[PATCH 2/4] Separate API login from UI login
Pierre-Yves Chibon
pingou at pingoured.fr
Sun Mar 10 10:29:03 UTC 2013
The idea here is to prevent someone from login in via the API mechanism
and performs action which are outside of the API.
---
coprs_frontend/coprs/views/api_ns/api_general.py | 9 +++++----
coprs_frontend/coprs/views/misc.py | 17 ++++++++++++++---
2 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/coprs_frontend/coprs/views/api_ns/api_general.py b/coprs_frontend/coprs/views/api_ns/api_general.py
index d69013b..a51bad6 100644
--- a/coprs_frontend/coprs/views/api_ns/api_general.py
+++ b/coprs_frontend/coprs/views/api_ns/api_general.py
@@ -1,6 +1,7 @@
import datetime
import time
+import base64
import flask
from coprs import db
@@ -8,7 +9,7 @@ from coprs import exceptions
from coprs import forms
from coprs import helpers
-from coprs.views.misc import login_required
+from coprs.views.misc import login_required, api_login_required
from coprs.views.api_ns import api_ns
@@ -31,7 +32,7 @@ def api_new_token():
"""
user = flask.g.user
copr64 = base64.b64encode('copr') + '##'
- api_login = helpers.generate_api_token(
+ api_login = copr64 + helpers.generate_api_token(
flask.current_app.config['API_TOKEN_LENGTH'] - len(copr64))
user.api_login = api_login
user.api_token = helpers.generate_api_token(
@@ -44,7 +45,7 @@ def api_new_token():
@api_ns.route('/copr/new/', methods=['POST'])
- at login_required
+ at api_login_required
def api_new_copr():
""" Receive information from the user on how to create its new copr,
check their validity and create the corresponding copr.
@@ -134,7 +135,7 @@ def api_coprs_by_owner(username=None):
@api_ns.route('/coprs/detail/<username>/<coprname>/new_build/',
methods=["POST"])
- at login_required
+ at api_login_required
def copr_new_build(username, coprname):
form = forms.BuildForm(csrf_enabled=False)
copr = coprs_logic.CoprsLogic.get(flask.g.user, username,
diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 12072e7..1c5a47c 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -79,8 +79,7 @@ def logout():
flask.flash(u'You were signed out')
return flask.redirect(oid.get_next_url())
-
-def login_required(f):
+def api_login_required(f):
@functools.wraps(f)
def decorated_function(*args, **kwargs):
token = None
@@ -99,7 +98,19 @@ def login_required(f):
and user.api_token_expiration >= datetime.date.today():
token_auth = True
flask.g.user = user
- if not token_auth and flask.g.user is None:
+ if not token_auth:
+ output = {'output': 'notok', 'error': 'Login invalid/expired'}
+ jsonout = flask.jsonify(output)
+ jsonout.status_code = 500
+ return jsonout
+ return f(*args, **kwargs)
+ return decorated_function
+
+
+def login_required(f):
+ @functools.wraps(f)
+ def decorated_function(*args, **kwargs):
+ if flask.g.user is None:
return flask.redirect(flask.url_for('misc.login',
next = flask.request.url))
return f(*args, **kwargs)
--
1.7.1
More information about the copr-devel
mailing list