jro_apps/redmine Commit - r3134:718cd596e061

Merged r3246 and r3247 from trunk....

Jean-Philippe Lang -

r3134:718cd596e061

parent child

Context file:

r3134:718cd596e061

Collapse all files

app/models/mail_handler.rb 0 -1

             # redMine - project management software
             # Copyright (C) 2006-2007  Jean-Philippe Lang
             #
             # This program is free software; you can redistribute it and/or
             # modify it under the terms of the GNU General Public License
             # as published by the Free Software Foundation; either version 2
             # of the License, or (at your option) any later version.
             #
             # This program is distributed in the hope that it will be useful,
             # but WITHOUT ANY WARRANTY; without even the implied warranty of
             # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
             # GNU General Public License for more details.
             #
             # You should have received a copy of the GNU General Public License
             # along with this program; if not, write to the Free Software
             # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
             class MailHandler < ActionMailer::Base
               include ActionView::Helpers::SanitizeHelper
               class UnauthorizedAction < StandardError; end
               class MissingInformation < StandardError; end
               attr_reader :email, :user
               def self.receive(email, options={})
                 @@handler_options = options.dup
                 @@handler_options[:issue] ||= {}
                 @@handler_options[:allow_override] = @@handler_options[:allow_override].split(',').collect(&:strip) if @@handler_options[:allow_override].is_a?(String)
                 @@handler_options[:allow_override] ||= []
                 # Project needs to be overridable if not specified
                 @@handler_options[:allow_override] << 'project' unless @@handler_options[:issue].has_key?(:project)
                 # Status overridable by default
                 @@handler_options[:allow_override] << 'status' unless @@handler_options[:issue].has_key?(:status)
                 @@handler_options[:no_permission_check] = (@@handler_options[:no_permission_check].to_s == '1' ? true : false)
                 super email
               end
               # Processes incoming emails
               # Returns the created object (eg. an issue, a message) or false
               def receive(email)
                 @email = email
                 sender_email = email.from.to_a.first.to_s.strip
                 # Ignore emails received from the application emission address to avoid hell cycles
                 if sender_email.downcase == Setting.mail_from.to_s.strip.downcase
                   logger.info  "MailHandler: ignoring email from Redmine emission address [#{sender_email}]" if logger && logger.info
                   return false
                 end
                 @user = User.find_by_mail(sender_email)
                 if @user && !@user.active?
                   logger.info  "MailHandler: ignoring email from non-active user [#{@user.login}]" if logger && logger.info
                   return false
                 end
                 if @user.nil?
                   # Email was submitted by an unknown user
                   case @@handler_options[:unknown_user]
                   when 'accept'
                     @user = User.anonymous
                   when 'create'
                     @user = MailHandler.create_user_from_email(email)
                     if @user
                       logger.info "MailHandler: [#{@user.login}] account created" if logger && logger.info
                       Mailer.deliver_account_information(@user, @user.password)
                     else
                       logger.error "MailHandler: could not create account for [#{sender_email}]" if logger && logger.error
                       return false
                     end
                   else
                     # Default behaviour, emails from unknown users are ignored
                     logger.info  "MailHandler: ignoring email from unknown user [#{sender_email}]" if logger && logger.info
                     return false
                   end
                 end
                 User.current = @user
                 dispatch
               end
               private
               MESSAGE_ID_RE = %r{^<redmine\.([a-z0-9_]+)\-(\d+)\.\d+@}
               ISSUE_REPLY_SUBJECT_RE = %r{\[[^\]]*#(\d+)\]}
               MESSAGE_REPLY_SUBJECT_RE = %r{\[[^\]]*msg(\d+)\]}
               def dispatch
                 headers = [email.in_reply_to, email.references].flatten.compact
                 if headers.detect {|h| h.to_s =~ MESSAGE_ID_RE}
                   klass, object_id = $1, $2.to_i
                   method_name = "receive_#{klass}_reply"
                   if self.class.private_instance_methods.collect(&:to_s).include?(method_name)
                     send method_name, object_id
                   else
                     # ignoring it
                   end
                 elsif m = email.subject.match(ISSUE_REPLY_SUBJECT_RE)
                   receive_issue_reply(m[1].to_i)
                 elsif m = email.subject.match(MESSAGE_REPLY_SUBJECT_RE)
                   receive_message_reply(m[1].to_i)
                 else
                   receive_issue
                 end
               rescue ActiveRecord::RecordInvalid => e
                 # TODO: send a email to the user
                 logger.error e.message if logger
                 false
               rescue MissingInformation => e
                 logger.error "MailHandler: missing information from #{user}: #{e.message}" if logger
                 false
               rescue UnauthorizedAction => e
                 logger.error "MailHandler: unauthorized attempt from #{user}" if logger
                 false
               end
               # Creates a new issue
               def receive_issue
                 project = target_project
                 tracker = (get_keyword(:tracker) && project.trackers.find_by_name(get_keyword(:tracker))) || project.trackers.find(:first)
                 category = (get_keyword(:category) && project.issue_categories.find_by_name(get_keyword(:category)))
                 priority = (get_keyword(:priority) && IssuePriority.find_by_name(get_keyword(:priority)))
                 status =  (get_keyword(:status) && IssueStatus.find_by_name(get_keyword(:status)))
                 # check permission
                 unless @@handler_options[:no_permission_check]
                   raise UnauthorizedAction unless user.allowed_to?(:add_issues, project)
                 end
                 issue = Issue.new(:author => user, :project => project, :tracker => tracker, :category => category, :priority => priority)
                 # check workflow
                 if status && issue.new_statuses_allowed_to(user).include?(status)
                   issue.status = status
                 end
                 issue.subject = email.subject.chomp
-                issue.subject = issue.subject.toutf8 if issue.subject.respond_to?(:toutf8)
                 if issue.subject.blank?
                   issue.subject = '(no subject)'
                 end
                 # custom fields
                 issue.custom_field_values = issue.available_custom_fields.inject({}) do |h, c|
                   if value = get_keyword(c.name, :override => true)
                     h[c.id] = value
                   end
                   h
                 end
                 issue.description = cleaned_up_text_body
                 # add To and Cc as watchers before saving so the watchers can reply to Redmine
                 add_watchers(issue)
                 issue.save!
                 add_attachments(issue)
                 logger.info "MailHandler: issue ##{issue.id} created by #{user}" if logger && logger.info
                 issue
               end
               def target_project
                 # TODO: other ways to specify project:
                 # * parse the email To field
                 # * specific project (eg. Setting.mail_handler_target_project)
                 target = Project.find_by_identifier(get_keyword(:project))
                 raise MissingInformation.new('Unable to determine target project') if target.nil?
                 target
               end
               # Adds a note to an existing issue
               def receive_issue_reply(issue_id)
                 status =  (get_keyword(:status) && IssueStatus.find_by_name(get_keyword(:status)))
                 issue = Issue.find_by_id(issue_id)
                 return unless issue
                 # check permission
                 unless @@handler_options[:no_permission_check]
                   raise UnauthorizedAction unless user.allowed_to?(:add_issue_notes, issue.project) || user.allowed_to?(:edit_issues, issue.project)
                   raise UnauthorizedAction unless status.nil? || user.allowed_to?(:edit_issues, issue.project)
                 end
                 # add the note
                 journal = issue.init_journal(user, cleaned_up_text_body)
                 add_attachments(issue)
                 # check workflow
                 if status && issue.new_statuses_allowed_to(user).include?(status)
                   issue.status = status
                 end
                 issue.save!
                 logger.info "MailHandler: issue ##{issue.id} updated by #{user}" if logger && logger.info
                 journal
               end
               # Reply will be added to the issue
               def receive_journal_reply(journal_id)
                 journal = Journal.find_by_id(journal_id)
                 if journal && journal.journalized_type == 'Issue'
                   receive_issue_reply(journal.journalized_id)
                 end
               end
               # Receives a reply to a forum message
               def receive_message_reply(message_id)
                 message = Message.find_by_id(message_id)
                 if message
                   message = message.root
                   unless @@handler_options[:no_permission_check]
                     raise UnauthorizedAction unless user.allowed_to?(:add_messages, message.project)
                   end
                   if !message.locked?
                     reply = Message.new(:subject => email.subject.gsub(%r{^.*msg\d+\]}, '').strip,
                                         :content => cleaned_up_text_body)
                     reply.author = user
                     reply.board = message.board
                     message.children << reply
                     add_attachments(reply)
                     reply
                   else
                     logger.info "MailHandler: ignoring reply from [#{sender_email}] to a locked topic" if logger && logger.info
                   end
                 end
               end
               def add_attachments(obj)
                 if email.has_attachments?
                   email.attachments.each do |attachment|
                     Attachment.create(:container => obj,
                                       :file => attachment,
                                       :author => user,
                                       :content_type => attachment.content_type)
                   end
                 end
               end
               # Adds To and Cc as watchers of the given object if the sender has the
               # appropriate permission
               def add_watchers(obj)
                 if user.allowed_to?("add_#{obj.class.name.underscore}_watchers".to_sym, obj.project)
                   addresses = [email.to, email.cc].flatten.compact.uniq.collect {|a| a.strip.downcase}
                   unless addresses.empty?
                     watchers = User.active.find(:all, :conditions => ['LOWER(mail) IN (?)', addresses])
                     watchers.each {|w| obj.add_watcher(w)}
                   end
                 end
               end
               def get_keyword(attr, options={})
                 @keywords ||= {}
                 if @keywords.has_key?(attr)
                   @keywords[attr]
                 else
                   @keywords[attr] = begin
                     if (options[:override] || @@handler_options[:allow_override].include?(attr.to_s)) && plain_text_body.gsub!(/^#{attr}[ \t]*:[ \t]*(.+)\s*$/i, '')
                       $1.strip
                     elsif !@@handler_options[:issue][attr].blank?
                       @@handler_options[:issue][attr]
                     end
                   end
                 end
               end
               # Returns the text/plain part of the email
               # If not found (eg. HTML-only email), returns the body with tags removed
               def plain_text_body
                 return @plain_text_body unless @plain_text_body.nil?
                 parts = @email.parts.collect {|c| (c.respond_to?(:parts) && !c.parts.empty?) ? c.parts : c}.flatten
                 if parts.empty?
                   parts << @email
                 end
                 plain_text_part = parts.detect {|p| p.content_type == 'text/plain'}
                 if plain_text_part.nil?
                   # no text/plain part found, assuming html-only email
                   # strip html tags and remove doctype directive
                   @plain_text_body = strip_tags(@email.body.to_s)
                   @plain_text_body.gsub! %r{^<!DOCTYPE .*$}, ''
                 else
                   @plain_text_body = plain_text_part.body.to_s
                 end
                 @plain_text_body.strip!
                 @plain_text_body
               end
               def cleaned_up_text_body
                 cleanup_body(plain_text_body)
               end
               def self.full_sanitizer
                 @full_sanitizer ||= HTML::FullSanitizer.new
               end
               # Creates a user account for the +email+ sender
               def self.create_user_from_email(email)
                 addr = email.from_addrs.to_a.first
                 if addr && !addr.spec.blank?
                   user = User.new
                   user.mail = addr.spec
                   names = addr.name.blank? ? addr.spec.gsub(/@.*$/, '').split('.') : addr.name.split
                   user.firstname = names.shift
                   user.lastname = names.join(' ')
                   user.lastname = '-' if user.lastname.blank?
                   user.login = user.mail
                   user.password = ActiveSupport::SecureRandom.hex(5)
                   user.language = Setting.default_language
                   user.save ? user : nil
                 end
               end
               private
               # Removes the email body of text after the truncation configurations.
               def cleanup_body(body)
                 delimiters = Setting.mail_handler_body_delimiters.to_s.split(/[\r\n]+/).reject(&:blank?).map {|s| Regexp.escape(s)}
                 unless delimiters.empty?
                   regex = Regexp.new("^(#{ delimiters.join('|') })\s*[\r\n].*", Regexp::MULTILINE)
                   body = body.gsub(regex, '')
                 end
                 body.strip
               end
             end

extra/svn/Redmine.pm +8 -3

             package Apache::Authn::Redmine;
             =head1 Apache::Authn::Redmine
             Redmine - a mod_perl module to authenticate webdav subversion users
             against redmine database
             =head1 SYNOPSIS
             This module allow anonymous users to browse public project and
             registred users to browse and commit their project. Authentication is
             done against the redmine database or the LDAP configured in redmine.
             This method is far simpler than the one with pam_* and works with all
             database without an hassle but you need to have apache/mod_perl on the
             svn server.
             =head1 INSTALLATION
             For this to automagically work, you need to have a recent reposman.rb
             (after r860) and if you already use reposman, read the last section to
             migrate.
             Sorry ruby users but you need some perl modules, at least mod_perl2,
             DBI and DBD::mysql (or the DBD driver for you database as it should
             work on allmost all databases).
             On debian/ubuntu you must do :
               aptitude install libapache-dbi-perl libapache2-mod-perl2 libdbd-mysql-perl
             If your Redmine users use LDAP authentication, you will also need
             Authen::Simple::LDAP (and IO::Socket::SSL if LDAPS is used):
               aptitude install libauthen-simple-ldap-perl libio-socket-ssl-perl
             =head1 CONFIGURATION
                ## This module has to be in your perl path
                ## eg:  /usr/lib/perl5/Apache/Authn/Redmine.pm
                PerlLoadModule Apache::Authn::Redmine
                <Location /svn>
                  DAV svn
                  SVNParentPath "/var/svn"
                  AuthType Basic
                  AuthName redmine
                  Require valid-user
                  PerlAccessHandler Apache::Authn::Redmine::access_handler
                  PerlAuthenHandler Apache::Authn::Redmine::authen_handler
                  ## for mysql
                  RedmineDSN "DBI:mysql:database=databasename;host=my.db.server"
                  ## for postgres
                  # RedmineDSN "DBI:Pg:dbname=databasename;host=my.db.server"
                  RedmineDbUser "redmine"
                  RedmineDbPass "password"
                  ## Optional where clause (fulltext search would be slow and
                  ## database dependant).
                  # RedmineDbWhereClause "and members.role_id IN (1,2)"
                  ## Optional credentials cache size
                  # RedmineCacheCredsMax 50
               </Location>
             To be able to browse repository inside redmine, you must add something
             like that :
                <Location /svn-private>
                  DAV svn
                  SVNParentPath "/var/svn"
                  Order deny,allow
                  Deny from all
                  # only allow reading orders
                  <Limit GET PROPFIND OPTIONS REPORT>
                    Allow from redmine.server.ip
                  </Limit>
                </Location>
             and you will have to use this reposman.rb command line to create repository :
               reposman.rb --redmine my.redmine.server --svn-dir /var/svn --owner www-data -u http://svn.server/svn-private/
             =head1 MIGRATION FROM OLDER RELEASES
             If you use an older reposman.rb (r860 or before), you need to change
             rights on repositories to allow the apache user to read and write
             S<them :>
               sudo chown -R www-data /var/svn/*
               sudo chmod -R u+w /var/svn/*
             And you need to upgrade at least reposman.rb (after r860).
             =cut
             use strict;
             use warnings FATAL => 'all', NONFATAL => 'redefine';
             use DBI;
             use Digest::SHA1;
             # optional module for LDAP authentication
             my $CanUseLDAPAuth = eval("use Authen::Simple::LDAP; 1");
             use Apache2::Module;
             use Apache2::Access;
             use Apache2::ServerRec qw();
             use Apache2::RequestRec qw();
             use Apache2::RequestUtil qw();
             use Apache2::Const qw(:common :override :cmd_how);
             use APR::Pool ();
             use APR::Table ();
             # use Apache2::Directive qw();
             my @directives = (
               {
                 name => 'RedmineDSN',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'Dsn in format used by Perl DBI. eg: "DBI:Pg:dbname=databasename;host=my.db.server"',
               },
               {
                 name => 'RedmineDbUser',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbPass',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineDbWhereClause',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
               },
               {
                 name => 'RedmineCacheCredsMax',
                 req_override => OR_AUTHCFG,
                 args_how => TAKE1,
                 errmsg => 'RedmineCacheCredsMax must be decimal number',
               },
             );
             sub RedmineDSN {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineDSN} = $arg;
               my $query = "SELECT
                              hashed_password, auth_source_id, permissions
                           FROM members, projects, users, roles, member_roles
                           WHERE
                             projects.id=members.project_id
                             AND member_roles.member_id=members.id
                             AND users.id=members.user_id
                             AND roles.id=member_roles.role_id
                             AND users.status=1
                             AND login=?
                             AND identifier=? ";
               $self->{RedmineQuery} = trim($query);
             }
             sub RedmineDbUser { set_val('RedmineDbUser', @_); }
             sub RedmineDbPass { set_val('RedmineDbPass', @_); }
             sub RedmineDbWhereClause {
               my ($self, $parms, $arg) = @_;
               $self->{RedmineQuery} = trim($self->{RedmineQuery}.($arg ? $arg : "")." ");
             }
             sub RedmineCacheCredsMax {
               my ($self, $parms, $arg) = @_;
               if ($arg) {
                 $self->{RedmineCachePool} = APR::Pool->new;
                 $self->{RedmineCacheCreds} = APR::Table::make($self->{RedmineCachePool}, $arg);
                 $self->{RedmineCacheCredsCount} = 0;
                 $self->{RedmineCacheCredsMax} = $arg;
               }
             }
             sub trim {
               my $string = shift;
               $string =~ s/\s{2,}/ /g;
               return $string;
             }
             sub set_val {
               my ($key, $self, $parms, $arg) = @_;
               $self->{$key} = $arg;
             }
             Apache2::Module::add(__PACKAGE__, \@directives);
             my %read_only_methods = map { $_ => 1 } qw/GET PROPFIND REPORT OPTIONS/;
             sub access_handler {
               my $r = shift;
               unless ($r->some_auth_required) {
                   $r->log_reason("No authentication has been configured");
                   return FORBIDDEN;
               }
               my $method = $r->method;
               return OK unless defined $read_only_methods{$method};
               my $project_id = get_project_identifier($r);
               $r->set_handlers(PerlAuthenHandler => [\&OK])
                   if is_public_project($project_id, $r);
               return OK
             }
             sub authen_handler {
               my $r = shift;
               my ($res, $redmine_pass) =  $r->get_basic_auth_pw();
               return $res unless $res == OK;
               if (is_member($r->user, $redmine_pass, $r)) {
                   return OK;
               } else {
                   $r->note_auth_failure();
                   return AUTH_REQUIRED;
               }
             }
             sub is_public_project {
                 my $project_id = shift;
                 my $r = shift;
                 my $dbh = connect_database($r);
                 my $sth = $dbh->prepare(
-                    "SELECT * FROM projects WHERE projects.identifier=? and projects.is_public=true;"
+                    "SELECT is_public FROM projects WHERE projects.identifier = ?;"
                 );
                 $sth->execute($project_id);
-                my $ret = $sth->fetchrow_array ? 1 : 0;
+                my $ret = 0;
+                if (my @row = $sth->fetchrow_array) {
+                	if ($row[0] eq "1" || $row[0] eq "t") {
+                		$ret = 1;
+                	}
+                }
                 $sth->finish();
                 $dbh->disconnect();
                 $ret;
             }
             # perhaps we should use repository right (other read right) to check public access.
             # it could be faster BUT it doesn't work for the moment.
             # sub is_public_project_by_file {
             #     my $project_id = shift;
             #     my $r = shift;
             #     my $tree = Apache2::Directive::conftree();
             #     my $node = $tree->lookup('Location', $r->location);
             #     my $hash = $node->as_hash;
             #     my $svnparentpath = $hash->{SVNParentPath};
             #     my $repos_path = $svnparentpath . "/" . $project_id;
             #     return 1 if (stat($repos_path))[2] & 00007;
             # }
             sub is_member {
               my $redmine_user = shift;
               my $redmine_pass = shift;
               my $r = shift;
               my $dbh         = connect_database($r);
               my $project_id  = get_project_identifier($r);
               my $pass_digest = Digest::SHA1::sha1_hex($redmine_pass);
               my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
               my $usrprojpass;
               if ($cfg->{RedmineCacheCredsMax}) {
                 $usrprojpass = $cfg->{RedmineCacheCreds}->get($redmine_user.":".$project_id);
                 return 1 if (defined $usrprojpass and ($usrprojpass eq $pass_digest));
               }
               my $query = $cfg->{RedmineQuery};
               my $sth = $dbh->prepare($query);
               $sth->execute($redmine_user, $project_id);
               my $ret;
               while (my ($hashed_password, $auth_source_id, $permissions) = $sth->fetchrow_array) {
                   unless ($auth_source_id) {
             	  my $method = $r->method;
                       if ($hashed_password eq $pass_digest && ((defined $read_only_methods{$method} && $permissions =~ /:browse_repository/) || $permissions =~ /:commit_access/) ) {
                           $ret = 1;
                           last;
                       }
                   } elsif ($CanUseLDAPAuth) {
                       my $sthldap = $dbh->prepare(
                           "SELECT host,port,tls,account,account_password,base_dn,attr_login from auth_sources WHERE id = ?;"
                       );
                       $sthldap->execute($auth_source_id);
                       while (my @rowldap = $sthldap->fetchrow_array) {
                         my $ldap = Authen::Simple::LDAP->new(
-                            host    =>      ($rowldap[2] == 1 || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]" : $rowldap[0],
+                            host    =>      ($rowldap[2] eq "1" || $rowldap[2] eq "t") ? "ldaps://$rowldap[0]" : $rowldap[0],
                             port    =>      $rowldap[1],
                             basedn  =>      $rowldap[5],
                             binddn  =>      $rowldap[3] ? $rowldap[3] : "",
                             bindpw  =>      $rowldap[4] ? $rowldap[4] : "",
                             filter  =>      "(".$rowldap[6]."=%s)"
                         );
                         $ret = 1 if ($ldap->authenticate($redmine_user, $redmine_pass));
                       }
                       $sthldap->finish();
                   }
               }
               $sth->finish();
               $dbh->disconnect();
               if ($cfg->{RedmineCacheCredsMax} and $ret) {
                 if (defined $usrprojpass) {
                   $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                 } else {
                   if ($cfg->{RedmineCacheCredsCount} < $cfg->{RedmineCacheCredsMax}) {
                     $cfg->{RedmineCacheCreds}->set($redmine_user.":".$project_id, $pass_digest);
                     $cfg->{RedmineCacheCredsCount}++;
                   } else {
                     $cfg->{RedmineCacheCreds}->clear();
                     $cfg->{RedmineCacheCredsCount} = 0;
                   }
                 }
               }
               $ret;
             }
             sub get_project_identifier {
                 my $r = shift;
                 my $location = $r->location;
                 my ($identifier) = $r->uri =~ m{$location/*([^/]+)};
                 $identifier;
             }
             sub connect_database {
                 my $r = shift;
                 my $cfg = Apache2::Module::get_config(__PACKAGE__, $r->server, $r->per_dir_config);
                 return DBI->connect($cfg->{RedmineDSN}, $cfg->{RedmineDbUser}, $cfg->{RedmineDbPass});
             }
 ;

General Comments 0

Write
Preview

You need to be logged in to leave comments. Login now

No TODOs yet

	Site-wide shortcuts
/	Use quick search box
g h	Goto home page
g g	Goto my private gists page
g G	Goto my public gists page
g 0-9	Goto bookmarked items from 0-9
n r	New repository page
n g	New gist page

	Repositories
g s	Goto summary page
g c	Goto changelog page
g f	Goto files page
g F	Goto files page with file search activated
g p	Goto pull requests page
g o	Goto repository settings
g O	Goto repository access permissions settings
t s	Toggle sidebar on some pages