From 975efff634d215bbc6430ffd6d35f4a415678060 Mon Sep 17 00:00:00 2001 From: James Taylor Date: Sun, 23 Aug 2009 12:28:36 -0400 Subject: [PATCH] Fix security problem with grids. Template should not be passed at call time, it must be passed at configure time. --- lib/galaxy/web/controllers/history.py | 10 +- lib/galaxy/web/controllers/requests.py | 3 +- lib/galaxy/web/controllers/requests_admin.py | 3 +- lib/galaxy/web/framework/helpers/grids.py | 6 +- manage_db.sh | 0 templates/grid.mako | 196 +++++++++++++++++++ 6 files changed, 209 insertions(+), 9 deletions(-) mode change 100644 => 100755 manage_db.sh create mode 100644 templates/grid.mako diff --git a/lib/galaxy/web/controllers/history.py b/lib/galaxy/web/controllers/history.py index bc42ebaeae4..bb45cb06e03 100644 --- a/lib/galaxy/web/controllers/history.py +++ b/lib/galaxy/web/controllers/history.py @@ -39,6 +39,7 @@ class HistoryListGrid( grids.Grid ): # Grid definition title = "Stored histories" model_class = model.History + template='/history/grid.mako' default_sort_key = "-create_time" columns = [ grids.GridColumn( "Name", key="name", @@ -86,6 +87,7 @@ class SharedHistoryListGrid( grids.Grid ): return history.user.email # Grid definition title = "Histories shared with you by others" + template='/history/grid.mako' model_class = model.History default_sort_key = "-update_time" columns = [ @@ -161,7 +163,7 @@ class HistoryController( BaseController ): status, message = self._list_undelete( trans, histories ) trans.sa_session.flush() # Render the list view - return self.stored_list_grid( trans, status=status, message=message, template='/history/grid.mako', **kwargs ) + return self.stored_list_grid( trans, status=status, message=message, **kwargs ) def _list_delete( self, trans, histories ): """Delete histories""" n_deleted = 0 @@ -240,14 +242,14 @@ class HistoryController( BaseController ): if operation == "clone": if not id: message = "Select a history to clone" - return self.shared_list_grid( trans, status='error', message=message, template='/history/grid.mako', **kwargs ) + return self.shared_list_grid( trans, status='error', message=message, **kwargs ) # When cloning shared histories, only copy active datasets new_kwargs = { 'clone_choice' : 'active' } return self.clone( trans, id, **new_kwargs ) elif operation == 'unshare': if not id: message = "Select a history to unshare" - return self.shared_list_grid( trans, status='error', message=message, template='/history/grid.mako', **kwargs ) + return self.shared_list_grid( trans, status='error', message=message, **kwargs ) ids = util.listify( id ) histories = [] for history_id in ids: @@ -261,7 +263,7 @@ class HistoryController( BaseController ): message = "Unshared %d shared histories" % len( ids ) status = 'done' # Render the list view - return self.shared_list_grid( trans, status=status, message=message, template='/history/grid.mako', **kwargs ) + return self.shared_list_grid( trans, status=status, message=message, **kwargs ) @web.expose def delete_current( self, trans ): """Delete just the active history -- this does not require a logged in user.""" diff --git a/lib/galaxy/web/controllers/requests.py b/lib/galaxy/web/controllers/requests.py index a63c9ac94d6..77f8fcdc474 100644 --- a/lib/galaxy/web/controllers/requests.py +++ b/lib/galaxy/web/controllers/requests.py @@ -16,6 +16,7 @@ log = logging.getLogger( __name__ ) class RequestsListGrid( grids.Grid ): title = "Sequencing Requests" + template = '/requests/grid.mako' model_class = model.Request default_sort_key = "-create_time" show_filter = model.Request.states.UNSUBMITTED @@ -103,7 +104,7 @@ class Requests( BaseController ): self.request_grid.default_filter = dict(state=kwargs['show_filter'], deleted=False) self.request_grid.show_filter = kwargs.get('show_filter', trans.app.model.Request.states.UNSUBMITTED) # Render the list view - return self.request_grid( trans, template='/requests/grid.mako', **kwargs ) + return self.request_grid( trans, **kwargs ) def __show_request(self, trans, id, add_sample=False): try: diff --git a/lib/galaxy/web/controllers/requests_admin.py b/lib/galaxy/web/controllers/requests_admin.py index fd821fad40b..f48a86061a9 100644 --- a/lib/galaxy/web/controllers/requests_admin.py +++ b/lib/galaxy/web/controllers/requests_admin.py @@ -14,6 +14,7 @@ log = logging.getLogger( __name__ ) class RequestsListGrid( grids.Grid ): title = "Sequencing Requests" + template = "admin/requests/grid.mako" model_class = model.Request default_sort_key = "-create_time" show_filter = model.Request.states.SUBMITTED @@ -101,7 +102,7 @@ class Requests( BaseController ): self.request_grid.default_filter = dict(state=kwargs['show_filter'], deleted=False) self.request_grid.show_filter = kwargs.get('show_filter', trans.app.model.Request.states.SUBMITTED) # Render the list view - return self.request_grid( trans, template='/admin/requests/grid.mako', **kwargs ) + return self.request_grid( trans, **kwargs ) @web.expose @web.require_admin def edit(self, trans, **kwd): diff --git a/lib/galaxy/web/framework/helpers/grids.py b/lib/galaxy/web/framework/helpers/grids.py index ff7d30fbf00..fe1ed635b3d 100644 --- a/lib/galaxy/web/framework/helpers/grids.py +++ b/lib/galaxy/web/framework/helpers/grids.py @@ -14,8 +14,9 @@ class Grid( object ): title = "" exposed = True model_class = None - template = None + template = "grid.mako" columns = [] + operations = [] standard_filters = [] default_filter = None default_sort_key = None @@ -25,7 +26,6 @@ class Grid( object ): def __call__( self, trans, **kwargs ): status = kwargs.get( 'status', None ) message = kwargs.get( 'message', None ) - template = kwargs.get( 'template', None ) session = trans.sa_session # Build initial query query = self.build_initial_query( session ) @@ -77,7 +77,7 @@ class Grid( object ): else: new_kwargs[ 'id' ] = trans.security.encode_id( id ) return url_for( **new_kwargs ) - return trans.fill_template( template, + return trans.fill_template( self.template, grid=self, query=query, sort_key=sort_key, diff --git a/manage_db.sh b/manage_db.sh old mode 100644 new mode 100755 diff --git a/templates/grid.mako b/templates/grid.mako new file mode 100644 index 00000000000..5c63caa7552 --- /dev/null +++ b/templates/grid.mako @@ -0,0 +1,196 @@ +<%inherit file="/base.mako"/> +<%def name="title()">${grid.title} + +%if message: +

+

${message}
+
+

+%endif + +<%def name="javascripts()"> + ${parent.javascripts()} + + + +<%def name="stylesheets()"> + + + + +
+

${grid.title}

+ %if grid.standard_filters: + Filter: + %for i, filter in enumerate( grid.standard_filters ): + %if i > 0: + | + %endif + ${filter.label} + %endfor + %endif +
+ + +
+ + + + + %for column in grid.columns: + %if column.visible: + <% + href = "" + extra = "" + if column.sortable: + if sort_key == column.key: + if sort_order == "asc": + href = url( sort=( "-" + column.key ) ) + extra = "↓" + else: + href = url( sort=( column.key ) ) + extra = "↑" + else: + href = url( sort=column.key ) + %> + 1: + colspan="${column.ncells}" + %endif + > + %if href: + ${column.label} + %else: + ${column.label} + %endif + ${extra} + + %endif + %endfor + + + + + %for i, item in enumerate( query ): + + ## Item selection column + + ## Data columns + %for column in grid.columns: + %if column.visible: + <% + # Link + link = column.get_link( trans, grid, item ) + if link: + href = url( **link ) + else: + href = None + # Value (coerced to list so we can loop) + value = column.get_value( trans, grid, item ) + if column.ncells == 1: + value = [ value ] + %> + %for cellnum, v in enumerate( value ): + <% + # Attach popup menu? + if column.attach_popup and cellnum == 0: + extra = '' % i + else: + extra = "" + %> + %if href: + + %else: + + %endif + %endfor + %endif + %endfor + ## Actions column + + + %endfor + + + + + + + +
+ +
${v}${extra}
${v}${extra} +
+ %for operation in grid.operations: + %if operation.allowed( item ): + ${operation.label} + %endif + %endfor +
+
+ For selected items: + %for operation in grid.operations: + %if operation.allow_multiple: + + %endif + %endfor +
+