Package: python-django
Version: 1.3.1-4
Severity: normal
Hello,
thank you for maintaining Django. This was reproduced on
1.2.3-3+squeeze2 but the RemoteUserMiddleware code seems to be the same
as the 1.3.1-4 in my development machine.
RemoteUserMiddleware relies on a REMOTE_USER variable to be set by the
web server with the current user name, so far so good. However it does
not log a person out if the variable disappears during the same browser
session.
That may never happen with the usual browsers and auth, but it does
happen for other setups like DACS that have a logout feature button.
The error is in this bit of django.contrib.auth.middleware.RemoteUserMiddleware:
try:
username = request.META[self.header]
except KeyError:
# If specified header doesn't exist then return (leaving
# request.user set to AnonymousUser by the
# AuthenticationMiddleware).
return
The except side assumes that if there is no request.META[self.header],
then the user is the anonymous one.
Since I found that it is not always the case, I fixed it adding a simple
"auth.logout(request)" before returning:
try:
username = request.META[self.header]
except KeyError:
# If specified header doesn't exist then return (leaving
# request.user set to AnonymousUser by the
# AuthenticationMiddleware).
# Make sure that if the server did not send any headers,
# then we are actually logged out
auth.logout(request)
return
That one line change made nm.debian.org logout properly under DACS.
Ciao,
Enrico
-- System Information:
Debian Release: wheezy/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Kernel: Linux 3.1.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages python-django depends on:
ii python 2.7.2-10
ii python2.6 2.6.7-4
ii python2.7 2.7.2-8
Versions of packages python-django recommends:
ii libjs-jquery 1.7.1-1
Versions of packages python-django suggests:
ii geoip-database-contrib <none>
ii python-flup <none>
ii python-mysqldb 1.2.3-1
ii python-psycopg <none>
ii python-psycopg2 2.4.4-3
ii python-sqlite 1.0.1-9
ii python-yaml 3.10-2
-- no debconf information
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
