mirror of
https://github.com/gentoo-mirror/gentoo.git
synced 2026-07-31 10:58:21 -07:00
dev-python/ipython: Drop vulnerable version
Gentoo-Bug: https://bugs.gentoo.org/show_bug.cgi?id=560708 Package-Manager: portage-2.2.21 Signed-off-by: Justin Lecher <jlec@gentoo.org>
This commit is contained in:
@@ -1,35 +0,0 @@
|
||||
From 5d6ce3671318c8d32bab770ece841590bbec358d Mon Sep 17 00:00:00 2001
|
||||
From: Matthias Bussonnier <bussonniermatthias@gmail.com>
|
||||
Date: Fri, 17 Apr 2015 13:08:32 -0700
|
||||
Subject: [PATCH] Set secure cookie by default if login handler is hit.
|
||||
|
||||
backport of https://github.com/jupyter/jupyter_notebook/pull/22 b8e99bc
|
||||
|
||||
> There is few chances that logged-in people do not use https connexion,
|
||||
> but I guess it can happened if the server is ran in front of a proxy
|
||||
> that does the https termination, so leave it configurable.
|
||||
>
|
||||
> closes ipython/ipython#8325
|
||||
---
|
||||
IPython/html/auth/login.py | 8 +++++++-
|
||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/IPython/html/auth/login.py b/IPython/html/auth/login.py
|
||||
index 1ad4673..1a340c8 100644
|
||||
--- a/IPython/html/auth/login.py
|
||||
+++ b/IPython/html/auth/login.py
|
||||
@@ -46,7 +46,13 @@ class LoginHandler(IPythonHandler):
|
||||
pwd = self.get_argument('password', default=u'')
|
||||
if self.login_available:
|
||||
if passwd_check(self.password, pwd):
|
||||
- self.set_secure_cookie(self.cookie_name, str(uuid.uuid4()))
|
||||
+ # tornado <4.2 have a bug that consider secure==True as soon as
|
||||
+ # 'secure' kwarg is passed to set_secure_cookie
|
||||
+ if self.settings.get('secure_cookie', self.request.protocol == 'https'):
|
||||
+ kwargs = {'secure':True}
|
||||
+ else:
|
||||
+ kwargs = {}
|
||||
+ self.set_secure_cookie(self.cookie_name, str(uuid.uuid4()), **kwargs)
|
||||
else:
|
||||
self._render(message={'error': 'Invalid password'})
|
||||
return
|
||||
Reference in New Issue
Block a user