Revision 2a496ad8
Von Moritz Bunkus vor mehr als 5 Jahren hinzugefügt
| SL/Auth.pm | ||
|---|---|---|
|
}
|
||
|
|
||
|
if (!$dont_abort) {
|
||
|
$::dispatcher->reply_with_json_error(error => 'access') if $::request->type eq 'json';
|
||
|
|
||
|
delete $::form->{title};
|
||
|
$::form->show_generic_error($::locale->text("You do not have the permissions to access this function."));
|
||
|
}
|
||
| SL/Controller/Base.pm | ||
|---|---|---|
|
header => 1,
|
||
|
layout => 1,
|
||
|
process => 1,
|
||
|
status => '200 ok',
|
||
|
);
|
||
|
$options->{$_} //= $defaults{$_} for keys %defaults;
|
||
|
$options->{type} = lc $options->{type};
|
||
| ... | ... | |
|
: 'application/json';
|
||
|
|
||
|
print $::form->create_http_response(content_type => $content_type,
|
||
|
charset => 'UTF-8');
|
||
|
charset => 'UTF-8',
|
||
|
(status => $options->{status}) x !!$options->{status});
|
||
|
}
|
||
|
}
|
||
|
|
||
| SL/Dispatcher.pm | ||
|---|---|---|
|
if ( (($script eq 'login') && !$action)
|
||
|
|| ($script eq 'admin')
|
||
|
|| (SL::Auth::SESSION_EXPIRED() == $session_result)) {
|
||
|
$self->redirect_to_login(script => $script, error => 'session');
|
||
|
$self->handle_login_error(script => $script, error => 'session');
|
||
|
|
||
|
}
|
||
|
|
||
| ... | ... | |
|
$::lxdebug->leave_sub;
|
||
|
}
|
||
|
|
||
|
sub redirect_to_login {
|
||
|
sub reply_with_json_error {
|
||
|
my ($self, %params) = @_;
|
||
|
|
||
|
my %errors = (
|
||
|
session => { code => '401 Unauthorized', text => 'session expired' },
|
||
|
password => { code => '401 Unauthorized', text => 'incorrect username or password' },
|
||
|
action => { code => '400 Bad request', text => 'incorrect or missing action' },
|
||
|
access => { code => '403 Forbidden', text => 'no permissions for accessing this function' },
|
||
|
_default => { code => '500 Internal server error', text => 'general server-side error' },
|
||
|
);
|
||
|
|
||
|
my $error = $errors{$params{error}} // $errors{_default};
|
||
|
my $reply = SL::JSON::to_json({ status => 'failed', error => $error->{text} });
|
||
|
|
||
|
print $::request->cgi->header(
|
||
|
-type => 'application/json',
|
||
|
-charset => 'utf-8',
|
||
|
-status => $error->{code},
|
||
|
);
|
||
|
|
||
|
print $reply;
|
||
|
|
||
|
$self->end_request;
|
||
|
}
|
||
|
|
||
|
sub handle_login_error {
|
||
|
my ($self, %params) = @_;
|
||
|
|
||
|
return $self->reply_with_json_error(error => $params{error}) if $::request->type eq 'json';
|
||
|
|
||
|
my $action = ($params{script} // '') =~ m/^admin/i ? 'Admin/login' : 'LoginScreen/user_login';
|
||
|
$action .= '&error=' . $params{error} if $params{error};
|
||
|
|
||
| ... | ... | |
|
eval {
|
||
|
# Redirect simple requests to controller.pl without any GET/POST
|
||
|
# param to the login page.
|
||
|
$self->redirect_to_login(error => 'action') if !$::form->{action};
|
||
|
$self->handle_login_error(error => 'action') if !$::form->{action};
|
||
|
|
||
|
# Show an error if the »action« parameter doesn't match the
|
||
|
# pattern »Controller/action«.
|
||
| SL/Dispatcher/AuthHandler/User.pm | ||
|---|---|---|
|
my $self = shift;
|
||
|
|
||
|
$::auth->punish_wrong_login;
|
||
|
$::dispatcher->handle_login_error(error => 'password');
|
||
|
|
||
|
require SL::Controller::Base;
|
||
|
SL::Controller::Base->new->redirect_to('controller.pl?action=LoginScreen/user_login&error=password');
|
||
|
return 0;
|
||
|
}
|
||
|
|
||
| SL/Form.pm | ||
|---|---|---|
|
$cgi_params{'-charset'} = $params{charset} if ($params{charset});
|
||
|
$cgi_params{'-cookie'} = $session_cookie if ($session_cookie);
|
||
|
|
||
|
map { $cgi_params{'-' . $_} = $params{$_} if exists $params{$_} } qw(content_disposition content_length);
|
||
|
map { $cgi_params{'-' . $_} = $params{$_} if exists $params{$_} } qw(content_disposition content_length status);
|
||
|
|
||
|
my $output = $cgi->header(%cgi_params);
|
||
|
|
||
Auch abrufbar als: Unified diff
Auth: fehlerhafte JSON-Requests mit JSON und richtigem HTTP-Response-Code beantworten