Hopiu/django-axes
1
0
Fork 0
mirror of https://github.com/jazzband/django-axes.git synced 2026-05-21 13:51:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Failed logins can also be called with a wrong request object

Browse source
This commit is contained in:
Gert Van Gool 2020-12-23 15:53:38 -08:00
parent 82ca671f94
commit 551865d9c2
2 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
axes/signals.py
View file

@ -29,7 +29,7 @@ user_locked_out = Signal(providing_args=['request', 'username', 'ip_address'])
def request_meta_get(request, key, default_value=None):
meta = getattr(request, 'META', {})
if not meta:
# oauth2_provider package stores META in headers
# oauthlib uses custom request object with Django's `META` in `headers` attribute
meta = getattr(request, 'headers', {})
return meta.get(key, default_value)
@ -45,9 +45,9 @@ def log_user_login_failed(sender, credentials, request, **kwargs):
return
ip_address = get_ip(request)
username = credentials.get('username', None)
user_agent = request.META.get('HTTP_USER_AGENT', '<unknown>')[:255]
path_info = request.META.get('PATH_INFO', '<unknown>')[:255]
http_accept = request.META.get('HTTP_ACCEPT', '<unknown>')[:1025]
user_agent = request_meta_get(request, 'HTTP_USER_AGENT', '<unknown>')[:255]
path_info = request_meta_get(request, 'PATH_INFO', '<unknown>')[:255]
http_accept = request_meta_get(request, 'HTTP_ACCEPT', '<unknown>')[:1025]
if settings.AXES_NEVER_LOCKOUT_WHITELIST and ip_in_whitelist(ip_address):
return

1
axes/utils.py
View file

@ -57,6 +57,7 @@ def get_ip(request):
return ''
request_meta = getattr(request, "META", {})
if not request_meta:
# oauthlib uses custom request object with Django's `META` in `headers`
request_meta = getattr(request, "headers", {})
if settings.AXES_BEHIND_REVERSE_PROXY:
# For requests originating from behind a reverse proxy,