From 31ea2e713976b91f4f492f72f71d1d8502e446be Mon Sep 17 00:00:00 2001 From: Jens Langhammer Date: Tue, 31 Dec 2019 11:40:03 +0100 Subject: [PATCH] audit: fix internal server error from passing models --- passbook/providers/oauth/views/oauth2.py | 4 ++-- passbook/providers/oidc/lib.py | 3 ++- passbook/providers/saml/views.py | 4 ++-- passbook/sources/oauth/views/core.py | 2 +- 4 files changed, 7 insertions(+), 6 deletions(-) diff --git a/passbook/providers/oauth/views/oauth2.py b/passbook/providers/oauth/views/oauth2.py index b976eb4ea..13ffd5ae5 100644 --- a/passbook/providers/oauth/views/oauth2.py +++ b/passbook/providers/oauth/views/oauth2.py @@ -24,7 +24,7 @@ class PassbookAuthorizationLoadingView(LoginRequiredMixin, LoadingView): def get_url(self): querystring = urlencode(self.request.GET) - return reverse('passbook_providers_oauth:oauth2-ok-authorize')+'?'+querystring + return reverse('passbook_providers_oauth:oauth2-ok-authorize') + '?' + querystring class OAuthPermissionDenied(PermissionDeniedView): @@ -78,7 +78,7 @@ class PassbookAuthorizationView(AccessMixin, AuthorizationView): def form_valid(self, form): # User has clicked on "Authorize" Event.new(EventAction.AUTHORIZE_APPLICATION, - authorized_application=self._application).from_http(self.request) + authorized_application=self._application.pk).from_http(self.request) LOGGER.debug('User authorized Application', user=self.request.user, application=self._application) return super().form_valid(form) diff --git a/passbook/providers/oidc/lib.py b/passbook/providers/oidc/lib.py index 4797e8c2e..d84fe7187 100644 --- a/passbook/providers/oidc/lib.py +++ b/passbook/providers/oidc/lib.py @@ -9,6 +9,7 @@ from passbook.policies.engine import PolicyEngine LOGGER = get_logger() + def check_permissions(request, user, client): """Check permissions, used for https://django-oidc-provider.readthedocs.io/en/latest/ @@ -29,6 +30,6 @@ def check_permissions(request, user, client): return redirect('passbook_providers_oauth:oauth2-permission-denied') Event.new(EventAction.AUTHORIZE_APPLICATION, - authorized_application=application, + authorized_application=application.pk, skipped_authorization=False).from_http(request) return None diff --git a/passbook/providers/saml/views.py b/passbook/providers/saml/views.py index 09cfbbd18..cc8bc1929 100644 --- a/passbook/providers/saml/views.py +++ b/passbook/providers/saml/views.py @@ -124,7 +124,7 @@ class LoginProcessView(AccessRequiredView): ctx = self.provider.processor.generate_response() # Log Application Authorization Event.new(EventAction.AUTHORIZE_APPLICATION, - authorized_application=self.provider.application, + authorized_application=self.provider.application.pk, skipped_authorization=True).from_http(request) return RedirectToSPView.as_view()( request=request, @@ -144,7 +144,7 @@ class LoginProcessView(AccessRequiredView): if request.POST.get('ACSUrl', None): # User accepted request Event.new(EventAction.AUTHORIZE_APPLICATION, - authorized_application=self.provider.application, + authorized_application=self.provider.application.pk, skipped_authorization=False).from_http(request) return RedirectToSPView.as_view()( request=request, diff --git a/passbook/sources/oauth/views/core.py b/passbook/sources/oauth/views/core.py index 12a575c81..4e128ea49 100644 --- a/passbook/sources/oauth/views/core.py +++ b/passbook/sources/oauth/views/core.py @@ -181,7 +181,7 @@ class OAuthCallback(OAuthClientMixin, View): access.save() UserOAuthSourceConnection.objects.filter(pk=access.pk).update(user=user) Event.new(EventAction.CUSTOM, message="Linked OAuth Source", - source=source).from_http(self.request) + source=source.pk).from_http(self.request) if was_authenticated: messages.success(self.request, _("Successfully linked %(source)s!" % { 'source': self.source.name