What directory should the frontend user login template be put into? - authentication

Since I want to keep the admin login separate from the user login on my Wagtail site, I'm trying to use the login page settings mentioned in this section of the documentation to direct people to a custom login page. I added the following settings to my base.py folder in the settings directory for my WT project under #Wagtail settings:
WAGTAIL_FRONTEND_LOGIN_URL = '/login/'
WAGTAIL_FRONTEND_LOGIN_TEMPLATE = 'base/login.html'
My project is structured similar to the bakerydemo, so there is a base app that manages a lot of the shared pieces of the site. I put my login.html in the templates directory for the base app. See link below for screenshot.
Screenshot of project directories
I am getting a 404 error whenever I try to navigate to the login URL I specified. Is there a setting I missed? Did I put the template in the wrong directory? Still getting used to how WT structures projects, so any pointers would be very much appreciated.

You should only set one of WAGTAIL_FRONTEND_LOGIN_URL and WAGTAIL_FRONTEND_LOGIN_TEMPLATE, not both.
WAGTAIL_FRONTEND_LOGIN_TEMPLATE is used if you want to use Wagtail's own login view (located at the URL /_util/login/), but want to customise its template. If you're going down this route, a path like 'base/login.html' is correct - Django will search within all template directories for a file matching this path.
WAGTAIL_FRONTEND_LOGIN_URL is used if you want to provide your own view code. To use this, you'll need to write the view function (most likely inheriting from Django's LoginView) and register it in the URL config, then point WAGTAIL_FRONTEND_LOGIN_URL at the resulting URL. In this case, your view function will be responsible for rendering an appropriate template, so WAGTAIL_FRONTEND_LOGIN_TEMPLATE will not come into play.

Related

Prevent access to public webpack bundle? ExpressJS

In my webpack config I have the publicPath set like so:
publicPath: '/js'
This way it points to public/js. Also in my index.pug file, which is loaded by the server and not in the public folder I have this:
extends layout
block content
main#app
script(src="/js/bundle.js")
Unfortunately, this enables people accessing my site to visit example.com/js/bundle.js. Is there a way to prevent this?
If /js/bundle.js is a script file you are using in your web page, then there is NO way to prevent the browser from going directly to http://example.com/js/bundle.js. That's the exact URL that the browser uses to load the script from your web page so that URL has to work.
ALL Javascript that runs in your web page is openly available to the public. You cannot change that. That's the architecture of the web and browsers.
Unfortunately, this enables people accessing my site to visit example.com/js/bundle.js. Is there a way to prevent this?
No. You cannot prevent it.

Aurelia with out a router, navigate to login.html and not /#login

I'm writing custom views for Identity Server 3 for its login, logout, consent, etc. I want to use Aurelia but in Identity server I have to pass in the actual html file. So, how can I navigate to localhost:9000/login.html and not localhost:9000/#login
Thanks
if you want to remove the # from URLs in an aurelia application:
Configuring PushState
Remember that Aurelia is "just JavaScript," so when you want to link to another page on your site, you'll do it the same way you always would, by giving either an absolute or relative path to the file. You're not going to be able to link to an HTML file that is in your bundle though, the file will have to be unbundled, like index.html is.
At this point, this becomes just a standard JavaScript question about building a URL, and not anything to do with Aurelia. So just have the url point to wherever login.html is. I'm hoping this is enough for the answer, if not we can discuss it further.
With #Ashley Grant's help, I was able to create an aurelia replacement for IViewService example coded in angular. Identity Server 3 IView Service Example
It's honestly quite easy. Just create a standard aurelia project and put your html in app.html and view model in app.js. In addition to having the vendor_bundle reference link in your Index.html you will also have to create a link for the app_bundle as well because of a bug that tries to locate app_bundle in the root of your folder structure for Identity Server.
If anyone is interested in the source I can put something together just IM me.

Seeing bundle files path in login url and redirecting multiple times

I'm using mvc4 and .Net 4.5 in my project with SSL. Now, on localhost and even on server, the login page gets redirect a bunch of times and then loads without and css on page. In browser debugger I get error as:
Uncaught SyntaxError: Unexpected token <http://localhost:55248/Account/Login? ReturnUrl=%2fbundles%2fjqueryval%3fv%3dWrBNyT_GYLXAZ7iWD7vDdFccq24m7v_9MPi3rcQ8FO01&v=WrBNyT_GYLXAZ7iWD7vDdFccq24m7v_9MPi3rcQ8FO01...
I'm using bundling and code snippet as below.
bundles.Add(new ScriptBundle("~/bundles/BaseJs")
.Include("~/Scripts/jquery-{version}.js")
.Include("~/Scripts/jqueryui/jquery-ui.js")
.Include("~/Scripts/bootstrap.js"));
The syntax error is from the error page being loaded as JavaScript (when it's obviously not JavaScript). It's a red herring. The true problem is that your JavaScript file is needing authorization in the first place.
Typically, this wouldn't be an issue. By default, anything with an extension (.js, for example) is ignored by MVC and handled directly by IIS. Worst case scenario, there, IIS doesn't have permission to read the file, and you end up with a 403 Forbidden. It would end there, as an IIS-level 403 would not trigger a login page redirect, mostly because, again, MVC is not involved.
However, if you've bungled around the with default setup, such that MVC is now handling all requests, even for static files. Then, the action that's being triggered to handle the request to your JavaScript file is requiring authorization, and therefore is redirecting to the login page. So find out what action is being hit and either remove the requirement for it to be authorized or have the right action serve the file. Or, ideally, leave things as they should be and let IIS do what IIS does best and serve the static files.
EDIT
I wasn't paying attention to the fact that bundles are rendered without a file extension. However, the steps to correct the issue are largely the same. Something is mostly likely off with your routing, and the request for the bundle is actually being caught by one of your actions, particularly one that requires authorization. Look out for catch-all routes and make sure that you're not using a route like "bundles" anywhere in your RouteConfig.cs or any of your Route attributes, if you're using attribute routing.
First try to include your bundles like that :
.Include( "~/Scripts/jquery-{version}.js",
"~/Scripts/jqueryui/jquery-ui.js",
"~/Scripts/bootstrap.js"
);
Include takes string[] as parameter and you don't need to call include for each row. Then you should debug your bundles to see which js is giving the error.
Try to comment out rows 1 by 1 to see what would be the result. The problem is definatelly in your bundles, I also had these kind of errors. If you can provide more code - > snippet from the view, of the css loading and bundles and stuff like that I would be able to help you more.

Flask-security login and logout

How do you log a user in and out in Flask using the Flask-Security extension?
I just started using flask-security, and going through the documentation here http://pythonhosted.org/Flask-Security/api.html , I can't really figure out how to explicitly log a user in and out, as well as authenticate the user before logging them in.
Flask-Security uses Flask-Login. So you can do the following as per documentation:
login_user(user) # where user is your user object
logout_user()
Obviously, you still need to write your views where you will validate the form submissions etc before calling these methods and do the proper template rendering or redirects as needed.
Go to the flask security configurations page here: http://pythonhosted.org/Flask-Security/configuration.html
and copy over all the default configuration values into your init.py file like:
app.config['SECURITY_LOGIN_USER_TEMPLATE'] = 'security/login_user.html'
etc...
Then you have to download the security file which contains all the html templates. Put that folder in your templates folder where you keep all the other html templates. You can use google to figure out where to download the folder as well as how to set up the rest of flask security. I had a lot of trouble figuring out flask security as well, but after poking around here and on google, I was able to get some of it working, so don't lose faith. Hope this helps.

Unable to show page in iframe in Ektron CMS

I am working on Ektron 8.6.0.060 CMS, on admin dashboard I add an custom widget in which I call an iframe for content page, on picking URL from iframe, 404 page not found error occurs. All URL and signs are using correctly still error occurs.
Be sure that you are entering a fully qualified domain name in your IFrame. Unless you are very careful about your paths, relative locations will likely be incorrect. Rather than "/page/item.aspx" or "www.site.com/page/item.aspx" make sure you include your protocol, e.g. "http://www.site.com/page/item.aspx" . This is particularly easy to forget if you are generating this url dynamically.
Also, if you are pointing to ektron content, make sure the content is published and public.