Repository :
http://git.fedorahosted.org/cgit/copr.git
On branch : master
---------------------------------------------------------------
commit 8ccfe186f6d8bf2fa46335e1a485feec41068ad1
Author: Pierre-Yves Chibon <pingou(a)pingoured.fr>
Date: Sun Mar 10 10:20:12 2013 +0100
Separate API login from UI login
The idea here is to prevent someone from login in via the API mechanism
and performs action which are outside of the API.
---------------------------------------------------------------
coprs_frontend/coprs/views/api_ns/api_general.py | 7 ++++---
coprs_frontend/coprs/views/misc.py | 17 ++++++++++++++---
2 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py
b/coprs_frontend/coprs/views/api_ns/api_general.py
index 081aceb..f3a7a8f 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -1,6 +1,7 @@
import datetime
import time
+import base64
import flask
from coprs import db
@@ -8,7 +9,7 @@ from coprs import exceptions
from coprs import forms
from coprs import helpers
-from coprs.views.misc import login_required
+from coprs.views.misc import login_required, api_login_required
from coprs.views.api_ns import api_ns
@@ -40,7 +41,7 @@ def api_new_token():
@api_ns.route('/copr/new/', methods=['POST'])
-@login_required
+@api_login_required
def api_new_copr():
""" Receive information from the user on how to create its new copr,
check their validity and create the corresponding copr.
@@ -130,7 +131,7 @@ def api_coprs_by_owner(username=None):
@api_ns.route('/coprs/detail/<username>/<coprname>/new_build/',
methods=["POST"])
-@login_required
+@api_login_required
def copr_new_build(username, coprname):
form = forms.BuildForm(csrf_enabled=False)
copr = coprs_logic.CoprsLogic.get(flask.g.user, username,
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 383b832..ebb0d86 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -76,8 +76,7 @@ def logout():
flask.flash(u'You were signed out')
return flask.redirect(oid.get_next_url())
-
-def login_required(f):
+def api_login_required(f):
@functools.wraps(f)
def decorated_function(*args, **kwargs):
token = None
@@ -97,7 +96,19 @@ def login_required(f):
and user.api_token_expiration >= datetime.date.today():
token_auth = True
flask.g.user = user
- if not token_auth and flask.g.user is None:
+ if not token_auth:
+ output = {'output': 'notok', 'error': 'Login
invalid/expired'}
+ jsonout = flask.jsonify(output)
+ jsonout.status_code = 500
+ return jsonout
+ return f(*args, **kwargs)
+ return decorated_function
+
+
+def login_required(f):
+ @functools.wraps(f)
+ def decorated_function(*args, **kwargs):
+ if flask.g.user is None:
return flask.redirect(flask.url_for('misc.login',
next = flask.request.url))
return f(*args, **kwargs)