build slaves now require WIKI_VIEW permissions

[wbell]

One of the side-effects of the token changes on the slave is that slaves now require WIKI_VIEW permissions to access /login. We should either remove this requirement or update the documentation to reflect this.

[rblank]

You could use the ?referer= query argument with the /login URL to redirect to another page than Wiki Start, like so:

http://trac.example.com/login?referer=http://trac.example.com/builds

Note that the URL specified in the referer= argument must be absolute and point to the same Trac instance as the login page. Relative URLs would actually be a good idea, too, so we should probably fix this in Trac.

[osimons]

Heh. I was going to suggest that - and also explain why it won't work as a GET for /builds will instead return a 405 Method not allowed... If so, we'd need to strap on some other argument or attach something to the session that allowes us to just return an emtpy response and be done. Perhaps we can check the referrer and see it if we are redirected from login? Would need to look at the details to see what the incoming request actually contains.

I'd still prefer that Trac supported a no-nonsense HEAD request to /login that did not redirect (​trac:ticket:8598) but I suppose that is not realistic at this stage.

[osimons]

Need to tweak this before 0.6 final.

[rblank]

Replying to osimons:

Heh. I was going to suggest that - and also explain why it won't work as a GET for /builds will instead return a 405 Method not allowed...

How about allowing GET for /builds and returning an empty document?

[osimons]

Doing login with explicit redirect.

[osimons]

Replying to rblank:

How about allowing GET for /builds and returning an empty document?

Yeah. I'm fresh out of other and better options, so attachment:459-login_redirect-r780.diff​ implements this suggestion. Works well for regular authentication.

It needs testing with form authentication - not sure how that works or how it handles redirects, as I've never looked at acct_mgr.

[rblank]

You should probably URL-escape the referer= argument.

[osimons]

Replying to rblank:

You should probably URL-escape the referer= argument.

Yup. Good call. Changed patch like this:

bitten/slave.py

@@ -192 +192 @@
             try:
                 try:
                     if self.username and not self.auth_map.get(url):
-                        login_url = '%s/login?referer=%s' % (url[:-7], url)
+                        login_url = '%s/login?referer=%s' % (url[:-7],
+                                                        urllib.quote_plus(url))
                         # First request to url, authentication needed
                         if self.form_auth:
                             log.debug('Performing http form authentication')

Testing with acct_mgr remains.

[osimons]

Committed in [793]. Acct_mgr is still untested by me, so if anyone spots issues with this then please reopen ticket.