use cookieretry only on presale event pages (Z#23236752) (#6297)

* use cookieretry only on presale event pages

* use csrfcookieretry only on event index page

* include static tag

* include csrfcookieretry in order.html as well

* Update src/pretix/static/pretixpresale/js/csrfcookieretry.js

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

---------

Co-authored-by: Richard Schreiber <schreiber@pretix.eu>

pyproject.toml

@@ -53,7 +53,7 @@ dependencies = [
   "django-oauth-toolkit==2.3.*",
   "django-otp==1.7.*",
   "django-phonenumber-field==8.4.*",
-  "django-querytagger==0.0.2",
+  "django-querytagger==0.0.3",
   "django-redis==6.0.*",
   "django-scopes==2.0.*",
   "django-statici18n==2.7.*",

src/pretix/control/middleware.py

@@ -37,7 +37,7 @@ from urllib.parse import quote, urljoin, urlparse
 from django.conf import settings
 from django.contrib.auth import REDIRECT_FIELD_NAME, logout
 from django.contrib.auth.views import redirect_to_login
-from django.http import Http404, HttpResponse
+from django.http import Http404
 from django.shortcuts import get_object_or_404, resolve_url
 from django.template.response import TemplateResponse
 from django.urls import get_script_prefix, resolve, reverse
@@ -98,8 +98,6 @@ class PermissionMiddleware:
         super().__init__()
 
     def _login_redirect(self, request):
-        from django.contrib.auth.views import redirect_to_login
-
         # Taken from django/contrib/auth/decorators.py
         path = request.build_absolute_uri()
         # urlparse chokes on lazy objects in Python 3, force to str
@@ -112,21 +110,10 @@ class PermissionMiddleware:
         if ((not login_scheme or login_scheme == current_scheme) and
                 (not login_netloc or login_netloc == current_netloc)):
             path = request.get_full_path()
+        from django.contrib.auth.views import redirect_to_login
 
-        if request.headers.get("X-Requested-With") == "XMLHttpRequest":
-            # It's not useful to return a 302 redirect on a XMLHttpRequest request,  because
-            # the XMLHttpRequest is unable to detect redirects.
-            return HttpResponse(
-                "Authentication required",
-                status=401,
-                headers={
-                    # Appending ?next= is handled by client, because it should be the top-level context url,
-                    # not the URL called in the background
-                    "X-Login-Url": resolved_login_url,
-                }
-            )
-
-        return redirect_to_login(path, resolved_login_url, REDIRECT_FIELD_NAME)
+        return redirect_to_login(
+            path, resolved_login_url, REDIRECT_FIELD_NAME)
 
     def __call__(self, request):
         url = resolve(request.path_info)

src/pretix/control/templates/pretixcontrol/auth/login.html

@@ -56,4 +56,5 @@
     </form>
     <script type="text/plain" id="good_origin">{{ good_origin }}</script>
     <script type="text/plain" id="bad_origin_report_url">{{ bad_origin_report_url }}</script>
+    <!-- pretix-login-marker -->{# marker required for ajax calls to detect that user session is over #}
 {% endblock %}

src/pretix/plugins/webcheckin/static/pretixplugins/webcheckin/api.ts

@@ -205,8 +205,8 @@ const CSRF_TOKEN = document.querySelector<HTMLInputElement>('input[name=csrfmidd
 function handleAuthError (response: Response): void {
 	if ([401, 403].includes(response.status)) {
 		window.location.href = '/control/login?next=' + encodeURIComponent(
-			window.location.pathname + window.location.search
-		) + window.location.hash
+			window.location.pathname + window.location.search + window.location.hash
+		)
 	}
 }
 

src/pretix/presale/templates/pretixpresale/event/base.html

@@ -9,7 +9,7 @@
 {% load anonymize_email %}
 {% block thetitle %}
     {% if messages %}
-        {{ messages|join:" " }} :: 
+        {{ messages|join:" " }} ::
     {% endif %}
     {% block title %}{% endblock %}{% if request.resolver_match.url_name != "event.index" %} :: {% endif %}{{ event.name }}
 {% endblock %}

src/pretix/presale/templates/pretixpresale/event/index.html

@@ -1,6 +1,7 @@
 {% extends "pretixpresale/event/base.html" %}
 {% load i18n %}
 {% load l10n %}
+{% load static %}
 {% load eventurl %}
 {% load cache_large %}
 {% load money %}
@@ -39,6 +40,7 @@
     {% else %}
         <meta property="og:url" content="{% abseventurl request.event "presale:event.index" %}" />
     {% endif %}
+    <script type="text/javascript" src="{% static "pretixpresale/js/csrfcookieretry.js" %}"></script>
 {% endblock %}
 {% block content %}
 

src/pretix/presale/templates/pretixpresale/event/order.html

@@ -6,6 +6,7 @@
 {% load money %}
 {% load expiresformat %}
 {% load eventurl %}
+{% load static %}
 {% load phone_format %}
 {% load rich_text %}
 {% load getitem %}
@@ -22,6 +23,10 @@
     {% endif %}
     {% trans "Order details" %}
 {% endblock %}
+{% block custom_header %}
+    {{ block.super }}
+     <script type="text/javascript" src="{% static "pretixpresale/js/csrfcookieretry.js" %}"></script>
+{% endblock %}
 {% block content %}
     {% if "thanks" in request.GET or "paid" in request.GET %}
         <div class="thank-you">

src/pretix/presale/views/widget.py

@@ -123,7 +123,7 @@ def widget_css_etag(request, version, **kwargs):
 
 
 def _use_vite(request):
-    if getattr(settings, 'PRETIX_WIDGET_VITE', False):
+    if getattr(settings, 'PRETIX_WIDGET_VITE', False) or "beta" in request.GET:
         return True
     origin = request.META.get('HTTP_ORIGIN', '')
     gs = GlobalSettingsObject()

src/pretix/static/pretixbase/js/asynctask.js

@@ -113,12 +113,6 @@ function async_task_check_error(jqXHR, textStatus, errorThrown) {
     "use strict";
     var respdom = $(jqXHR.responseText);
     var c = respdom.filter('.container');
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-      // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-      // The browser will keep it in the redirect.
-      window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
-      return;
-    }
     if (respdom.filter('form') && (respdom.filter('.has-error') || respdom.filter('.alert-danger'))) {
         // This is a failed form validation, let's just use it
         $("body").data('ajaxing', false);
@@ -173,12 +167,6 @@ function async_task_callback(data, jqXHR, status) {
 function async_task_error(jqXHR, textStatus, errorThrown) {
     "use strict";
     $("body").data('ajaxing', false);
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-      // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-      // The browser will keep it in the redirect.
-      window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
-      return;
-    }
     waitingDialog.hide();
     if (textStatus === "timeout") {
         alert(gettext("The request took too long. Please try again."));

src/pretix/static/pretixcontrol/js/ui/main.js

@@ -58,16 +58,13 @@ var i18nToString = function (i18nstring) {
 };
 
 $(document).ajaxError(function (event, jqXHR, settings, thrownError) {
+    waitingDialog.hide();
     var c = $(jqXHR.responseText).filter('.container');
-    if (jqXHR.status === 401 && jqXHR.getResponseHeader("X-Login-Url")) {
-        // Append location.hash outside the next parameter so it is not unexpectedly sent to the server
-        // The browser will keep it in the redirect.
-        window.location = jqXHR.getResponseHeader("X-Login-Url") + "?next=" + encodeURIComponent(location.pathname + location.search) + location.hash;
+    if (jqXHR.responseText && jqXHR.responseText.indexOf("<!-- pretix-login-marker -->") !== -1) {
+        location.href = '/control/login?next=' + encodeURIComponent(location.pathname + location.search + location.hash)
     } else if (c.length > 0) {
-        waitingDialog.hide();
         ajaxErrDialog.show(c.first().html());
     } else if (thrownError !== "abort" && thrownError !== "") {
-        waitingDialog.hide();
         console.error(event, jqXHR, settings, thrownError);
         alert(gettext('Unknown error.'));
     }

src/pretix/static/pretixpresale/js/csrfcookieretry.js

@@ -0,0 +1,15 @@
+document.addEventListener("DOMContentLoaded", () => {
+  const COOKIE_NAME = "__Host-pretix_csrftoken";
+  const RELOAD_FLAG = "csrfReloadPerformed";
+
+  const hasCookie = document.cookie
+    .split("; ")
+    .some((c) => c.startsWith(COOKIE_NAME + "="));
+
+  if (!hasCookie && !sessionStorage.getItem(RELOAD_FLAG)) {
+    sessionStorage.setItem(RELOAD_FLAG, "1");
+    location.reload();
+  } else if (hasCookie && sessionStorage.getItem(RELOAD_FLAG)) {
+      sessionStorage.removeItem(RELOAD_FLAG);
+  }
+});