Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added setting to add a message after logout #104

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Added setting to add a message after logout #104

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c5d5ef6
Added setting to add a message after logout
pythad Dec 21, 2017
c484aa0
Merge branch 'master' into master
jpic Nov 7, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
5 changes: 4 additions & 1 deletion session_security/middleware.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@

from datetime import datetime, timedelta

from django.contrib import messages
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we not check that this app is installed ?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It has been in Django core for quite a bit. Not sure for how long, but it was added to Git repo in 2009. It's definitely 1.8+ (django-session-security supported versions). So no, there is no need to check if this app has been installed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What happens if an app isn't using contrib.messages? Does the call fail silently? Error?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By default django.contrib.messages is included into INSTALLED_APPS. So unless a developer deleted the package from INSTALLED_APPS everything will work. If there is no django.contrib.messages in INSTALLED_APPS an exception will be raised. But the default value of LOGOUT_MESSAGE is None, this means that by default we even don't need django.contrib.messages. And if a user will want to set LOGOUT_MESSAGE he will read the docs and see that it depends on django.contrib.messages. So the only scenario the exeption will be raised is when a user will specify LOGOUT_MESSAGE and delete django.contrib.messages from INSTALLED_APPS.

from django.contrib.auth import logout
from django.core.urlresolvers import reverse, resolve, Resolver404

Expand All @@ -21,7 +22,7 @@
MiddlewareMixin = object

from .utils import get_last_activity, set_last_activity
from .settings import EXPIRE_AFTER, PASSIVE_URLS, PASSIVE_URL_NAMES
from .settings import EXPIRE_AFTER, PASSIVE_URLS, PASSIVE_URL_NAMES, LOGOUT_MESSAGE


class SessionSecurityMiddleware(MiddlewareMixin):
Expand Down Expand Up @@ -62,6 +63,8 @@ def process_request(self, request):
delta = now - get_last_activity(request.session)
expire_seconds = self.get_expire_seconds(request)
if delta >= timedelta(seconds=expire_seconds):
if LOGOUT_MESSAGE:
messages.add_message(request, messages.WARNING, LOGOUT_MESSAGE)
logout(request)
elif (request.path == reverse('session_security_ping') and
'idleFor' in request.GET):
Expand Down
7 changes: 7 additions & 0 deletions session_security/settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,11 @@
thus cannot be described statically. NOTE: currently namespaces are not
handled. Overridable in ``settings.SESSION_SECURITY_PASSIVE_URL_NAMES``.

LOGOUT_MESSAGE
Message that will be shown after user has been logged out. Works using Django
messages framework. Default is ``None``, so no message will be added to the
request. Overridable in ``settings.SESSION_SECURITY_LOGOUT_MESSAGE``.

SESSION_SECURITY_INSECURE
Set this to True in your settings if you want the project to run without
having to set SESSION_EXPIRE_AT_BROWSER_CLOSE=True, which you should
Expand All @@ -40,6 +45,8 @@

PASSIVE_URL_NAMES = getattr(settings, 'SESSION_SECURITY_PASSIVE_URL_NAMES', [])

LOGOUT_MESSAGE = getattr(settings, 'SESSION_SECURITY_LOGOUT_MESSAGE', None)

expire_at_browser_close = getattr(
settings,
'SESSION_EXPIRE_AT_BROWSER_CLOSE',
Expand Down