trustchain-oc1-orchestral/authentik
Archived
10
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

events: unpack wrapped query from FlowExecutor (#5244)

Browse source 
Signed-off-by: Jens Langhammer <jens@goauthentik.io>
This commit is contained in:
Jens L 2023-04-14 00:07:41 +02:00 committed by GitHub
parent 71820191a3
commit a5098364eb
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
authentik/events/models.py
View file

@ -214,11 +214,18 @@ class Event(SerializerModel, ExpiringModel):
Events independently from requests. Events independently from requests.
`user` arguments optionally overrides user from requests.""" `user` arguments optionally overrides user from requests."""
if request: if request:
from authentik.flows.views.executor import QS_QUERY
self.context["http_request"] = { self.context["http_request"] = {
"path": request.path, "path": request.path,
"method": request.method, "method": request.method,
"args": QueryDict(request.META.get("QUERY_STRING", "")), "args": QueryDict(request.META.get("QUERY_STRING", "")),
} }
# Special case for events created during flow execution
# since they keep the http query within a wrapped query
if QS_QUERY in self.context["http_request"]["args"]:
wrapped = self.context["http_request"]["args"][QS_QUERY]
self.context["http_request"]["args"] = QueryDict(wrapped)
if hasattr(request, "tenant"): if hasattr(request, "tenant"):
tenant: Tenant = request.tenant tenant: Tenant = request.tenant
# Because self.created only gets set on save, we can't use it's value here # Because self.created only gets set on save, we can't use it's value here

3
authentik/flows/views/executor.py
View file

@ -69,6 +69,7 @@ SESSION_KEY_GET = "authentik/flows/get"
SESSION_KEY_POST = "authentik/flows/post" SESSION_KEY_POST = "authentik/flows/post"
SESSION_KEY_HISTORY = "authentik/flows/history" SESSION_KEY_HISTORY = "authentik/flows/history"
QS_KEY_TOKEN = "flow_token" # nosec QS_KEY_TOKEN = "flow_token" # nosec
QS_QUERY = "query"
def challenge_types(): def challenge_types():
@ -173,7 +174,7 @@ class FlowExecutorView(APIView):
op="authentik.flow.executor.dispatch", description=self.flow.slug op="authentik.flow.executor.dispatch", description=self.flow.slug
) as span: ) as span:
span.set_data("authentik Flow", self.flow.slug) span.set_data("authentik Flow", self.flow.slug)
get_params = QueryDict(request.GET.get("query", "")) get_params = QueryDict(request.GET.get(QS_QUERY, ""))
if QS_KEY_TOKEN in get_params: if QS_KEY_TOKEN in get_params:
plan = self._check_flow_token(get_params[QS_KEY_TOKEN]) plan = self._check_flow_token(get_params[QS_KEY_TOKEN])
if plan: if plan: