On Tuesday 06 February 2007 02:06, Chris Shenton wrote: > > "Shannon -jj Behrens" <[EMAIL PROTECTED]> writes: > > > I think you're on the right path. It sounds like you're having a hard > > time figuring out what you should do than figuring out how to do it. > > If I had to implement different access controls based on different > > URLs, I'd probably just do it in base.py :-/ My biggest question is > > how do you know if someone is "internal"? > > I tried a bit but couldn't get "sub" paths working and ended up using > AuthKit's form-based auth, and putting auth checks in my private > controllers __init__ method. So internal users (well, our folks) get > a login screen and a menu wrapping the content via autohandler, and > outside folks see no auth screen and no menu. Seems to work but some > of my colleagues are worried about how secure AuthKit really is.
It will be safe if you'll check client's IP. First of: http://routes.groovie.org/manual.html#conditions client's IP is reachable thru environ['REMOTE_ADDR'] key, so you can add function condition to routes and access to controller clients from inside/outside. m.connect('private', '/private/:controller/:action/:id', conditions = dict(function=check_ip_int)) def check_ip_int(environ, match_dict): if environ['REMOTE_ADDR'] == '127.0.0.1': return True # allow only local ip return False # everyone else will be rejected Other way: add BaseController.__before__ method , where you check ip. Environment is available via environ keyword in params. Then you can add some property to inherited controller or it's method for distinction between 'public'/'internal' part of your app, and check it in __before__ class BaseController(WSGIController): def __before__(self, action, **kwds): remote_addr = kwds['environ']['REMOTE_ADDR'] if self.private: if remote_addr == '127.0.0.1': #very local client - allow him execute action return else: return redirect_to('/somewhere/else') ... class SomeController(BaseController): def __init__(self): BaseController.__init__(self): self.private = True You can mix both ways. Best regards, Cezary Statkiewicz -- Cezary Statkiewicz - http://thelirium.net rlu#280280 gg#5223219 jabber://[EMAIL PROTECTED] --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "pylons-discuss" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/pylons-discuss?hl=en -~----------~----~----~----~------~----~------~--~---
