[PATCH] Change from using parameters to HTTP Basic access authentication
Pierre-Yves Chibon
pingou at pingoured.fr
Sun Feb 3 19:50:36 UTC 2013
This change prevent the username/API token from being displayed in the server logs
and makes the API actually working in a more standardized maner, using the http
headers as they are expected to be.
---
This is rebased on the top of the previous commit sent changing the API itself.
Thus it should apply fine on master.
copr_cli/subcommands.py | 4 +++-
coprs_frontend/coprs/views/misc.py | 10 ++++++++--
2 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/copr_cli/subcommands.py b/copr_cli/subcommands.py
index ce267a2..c1af50a 100644
--- a/copr_cli/subcommands.py
+++ b/copr_cli/subcommands.py
@@ -101,7 +101,9 @@ class AddCopr(Command):
for chroot in args.chroots:
data[chroot] = 'y'
- req = requests.post(URL, params=user, data=data)
+ req = requests.post(URL,
+ auth=(user['username'], user['token']),
+ data=data)
output = json.loads(req.text)
if output['output'] == 'ok':
print output['message']
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 48a1f3a..d7eb73e 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -1,3 +1,4 @@
+import base64
import datetime
import functools
@@ -79,8 +80,13 @@ def logout():
def login_required(f):
@functools.wraps(f)
def decorated_function(*args, **kwargs):
- token = flask.request.args.get('token')
- username = flask.request.args.get('username')
+ token = None
+ username = None
+ if 'Authorization' in flask.request.headers:
+ base64string = flask.request.headers['Authorization']
+ base64string = base64string.split()[1].strip()
+ userstring = base64.b64decode(base64string)
+ (username, token) = userstring.split(':')
token_auth = False
if token and username:
user = models.User.query.filter(
--
1.8.1
More information about the copr-devel
mailing list