From 610420bd2ab976ea9e35e6d010e3f1c9f572c646 Mon Sep 17 00:00:00 2001 From: Petr Vobornik Date: Wed, 29 Feb 2012 15:25:40 +0100 Subject: Fixed content type check in login_password login_password is expecting that request content_type will be 'application/x-www-form-urlencoded'. Current check is an equality check of content_type http header. RFC 3875 defines that content type can contain parameters separated by ';'. For example: when firefox is doing ajax call it sets the request header to 'application/x-www-form-urlencoded; charset=UTF-8' which leads to negative result. This patch makes the check more benevolent to allow such values. Patch is a fixup for: https://fedorahosted.org/freeipa/ticket/2095 --- ipaserver/rpcserver.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ipaserver/rpcserver.py') diff --git a/ipaserver/rpcserver.py b/ipaserver/rpcserver.py index c383f048..3ada8b48 100644 --- a/ipaserver/rpcserver.py +++ b/ipaserver/rpcserver.py @@ -894,7 +894,7 @@ class login_password(Backend, KerberosSession, HTTP_Status): # Get the user and password parameters from the request content_type = environ.get('CONTENT_TYPE', '').lower() - if content_type != 'application/x-www-form-urlencoded': + if not content_type.startswith('application/x-www-form-urlencoded'): return self.bad_request(environ, start_response, "Content-Type must be application/x-www-form-urlencoded") method = environ.get('REQUEST_METHOD', '').upper() -- cgit