
3938

4039
logger = logging.getLogger(__name__)
4140

@@ -116,6 +115,8 @@ def prepare_context(self, request, context, *args, **kwargs):
116115
context.
117116
"""
118117

118+
super(render_response, self).prepare_context(request, context, *args, **kwargs)
119+
119120
# we expect @login_required to pass us 'conn', but just in case...
120121
if "conn" not in kwargs:
121122
return
@@ -134,7 +135,6 @@ def prepare_context(self, request, context, *args, **kwargs):
134135
public_user = omeroweb.decorators.is_public_user(request)
135136
if public_user is not None:
136137
context["ome"]["is_public_user"] = public_user
137-
context["ome"]["eventContext"] = eventContextMarshal(conn.getEventContext())
138138
context["ome"]["user"] = conn.getUser
139139
context["ome"]["user_id"] = request.session.get("user_id", conn.getUserId())
140140
context["ome"]["group_id"] = request.session.get("group_id", None)

‎omeroweb/webclient/forms.py‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@
3737
from .custom_forms import AnnotationModelMultipleChoiceField
3838
from .custom_forms import ObjectModelMultipleChoiceField
3939
from omeroweb.webadmin.custom_forms import ExperimenterModelMultipleChoiceField
40-
from omeroweb.webadmin.custom_forms import GroupModelMultipleChoiceField
4140
from omeroweb.webadmin.custom_forms import GroupModelChoiceField
4241
from omeroweb.webclient.webclient_utils import formatPercentFraction
4342

@@ -127,23 +126,6 @@ def clean_expiration(self):
127126
return self.cleaned_data["expiration"]
128127

129128

130-
class BasketShareForm(ShareForm):
131-
def __init__(self, *args, **kwargs):
132-
super(BasketShareForm, self).__init__(*args, **kwargs)
133-
134-
try:
135-
self.fields["image"] = GroupModelMultipleChoiceField(
136-
queryset=kwargs["initial"]["images"],
137-
initial=kwargs["initial"]["selected"],
138-
widget=forms.SelectMultiple(attrs={"size": 10}),
139-
)
140-
except Exception:
141-
self.fields["image"] = GroupModelMultipleChoiceField(
142-
queryset=kwargs["initial"]["images"],
143-
widget=forms.SelectMultiple(attrs={"size": 10}),
144-
)
145-
146-
147129
class ContainerForm(NonASCIIForm):
148130

149131
name = forms.CharField(max_length=250, widget=forms.TextInput(attrs={"size": 45}))

‎omeroweb/webclient/static/webclient/javascript/ome.tree.js‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1151,8 +1151,8 @@ $(function() {
11511151

11521152
var userId = WEBCLIENT.active_user.id,
11531153
// admin may be viewing a Group that they are not a member of
1154-
memberOfGroup = WEBCLIENT.eventContext.memberOfGroups.indexOf(WEBCLIENT.active_group_id) > -1,
1155-
writeOwned = WEBCLIENT.eventContext.adminPrivileges.indexOf("WriteOwned") > -1,
1154+
memberOfGroup = WEBCLIENT.member_of_groups.indexOf(WEBCLIENT.active_group_id) > -1,
1155+
writeOwned = WEBCLIENT.current_admin_privileges.indexOf("WriteOwned") > -1,
11561156
allMembers = userId === -1,
11571157
// canCreate if looking at your own data or 'All Members' OR User's data && writeOwned
11581158
canCreate = (userId === WEBCLIENT.USER.id || (allMembers && memberOfGroup) ||

‎omeroweb/webclient/templates/webclient/base/base_container.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@
166166
WEBCLIENT.active_group_id = {{ active_group.id }};
167167
WEBCLIENT.USER = {'id': {{ ome.user.id }}, 'fullName': "{{ ome.user.getFullName }}"};
168168
WEBCLIENT.active_user = {'id': {{ ome.user_id }}, 'fullName': "{{ active_user.getFullName }}"};
169-
WEBCLIENT.eventContext = {{ ome.eventContext|json_dumps|safe }};
169+
WEBCLIENT.member_of_groups = {{ member_of_groups|json_dumps|safe }};
170170
WEBCLIENT.isAdmin = {% if ome.user.isAdmin %}true{% else %}false{% endif %};
171171
WEBCLIENT.CAN_CREATE = {{ ome.can_create|json_dumps|safe }};
172172
WEBCLIENT.current_admin_privileges = {{ current_admin_privileges|json_dumps|safe }};

‎omeroweb/webclient/templates/webclient/base/includes/toolbar_forms.html‎

Lines changed: 10 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
{% comment %}
55
<!--
6-
Copyright (C) 2011 University of Dundee & Open Microscopy Environment.
6+
Copyright (C) 2011-2021 University of Dundee & Open Microscopy Environment.
77
All rights reserved.
88
This program is free software: you can redistribute it and/or modify
99
it under the terms of the GNU Affero General Public License as
@@ -25,82 +25,33 @@
2525
if (typeof OME === "undefined") { OME={}; }
2626

2727
OME.createShare = function() {
28-
29-
var productListQuery = [];
30-
31-
// we do inst.get_selected() here, since we then get objects
32-
// instead of ids for some reason?
33-
var inst = $.jstree.reference('#dataTree');
34-
data = inst.get_selected(true);
35-
data.forEach(function(node){
36-
productListQuery.push(node.type + "=" + node.data.id);
37-
});
38-
39-
var query = '{% url 'manage_action_containers' "add" "share" %}' + "?"+productListQuery.join("&");
4028
$("#create_share_form").dialog("open");
41-
$("#create_share_form").attr("action", query)
42-
$("#create_share_form").load(query);
4329
return false;
4430
}
4531

4632
$(document).ready(function(){
4733

48-
// AJAX handling of create-discussion form
49-
$("#create_share_form").ajaxForm({
50-
success: function(html) {
51-
if (html.indexOf("shareId") > -1) {
52-
var shareId = html.replace("shareId:", "");
53-
$("#create_share_form").dialog( "close" );
54-
$("#shareCreatedId").text(shareId);
55-
$("#share_dialog_form").dialog("open").show();
56-
} else {
57-
$("#create_share_form").html(html);
58-
}
59-
},
60-
});
61-
62-
$("#share_dialog_form").dialog({
63-
autoOpen: false,
64-
resizable: true,
65-
height: 150,
66-
width:300,
67-
modal: true,
68-
buttons: {
69-
"OK": function() {
70-
$( this ).dialog( "close" );
71-
}
72-
}
73-
});
74-
7534
$("#create_share_form").dialog({
35+
title: "Shares not supported",
7636
autoOpen: false,
7737
resizable: true,
78-
height: 600,
38+
height: 250,
7939
width:450,
8040
modal: true,
8141
buttons: {
82-
"Accept": function() {
83-
// simply submit the form
84-
$("#create_share_form").submit();
85-
},
86-
"Cancel": function() {
42+
"OK": function() {
8743
$( this ).dialog( "close" );
8844
}
8945
}
9046
});
91-
92-
9347
});
9448
</script>
9549

9650

97-
98-
<!-- hidden form for creating share - shown in dialog & loaded by AJAX -->
99-
<form id="create_share_form" action="#" method="post" title="Create Share" class="standard_form">{% csrf_token %}
100-
</form>
101-
102-
<form id="share_dialog_form" action="#" title="Create Share" style="display:none">
103-
<p style="font-size: 120%; font-weight: bold">
104-
Share <span id="shareCreatedId"></span> was created successfully.
51+
<!-- hidden dialog -->
52+
<div id="create_share_form" style="display:none">
53+
<p>Share functionality is no longer supported.</p>
54+
<p>Please see <a target="_blank" href="https://www.openmicroscopy.org/omero/features/share/">Sharing your data in OMERO</a>
55+
for alternative workflows.
10556
</p>
106-
</form>
57+
</div>

‎omeroweb/webclient/templates/webclient/data/containers.html‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -208,9 +208,9 @@
208208
// If we are filtering to show another user's data,
209209
// we 'should' have writeOwned privilege
210210

211-
var writeOwned = WEBCLIENT.eventContext.adminPrivileges.indexOf("WriteOwned") > -1;
211+
var writeOwned = WEBCLIENT.current_admin_privileges.indexOf("WriteOwned") > -1;
212212
var $f = $("#new-container-form");
213-
var memberOfGroup = WEBCLIENT.eventContext.memberOfGroups.indexOf(WEBCLIENT.active_group_id) > -1;
213+
var memberOfGroup = WEBCLIENT.member_of_groups.indexOf(WEBCLIENT.active_group_id) > -1;
214214

215215
// clear fields
216216
$("input[name='owner']", $f).val("");
@@ -289,8 +289,8 @@
289289

290290
// We 'canCreate' top level items, E.g. Project, Dataset, Screen, if the current userId is self or 'All Members'
291291
var userId = {{ ome.user_id }},
292-
memberOfGroup = WEBCLIENT.eventContext.memberOfGroups.indexOf(WEBCLIENT.active_group_id) > -1,
293-
writeOwned = WEBCLIENT.eventContext.adminPrivileges.indexOf("WriteOwned") > -1,
292+
memberOfGroup = WEBCLIENT.member_of_groups.indexOf(WEBCLIENT.active_group_id) > -1,
293+
writeOwned = WEBCLIENT.current_admin_privileges.indexOf("WriteOwned") > -1,
294294
allMembers = userId === -1,
295295
// canCreate if looking at your own data or 'All Members' OR User's data with writeOwned
296296
canCreate = (userId === WEBCLIENT.USER.id || (allMembers && memberOfGroup) ||

‎omeroweb/webclient/templates/webclient/public/public.html‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -489,7 +489,15 @@
489489

490490
<div class="left_panel_tree_container">
491491

492-
<div id="tree_details" class="left_panel_tree">
492+
<div style="height: 110px; padding: 15px; box-sizing: border-box;">
493+
<p>Creating new shares is no longer supported. Previously created shares are shown below.</p>
494+
<p>Please see <a target="_blank" href="https://www.openmicroscopy.org/omero/features/share/">Sharing your data in
495+
OMERO</a>
496+
for alternative workflows.
497+
</p>
498+
</div>
499+
500+
<div id="tree_details" class="left_panel_tree" style="height: calc(100% - 110px)">
493501
<div class="datashareTree" id="dataTree"></div>
494502
</div>
495503

0 commit comments

Comments
 (0)