[PATCH 2/4] Separate API login from UI login

Pierre-Yves Chibon pingou at pingoured.fr
Sun Mar 10 10:29:03 UTC 2013


The idea here is to prevent someone from login in via the API mechanism
and performs action which are outside of the API.
---
 coprs_frontend/coprs/views/api_ns/api_general.py |    9 +++++----
 coprs_frontend/coprs/views/misc.py               |   17 ++++++++++++++---
 2 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py b/coprs_frontend/coprs/views/api_ns/api_general.py
index d69013b..a51bad6 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -1,6 +1,7 @@
 import datetime
 import time
 
+import base64
 import flask
 
 from coprs import db
@@ -8,7 +9,7 @@ from coprs import exceptions
 from coprs import forms
 from coprs import helpers
 
-from coprs.views.misc import login_required
+from coprs.views.misc import login_required, api_login_required
 
 from coprs.views.api_ns import api_ns
 
@@ -31,7 +32,7 @@ def api_new_token():
     """
     user = flask.g.user
     copr64 = base64.b64encode('copr') + '##'
-    api_login = helpers.generate_api_token(
+    api_login = copr64 + helpers.generate_api_token(
         flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
     user.api_login = api_login
     user.api_token = helpers.generate_api_token(
@@ -44,7 +45,7 @@ def api_new_token():
 
 
 @api_ns.route('/copr/new/', methods=['POST'])
- at login_required
+ at api_login_required
 def api_new_copr():
     """ Receive information from the user on how to create its new copr,
     check their validity and create the corresponding copr.
@@ -134,7 +135,7 @@ def api_coprs_by_owner(username=None):
 
 @api_ns.route('/coprs/detail/<username>/<coprname>/new_build/',
     methods=["POST"])
- at login_required
+ at api_login_required
 def copr_new_build(username, coprname):
     form = forms.BuildForm(csrf_enabled=False)
     copr = coprs_logic.CoprsLogic.get(flask.g.user, username,
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 12072e7..1c5a47c 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -79,8 +79,7 @@ def logout():
     flask.flash(u'You were signed out')
     return flask.redirect(oid.get_next_url())
 
-
-def login_required(f):
+def api_login_required(f):
     @functools.wraps(f)
     def decorated_function(*args, **kwargs):
         token = None
@@ -99,7 +98,19 @@ def login_required(f):
                 and user.api_token_expiration >= datetime.date.today():
                 token_auth = True
                 flask.g.user = user
-        if not token_auth and flask.g.user is None:
+        if not token_auth:
+            output = {'output': 'notok', 'error': 'Login invalid/expired'}
+            jsonout = flask.jsonify(output)
+            jsonout.status_code = 500
+            return jsonout
+        return f(*args, **kwargs)
+    return decorated_function
+
+
+def login_required(f):
+    @functools.wraps(f)
+    def decorated_function(*args, **kwargs):
+        if flask.g.user is None:
             return flask.redirect(flask.url_for('misc.login',
                 next = flask.request.url))
         return f(*args, **kwargs)
-- 
1.7.1



More information about the copr-devel mailing list