Bug 663277

Please, note this is a regression.

This is caused by a bug in TurboGears, which we are hitting now that we have identity.force_external_redirect=True (as of Beaker 0.6.0).

The constructor for turbogears.identity.IdentityFailure does not take into account the possibility that cherrypy.request.params might contain dicts or lists due to the NestedVariablesFilter. In a case like:

/jobs/mine?jobsearch-0.table=Status&jobsearch-0.operation=is+not&jobsearch-0.value=Completed&jobsearch-1.table=Status&jobsearch-1.operation=is+not&jobsearch-1.value=Cancelled&jobsearch-2.table=Status&jobsearch-2.operation=is+not&jobsearch-2.value=Aborted&Search=Search

the NestedVariablesFilter gives us params like:

{'jobsearch': [{'table': u'Status', 'operation': u'is not', 'value': u'Completed'}, {'table': u'Status', 'operation': u'is not', 'value': u'Cancelled'}, {'table': u'Status', 'operation': u'is not', 'value': u'Aborted'}]}

which then ends up mangled when we redirect to /login:

/login?jobsearch={%27table%27%3A+u%27Status%27%2C+%27operation%27%3A+u%27is+not%27%2C+%27value%27%3A+u%27Completed%27}&jobsearch={%27table%27%3A+u%27Status%27%2C+%27operation%27%3A+u%27is+not%27%2C+%27value%27%3A+u%27Cancelled%27}&jobsearch={%27table%27%3A+u%27Status%27%2C+%27operation%27%3A+u%27is+not%27%2C+%27value%27%3A+u%27Aborted%27}&Search=Search&forward_url=%2Fjobs%2Fmine

I've got a Beaker test case for this, but it will need to be fixed by patching TurboGears. I've tested this patch:

--- TurboGears-1.0.8.orig/turbogears/identity/exceptions.py
+++ TurboGears-1.0.8/turbogears/identity/exceptions.py
@@ -83,9 +83,11 @@
             # by Apache/nginx or something else that CherryPy won't find.
             # We also need to set the forward_url, because the Referer header
             # won't work with an external redirect.
-            params = cherrypy.request.params
-            params['forward_url'] = cherrypy.request.path_info
-            raise cherrypy.HTTPRedirect(turbogears.url(url, params))
+            forward_url = cherrypy.request.path_info
+            if cherrypy.request.query_string:
+                forward_url += '?' + cherrypy.request.query_string
+            raise cherrypy.HTTPRedirect(
+                    turbogears.url(url, dict(forward_url=forward_url)))
         else:
             # use internal redirect which is quicker
             cherrypy.InternalRedirect.__init__(self, url)

I've rebuilt TurboGears locally with this patch and it works fine. I also updated to 1.0.9 (we have 1.0.8 built at present).

Bill, should I build TurboGears-1.0.9 with this patch, and we can upgrade to that in our 0.6.2 release?

*** Bug 671325 has been marked as a duplicate of this bug. ***

This fix will be going in with 0.6.5 as a patch to TurboGears 1.0.8. We can upgrade TurboGears at a later point.

And test case:

http://git.fedorahosted.org/git/?p=beaker.git;a=commitdiff;h=e49f0a936bc58440087bd72cb6e021e32b200369

Thanks!

This has now also been fixed in TurboGears for all 1.x branches in r7358, i.e. bugfix releases 1.0.10, 1.1.3 and in 1.5.