login_password is expecting that request content_type will be
'application/x-www-form-urlencoded'.
Current check is an equality check of content_type http header.
RFC 3875 defines that content type can contain parameters separated by
';'. For example: when firefox is doing ajax call it sets the request
header to 'application/x-www-form-urlencoded; charset=UTF-8' which leads
to negative result.
This patch makes the check more benevolent to allow such values.
Patch is a fix-up for:
https://fedorahosted.org/freeipa/ticket/2095
--
Petr Vobornik
From aabee55ec63b119a5556677508ae4d2e2b9daac4 Mon Sep 17 00:00:00 2001
From: Petr Vobornik <pvobo...@redhat.com>
Date: Wed, 29 Feb 2012 15:25:40 +0100
Subject: [PATCH] Fixed content type check in login_password
login_password is expecting that request content_type will be 'application/x-www-form-urlencoded'.
Current check is an equality check of content_type http header.
RFC 3875 defines that content type can contain parameters separated by ';'. For example: when firefox is doing ajax call it sets the request header to 'application/x-www-form-urlencoded; charset=UTF-8' which leads to negative result.
This patch makes the check more benevolent to allow such values.
Patch is a fixup for:
https://fedorahosted.org/freeipa/ticket/2095
---
ipaserver/rpcserver.py | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py
index c383f0482171e264c379aa594568f036feafe915..3ada8b48ff2ed16bf9d935c6a6f87539e2f1d9db 100644
--- a/ipaserver/rpcserver.py
+++ b/ipaserver/rpcserver.py
@@ -894,7 +894,7 @@ class login_password(Backend, KerberosSession, HTTP_Status):
# Get the user and password parameters from the request
content_type = environ.get('CONTENT_TYPE', '').lower()
- if content_type != 'application/x-www-form-urlencoded':
+ if not content_type.startswith('application/x-www-form-urlencoded'):
return self.bad_request(environ, start_response, "Content-Type must be application/x-www-form-urlencoded")
method = environ.get('REQUEST_METHOD', '').upper()
--
1.7.7.6
_______________________________________________
Freeipa-devel mailing list
Freeipa-devel@redhat.com
https://www.redhat.com/mailman/listinfo/freeipa-devel
