underground-software · theyoyojo · Mar 22, 2024 · Mar 22, 2024 · Mar 21, 2024 · Mar 22, 2024
diff --git a/kdlp.underground.software/405.md b/kdlp.underground.software/405.md
@@ -0,0 +1 @@
+# HTTP ERROR 405: METHOD NOT ALLOWED
diff --git a/nginx_snippets/server_https/01-orbit-paths.conf b/nginx_snippets/server_https/01-orbit-paths.conf
@@ -2,5 +2,6 @@ error_page 401 /login?target=\$uri;
 
 location ~* ^((.*\.md)|/log(in|out)|/dashboard|/register|/cgit.*)$ {
 	include uwsgi_params;
+	proxy_intercept_errors on;
 	proxy_pass http://host.containers.internal:9098;
 }
diff --git a/nginx_snippets/server_https/02-error-pages.conf b/nginx_snippets/server_https/02-error-pages.conf
@@ -1,5 +1,6 @@
 error_page 403 /403.md;
 error_page 404 /404.md;
+error_page 405 /405.md;
 error_page 502 /502.md;
 error_page 502 /502.md;
 error_page 500 /500.md;
diff --git a/orbit/config.py b/orbit/config.py
diff --git a/orbit/hyperspace.py b/orbit/hyperspace.py
@@ -167,14 +167,13 @@ def do_list_sessions(args):
 
 
 ASN_FMT = """
-{} submitted to {}@{}
+{} submitted to mailbox {}
 """.strip()
 
 
 def do_list_asn(args):
     raw_list = db.asn_get()
-    print('\n'.join([ASN_FMT.format(asn[0], asn[1],
-                                    config.srvname) for asn in raw_list]))
+    print('\n'.join([ASN_FMT.format(asn[0], asn[1]) for asn in raw_list]))
 
 
 INBOX_FMT = """

diff --git a/orbit/radius.py b/orbit/radius.py
@@ -295,7 +295,7 @@ def format_html(self, doc):
         return html_header + doc + f"""
         <hr>
         <code>msg = {self._msg}</code><br>
-        <code>whoami  = {self.username}</code><br>
+        <code>whoami = {self.username}</code><br>
         <code>
             {config.appname}
             {config.version}
@@ -312,10 +312,10 @@ def raw_respond(self, response_code, body=b''):
                              self.headers)
         return [body]
 
-    def respond(self, response_code, response_document):
+    def respond(self, response_document):
         self.headers += [('Content-Type', 'text/html')]
         response_document = self.format_html(response_document)
-        return self.raw_respond(response_code, encode(response_document))
+        return self.raw_respond(HTTPStatus.OK, encode(response_document))
 
 
 form_welcome_template = """
@@ -351,12 +351,6 @@ def respond(self, response_code, response_document):
     <h3>Need an account? Register <a href="/register">here</a></h3><br>
 """.strip()
 
-form_logout = """
-<head>
-    <meta http-equiv="Refresh" content="0; URL=/login" />
-</head>
-"""
-
 
 def cookie_info_table(session):
     return mk_table([
@@ -373,22 +367,20 @@ def mk_form_welcome(session):
 
 
 def handle_login(rocket):
-    response_document = form_login
-    response_status = HTTPStatus.OK
+    def respond(welcome):
+        return rocket.respond(mk_form_welcome(rocket.session)
+                              if welcome else form_login)
     if rocket.session:
         rocket.msg(f'{rocket.username} authenticated by token')
-        response_document = mk_form_welcome(rocket.session)
-    elif rocket.method == "POST":
-        if rocket.launch():
-            rocket.msg(f'{rocket.username} authenticated by password')
-            response_document = mk_form_welcome(rocket.session)
-        else:
-            rocket.msg('authentication failure')
-            response_status = HTTPStatus.UNAUTHORIZED
-    else:
+        return respond(welcome=True)
+    if rocket.method != 'POST':
         rocket.msg('welcome, please login')
-        response_document = form_login
-    return rocket.respond(response_status, response_document)
+        return respond(welcome=False)
+    if not rocket.launch():
+        rocket.msg('authentication failure')
+        return respond(welcome=False)
+    rocket.msg(f'{rocket.username} authenticated by password')
+    return respond(welcome=True)
 
 
 def handle_mail_auth(rocket):
@@ -413,14 +405,15 @@ def handle_mail_auth(rocket):
 def handle_logout(rocket):
     if rocket.session:
         rocket.retire()
-    return rocket.respond(HTTPStatus.OK, form_logout)
+    rocket.headers += [('Location', '/login')]
+    return rocket.raw_respond(HTTPStatus.FOUND)
 
 
 def handle_stub(rocket, more=[]):
     meth_path = f'{rocket.method} {rocket.path_info}'
     content = f'<h3>Development stub for {meth_path} </h3>{"".join(more)}'
     rocket.msg('oops')
-    return rocket.respond(HTTPStatus.OK, content)
+    return rocket.respond(content)
 
 
 def handle_dashboard(rocket):
@@ -444,24 +437,23 @@ def handle_dashboard(rocket):
 
 
 def handle_register(rocket):
-    response_document = form_register
-    response_status = HTTPStatus.OK
-    rocket.msg('welcome, please register')
-    if rocket.method == 'POST':
-        if student_id := rocket.body_args_query('student_id'):
-            if registration_data := db.reg_getby_stuid(student_id)[0]:
-                (regid, username, password) = registration_data
-                db.reg_delby_regid(regid)
-                response_document = register_response % {
-                    'username': username,
-                    'password': password,
-                }
-                rocket.msg('welcome to the classroom')
-            else:
-                rocket.msg('no such student')
-        else:
-            rocket.msg('you must provide a student id')
-    return rocket.respond(response_status, response_document)
+    def form_respond():
+        return rocket.respond(form_register)
+    if rocket.method != 'POST':
+        return form_respond()
+    if not (student_id := rocket.body_args_query('student_id')):
+        rocket.msg('you must provide a student id')
+        return form_respond()
+    if not (registration_data := db.reg_getby_stuid(student_id)[0]):
+        rocket.msg('no such student')
+        return form_respond()
+    (regid, username, password) = registration_data
+    db.reg_delby_regid(regid)
+    rocket.msg('welcome to the classroom')
+    return rocket.respond((register_response % {
+        'username': username,
+        'password': password,
+    }))
 
 
 def handle_cgit(rocket):
@@ -475,14 +467,14 @@ def handle_cgit(rocket):
     so, se = proc.communicate()
     outstring = str(so, 'UTF-8')
     begin = outstring.index('\n\n')
-    return rocket.respond(HTTPStatus.OK, outstring[begin+2:])
+    return rocket.respond(outstring[begin+2:])
 
 
 def handle_md(rocket, md_path):
     with open(md_path, 'r', newline='') as f:
         content = markdown.markdown(f.read(),
                                     extensions=['tables', 'fenced_code'])
-        return rocket.respond(HTTPStatus.OK, content)
+        return rocket.respond(content)
 
 
 def handle_try_md(rocket):
@@ -491,21 +483,30 @@ def handle_try_md(rocket):
             and os.access(md_path, os.R_OK):
         return handle_md(rocket, md_path)
     else:
-        return rocket.respond(HTTPStatus.NOT_FOUND, 'HTTP 404 NOT FOUND')
+        return rocket.raw_respond(HTTPStatus.NOT_FOUND)
 
 
 def application(env, SR):
     rocket = Rocket(env, SR)
+    if rocket.method != 'GET' and rocket.method != 'POST':
+        return rocket.raw_respond(HTTPStatus.METHOD_NOT_ALLOWED)
+
+    # routes supporting get and post
     if re.match("^/login", rocket.path_info):
         return handle_login(rocket)
-    elif re.match("^/logout", rocket.path_info):
+    elif re.match("^/register", rocket.path_info):
+        return handle_register(rocket)
+    else:
+        if rocket.method != 'GET':
+            return rocket.raw_respond(HTTPStatus.METHOD_NOT_ALLOWED)
+
+    # routes supporting only get
+    if re.match("^/logout", rocket.path_info):
         return handle_logout(rocket)
     elif re.match("^/mail_auth", rocket.path_info):
         return handle_mail_auth(rocket)
     elif re.match("^/dashboard", rocket.path_info):
         return handle_dashboard(rocket)
-    elif re.match("^/register", rocket.path_info):
-        return handle_register(rocket)
     elif re.match("^/cgit", rocket.path_info):
         return handle_cgit(rocket)
     else: