Reworks the cookieless session id from path to parameters

doc/dev_doc/extensions_doc/plugins.rst

@@ -27,7 +27,7 @@ The following code adds a new page displaying ``This is a simple demo plugin`` o
 
     def init(plugin_manager, taskset_factory, client, plugin_config):
         """ Init the plugin """
-        plugin_manager.add_page("/<cookieless:sessionid>plugindemo", DemoPage.as_view('demopage'))
+        plugin_manager.add_page("/plugindemo", DemoPage.as_view('demopage'))
 
 
 The plugin is initialized by the plugin manager, which is the frontend-extended hook manager, by calling method ``init``.

inginious/frontend/app.py

@@ -100,20 +100,24 @@ def _put_configuration_defaults(config):
 
     return config
 
+def get_homepath():
+    """ Returns the URL root. """
+    return flask.request.url_root[:-1]
 
-def get_homepath(ignore_session=False, force_cookieless=False):
+def get_path(*path_parts, force_cookieless=False):
     """
-    :param ignore_session: Ignore the cookieless session_id that should be put in the URL
+    :param path_parts: List of elements in the path to be separated by slashes
     :param force_cookieless: Force the cookieless session; the link will include the session_creator if needed.
     """
     session = flask.session
     request = flask.request
-    if not ignore_session and session.sid is not None and session.cookieless:
-        return request.url_root[:-1] + "/@" + session.sid + "@"
-    elif not ignore_session and force_cookieless:
-        return request.url_root[:-1] + "/@@"
-    else:
-        return request.url_root[:-1]
+    query_delimiter = '&' if path_parts and '?' in path_parts[-1] else '?'
+    path_parts = (get_homepath(), ) + path_parts
+    if session.sid is not None and session.cookieless:
+        return "/".join(path_parts) + f"{query_delimiter}session_id={session.sid}"
+    if force_cookieless:
+        return "/".join(path_parts) + f"{query_delimiter}session_id="
+    return "/".join(path_parts)
 
 
 def _close_app(mongo_client, client):
@@ -188,6 +192,7 @@ def get_app(config):
     if config.get("maintenance", False):
         template_helper = TemplateHelper(PluginManager(), None, config.get('use_minified_js', True))
         template_helper.add_to_template_globals("get_homepath", get_homepath)
+        template_helper.add_to_template_globals("get_path", get_path)
         template_helper.add_to_template_globals("pkg_version", __version__)
         template_helper.add_to_template_globals("available_languages", available_languages)
         template_helper.add_to_template_globals("_", _)
@@ -244,6 +249,7 @@ def get_app(config):
     template_helper.add_to_template_globals("str", str)
     template_helper.add_to_template_globals("available_languages", available_languages)
     template_helper.add_to_template_globals("get_homepath", get_homepath)
+    template_helper.add_to_template_globals("get_path", get_path)
     template_helper.add_to_template_globals("pkg_version", __version__)
     template_helper.add_to_template_globals("allow_registration", config.get("allow_registration", True))
     template_helper.add_to_template_globals("sentry_io_url", config.get("sentry_io_url"))
@@ -283,7 +289,7 @@ def flask_internalerror(e):
     flask_app.register_error_handler(InternalServerError, flask_internalerror)
 
     # Insert the needed singletons into the application, to allow pages to call them
-    flask_app.get_homepath = get_homepath
+    flask_app.get_path = get_path
     flask_app.plugin_manager = plugin_manager
     flask_app.taskset_factory = taskset_factory
     flask_app.course_factory = course_factory

inginious/frontend/flask/mapping.py

@@ -55,118 +55,105 @@
 from inginious.frontend.pages.search_user import SearchUserPage
 
 
-class CookielessConverter(BaseConverter):
-    # Parse the cookieless sessionid at the beginning of the url
-    regex = "@[a-f0-9A-F_]*@/|"
-    part_isolating = False
-
-    def to_python(self, value):
-        return value[1:-2]
-
-    def to_url(self, value):
-        return "@" + str(value) + "@/"
-
-
 def init_flask_maintenance_mapping(flask_app):
     flask_app.add_url_rule('/', view_func=MaintenancePage.as_view('maintenancepage.alias'))
     flask_app.add_url_rule('/<path:path>', view_func=MaintenancePage.as_view('maintenancepage'))
 
 
 def init_flask_mapping(flask_app):
-    flask_app.url_map.converters['cookieless'] = CookielessConverter
-    flask_app.add_url_rule('/<cookieless:sessionid>', view_func=IndexPage.as_view('indexpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>index', view_func=IndexPage.as_view('indexpage.alias'))
-    flask_app.add_url_rule('/<cookieless:sessionid>signin', view_func=SignInPage.as_view('signinpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>logout', view_func=LogOutPage.as_view('logoutpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>register', view_func=RegistrationPage.as_view('registrationpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>queue', view_func=QueuePage.as_view('queuepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>register/<courseid>',
+    flask_app.add_url_rule('/', view_func=IndexPage.as_view('indexpage'))
+    flask_app.add_url_rule('/index', view_func=IndexPage.as_view('indexpage.alias'))
+    flask_app.add_url_rule('/signin', view_func=SignInPage.as_view('signinpage'))
+    flask_app.add_url_rule('/logout', view_func=LogOutPage.as_view('logoutpage'))
+    flask_app.add_url_rule('/register', view_func=RegistrationPage.as_view('registrationpage'))
+    flask_app.add_url_rule('/queue', view_func=QueuePage.as_view('queuepage'))
+    flask_app.add_url_rule('/register/<courseid>',
                            view_func=CourseRegisterPage.as_view('courseregisterpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>marketplace', view_func=MarketplacePage.as_view('marketplacepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>marketplace/<tasksetid>',
+    flask_app.add_url_rule('/marketplace', view_func=MarketplacePage.as_view('marketplacepage'))
+    flask_app.add_url_rule('/marketplace/<tasksetid>',
                            view_func=MarketplaceTasksetPage.as_view('marketplacetasksetpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>course/<courseid>', view_func=CoursePage.as_view('coursepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>course/<courseid>/<taskid>', view_func=TaskPage.as_view('taskpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>course/<courseid>/<taskid>/<path:path>',
+    flask_app.add_url_rule('/course/<courseid>', view_func=CoursePage.as_view('coursepage'))
+    flask_app.add_url_rule('/course/<courseid>/<taskid>', view_func=TaskPage.as_view('taskpage'))
+    flask_app.add_url_rule('/course/<courseid>/<taskid>/<path:path>',
                            view_func=TaskPageStaticDownload.as_view('taskpagestaticdownload'))
-    flask_app.add_url_rule('/<cookieless:sessionid>group/<courseid>', view_func=GroupPage.as_view('grouppage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>user_settings/<courseid>', view_func=CourseUserSettingPage.as_view('courseusersettingpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>auth/signin/<auth_id>',
+    flask_app.add_url_rule('/group/<courseid>', view_func=GroupPage.as_view('grouppage'))
+    flask_app.add_url_rule('/user_settings/<courseid>', view_func=CourseUserSettingPage.as_view('courseusersettingpage'))
+    flask_app.add_url_rule('/auth/signin/<auth_id>',
                            view_func=AuthenticationPage.as_view('authenticationpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>auth/callback/<auth_id>',
+    flask_app.add_url_rule('/auth/callback/<auth_id>',
                            view_func=CallbackPage.as_view('callbackpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>pages/<pageid>', view_func=INGIniousStaticPage.as_view('staticpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>courselist', view_func=CourseListPage.as_view('courselistpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>mycourses', view_func=MyCoursesPage.as_view('mycoursespage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>tasksets', view_func=TasksetsPage.as_view('tasksetspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>preferences', view_func=PrefRedirectPage.as_view('prefredirectpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>preferences/bindings',
+    flask_app.add_url_rule('/pages/<pageid>', view_func=INGIniousStaticPage.as_view('staticpage'))
+    flask_app.add_url_rule('/courselist', view_func=CourseListPage.as_view('courselistpage'))
+    flask_app.add_url_rule('/mycourses', view_func=MyCoursesPage.as_view('mycoursespage'))
+    flask_app.add_url_rule('/tasksets', view_func=TasksetsPage.as_view('tasksetspage'))
+    flask_app.add_url_rule('/preferences', view_func=PrefRedirectPage.as_view('prefredirectpage'))
+    flask_app.add_url_rule('/preferences/bindings',
                            view_func=BindingsPage.as_view('bindingspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>preferences/delete', view_func=DeletePage.as_view('deletepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>preferences/profile', view_func=ProfilePage.as_view('profilepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>lti/task', view_func=LTITaskPage.as_view('ltitaskpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>lti/<courseid>/<taskid>',
+    flask_app.add_url_rule('/preferences/delete', view_func=DeletePage.as_view('deletepage'))
+    flask_app.add_url_rule('/preferences/profile', view_func=ProfilePage.as_view('profilepage'))
+    flask_app.add_url_rule('/lti/task', view_func=LTITaskPage.as_view('ltitaskpage'))
+    flask_app.add_url_rule('/lti/<courseid>/<taskid>',
                            view_func=LTILaunchPage.as_view('ltilaunchpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>lti/bind', view_func=LTIBindPage.as_view('ltibindpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>lti/login', view_func=LTILoginPage.as_view('ltiloginpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>lti/asset/<path:asset_url>',
+    flask_app.add_url_rule('/lti/bind', view_func=LTIBindPage.as_view('ltibindpage'))
+    flask_app.add_url_rule('/lti/login', view_func=LTILoginPage.as_view('ltiloginpage'))
+    flask_app.add_url_rule('/lti/asset/<path:asset_url>',
                            view_func=LTIAssetPage.as_view('ltiassetpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>',
+    flask_app.add_url_rule('/admin/<courseid>',
                            view_func=CourseRedirectPage.as_view('courseredirect'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/settings',
+    flask_app.add_url_rule('/admin/<courseid>/settings',
                            view_func=CourseSettingsPage.as_view('coursesettingspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/students',
+    flask_app.add_url_rule('/admin/<courseid>/students',
                            view_func=CourseStudentListPage.as_view('coursestudentlistpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/student/<username>',
+    flask_app.add_url_rule('/admin/<courseid>/student/<username>',
                            view_func=CourseStudentInfoPage.as_view('coursestudentinfopage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>submission/<submissionid>',
+    flask_app.add_url_rule('/submission/<submissionid>',
                            view_func=SubmissionPage.as_view('submissionpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/submissions',
+    flask_app.add_url_rule('/admin/<courseid>/submissions',
                            view_func=CourseSubmissionsPage.as_view('coursesubmissionspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/tasks',
+    flask_app.add_url_rule('/admin/<courseid>/tasks',
                            view_func=CourseTaskListPage.as_view('coursetasklistpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/edit/audience/<audienceid>',
+    flask_app.add_url_rule('/admin/<courseid>/edit/audience/<audienceid>',
                            view_func=CourseEditAudience.as_view('courseditaudience'))
 
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>',
+    flask_app.add_url_rule('/taskset/<tasksetid>',
                            view_func=TasksetRedirectPage.as_view('tasksetredirectpage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/settings',
+    flask_app.add_url_rule('/taskset/<tasksetid>/settings',
                            view_func=TasksetSettingsPage.as_view('tasksetsettingspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/edit/<taskid>',
+    flask_app.add_url_rule('/taskset/<tasksetid>/edit/<taskid>',
                            view_func=EditTaskPage.as_view('tasksetedittask'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/edit/<taskid>/files',
+    flask_app.add_url_rule('/taskset/<tasksetid>/edit/<taskid>/files',
                            view_func=CourseTaskFiles.as_view('tasksettaskfiles'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/edit/<taskid>/dd_upload',
+    flask_app.add_url_rule('/taskset/<tasksetid>/edit/<taskid>/dd_upload',
                            view_func=CourseTaskFileUpload.as_view('tasksettaskfileupload'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/template',
+    flask_app.add_url_rule('/taskset/<tasksetid>/template',
                            view_func=TasksetTemplatePage.as_view('tasksettemplatepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>taskset/<tasksetid>/danger',
+    flask_app.add_url_rule('/taskset/<tasksetid>/danger',
                            view_func=TasksetDangerZonePage.as_view('tasksetdangerzonepage'))
 
-    flask_app.add_url_rule('/<cookieless:sessionid>search_user/<request>',
+    flask_app.add_url_rule('/search_user/<request>',
                            view_func=SearchUserPage.as_view('searchuserpage'))
 
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/danger',
+    flask_app.add_url_rule('/admin/<courseid>/danger',
                            view_func=CourseDangerZonePage.as_view('coursedangerzonepage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>admin/<courseid>/stats',
+    flask_app.add_url_rule('/admin/<courseid>/stats',
                            view_func=CourseStatisticsPage.as_view('coursestatisticspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/auth_methods',
+    flask_app.add_url_rule('/api/v0/auth_methods',
                            view_func=APIAuthMethods.as_view('apiauthmethods'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/authentication',
+    flask_app.add_url_rule('/api/v0/authentication',
                            view_func=APIAuthentication.as_view('apiauthentication'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses', view_func=APICourses.as_view('apicourses.alias'),
+    flask_app.add_url_rule('/api/v0/courses', view_func=APICourses.as_view('apicourses.alias'),
                            defaults={'courseid': None})
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses/<courseid>',
+    flask_app.add_url_rule('/api/v0/courses/<courseid>',
                            view_func=APICourses.as_view('apicourses'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses/<courseid>/tasks',
+    flask_app.add_url_rule('/api/v0/courses/<courseid>/tasks',
                            view_func=APITasks.as_view('apitasks.alias'), defaults={'taskid': None})
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses/<courseid>/tasks/<taskid>',
+    flask_app.add_url_rule('/api/v0/courses/<courseid>/tasks/<taskid>',
                            view_func=APITasks.as_view('apitasks'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses/<courseid>/tasks/<taskid>/submissions',
+    flask_app.add_url_rule('/api/v0/courses/<courseid>/tasks/<taskid>/submissions',
                            view_func=APISubmissions.as_view('apisubmissions.alias'))
-    flask_app.add_url_rule('/<cookieless:sessionid>api/v0/courses/<courseid>/tasks/<taskid>/submissions/<submissionid>',
+    flask_app.add_url_rule('/api/v0/courses/<courseid>/tasks/<taskid>/submissions/<submissionid>',
                            view_func=APISubmissionSingle.as_view('apisubmissions'))
-    flask_app.add_url_rule('/<cookieless:sessionid>administrator/users',
+    flask_app.add_url_rule('/administrator/users',
                            view_func=AdministrationUsersPage.as_view('administrationuserspage'))
-    flask_app.add_url_rule('/<cookieless:sessionid>administrator/user_action',
+    flask_app.add_url_rule('/administrator/user_action',
                            view_func=AdministrationUserActionPage.as_view('administrationuseractionpage'))

inginious/frontend/flask/mongo_sessions.py

@@ -68,7 +68,7 @@ def _get_signer(self, app):
 
     def open_session(self, app, request):
         # Check for cookieless session in the path
-        path_session = re.match(r"(/@)([a-f0-9A-F_]*)(@)", request.path)
+        path_session = request.args.get('session_id')
 
         # Check if currently accessed URL is LTI launch page
         try:
@@ -80,7 +80,7 @@ def open_session(self, app, request):
 
         if path_session:  # Cookieless session
             cookieless = True
-            sid = path_session.group(2)
+            sid = path_session
         elif is_lti_launch:
             cookieless = True
             sid = None

inginious/frontend/pages/course.py

@@ -11,14 +11,14 @@
 from inginious.frontend.pages.utils import INGIniousAuthPage
 
 
-def handle_course_unavailable(app_homepath, template_helper, user_manager, course):
+def handle_course_unavailable(get_path, template_helper, user_manager, course):
     """ Displays the course_unavailable page or the course registration page """
     reason = user_manager.course_is_open_to_user(course, lti=False, return_reason=True)
     if reason == "unregistered_not_previewable":
         username = user_manager.session_username()
         user_info = user_manager.get_user_info(username)
         if course.is_registration_possible(user_info):
-            return redirect(app_homepath + "/register/" + course.get_id())
+            return redirect(get_path("register", course.get_id()))
     return template_helper.render("course_unavailable.html", reason=reason)
 
 
@@ -45,7 +45,7 @@ def POST_AUTH(self, courseid):  # pylint: disable=arguments-differ
         user_input = flask.request.form
         if "unregister" in user_input and course.allow_unregister():
             self.user_manager.course_unregister_user(courseid, self.user_manager.session_username())
-            return redirect(self.app.get_homepath() + '/mycourses')
+            return redirect(self.app.get_path('mycourses'))
 
         return self.show_page(course)
 
@@ -58,7 +58,7 @@ def show_page(self, course):
         """ Prepares and shows the course page """
         username = self.user_manager.session_username()
         if not self.user_manager.course_is_open_to_user(course, lti=False):
-            return handle_course_unavailable(self.app.get_homepath(), self.template_helper, self.user_manager, course)
+            return handle_course_unavailable(self.app.get_path, self.template_helper, self.user_manager, course)
         else:
             tasks = course.get_tasks()
 

inginious/frontend/pages/course_admin/audience_edit.py

@@ -88,7 +88,7 @@ def POST_AUTH(self, courseid, audienceid=''):  # pylint: disable=arguments-diffe
                     msg = _("Audience updated.")
 
             if audienceid and audienceid in data["delete"]:
-                return redirect(self.app.get_homepath() + "/admin/" + courseid + "/students?audiences")
+                return redirect(self.app.get_path("admin", courseid, "students?audiences"))
         else:
             audiences_dict = json.loads(data["audiences"])
             student_list = self.user_manager.get_course_registered_users(course, False)