views: implement CSRF protection

[patchwork] / apps / patchwork / views / xmlrpc.py

diff --git a/apps/patchwork/views/xmlrpc.py b/apps/patchwork/views/xmlrpc.py
index 791c89ef7ce534d2ed68e86cf4566c4102964a7d..0d3321fc259d5e431cfc643d7fbd48d850ecf890 100644 (file)
--- a/apps/patchwork/views/xmlrpc.py
+++ b/apps/patchwork/views/xmlrpc.py
@@ -29,6 +29,7 @@ from django.core import urlresolvers
 from django.shortcuts import render_to_response
 from django.contrib.auth import authenticate
 from patchwork.models import Patch, Project, Person, Bundle, State
+from django.views.decorators.csrf import csrf_exempt
 
 import sys
 import base64
@@ -120,6 +121,7 @@ class PatchworkXMLRPCDispatcher(SimpleXMLRPCDispatcher):
 dispatcher = PatchworkXMLRPCDispatcher()
 
 # XMLRPC view function
+@csrf_exempt
 def xmlrpc(request):
     if request.method != 'POST':
         return HttpResponseRedirect(
@@ -173,7 +175,7 @@ def person_to_dict(obj):
          'id'           : obj.id,
          'email'        : obj.email,
          'name'         : obj.name,
-         'user'         : str(obj.user),
+         'user'         : unicode(obj.user).encode("utf-8"),
         }
 
 def patch_to_dict(obj):
@@ -182,17 +184,17 @@ def patch_to_dict(obj):
     return \
         {
          'id'           : obj.id,
-         'date'         : str(obj.date),
+         'date'         : unicode(obj.date).encode("utf-8"),
          'filename'     : obj.filename(),
          'msgid'        : obj.msgid,
          'name'         : obj.name,
-         'project'      : str(obj.project),
+         'project'      : unicode(obj.project).encode("utf-8"),
          'project_id'   : obj.project_id,
-         'state'        : str(obj.state),
+         'state'        : unicode(obj.state).encode("utf-8"),
          'state_id'     : obj.state_id,
-         'submitter'    : str(obj.submitter),
+         'submitter'    : unicode(obj.submitter).encode("utf-8"),
          'submitter_id' : obj.submitter_id,
-         'delegate'     : str(obj.delegate),
+         'delegate'     : unicode(obj.delegate).encode("utf-8"),
          'delegate_id'  : max(obj.delegate_id, 0),
          'commit_ref'   : max(obj.commit_ref, ''),
         }
@@ -296,7 +298,6 @@ def patch_list(filter={}):
             "commit_ref",
             "hash",
             "msgid",
-            "name",
             "max_count",
             ]
 
@@ -355,6 +356,16 @@ def patch_get_by_hash(hash):
     except:
         return {}
 
+@xmlrpc_method(False)
+def patch_get_by_project_hash(project, hash):
+    """Return structure for the given patch hash."""
+    try:
+        patch = Patch.objects.filter(project__linkname = project,
+                                     hash = hash)[0]
+        return patch_to_dict(patch)
+    except:
+        return {}
+
 @xmlrpc_method(False)
 def patch_get_mbox(patch_id):
     """Return mbox string for the given patch ID."""