[copr] master: Rework the login_required decorator to allow token login With the current mechanism, one can either login via the website or provide a "token" and "username" POST or GET parameters. (789c2f9)

Repository : http://git.fedorahosted.org/cgit/copr.git

On branch  : master

> ---------------------------------------------------------------
commit 789c2f94f2900315d04bf0aa91435b2c8839a491
Author: Pierre-Yves Chibon <pingou(a)pingoured.fr&gt;
Date:   Tue Jan 8 11:42:08 2013 +0100

    Rework the login_required decorator to allow token login
    With the current mechanism, one can either login via the website or
    provide a "token" and "username" POST or GET parameters.
    
    By providing the "token" and "username" parameters, one can
access
    to all the functions of coprs and pretty do as much as via the
    website (assuming the other needed parameters are also given).


> ---------------------------------------------------------------
 coprs_frontend/coprs/views/misc.py |   21 +++++++++++++++++----
 1 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/coprs_frontend/coprs/views/misc.py b/coprs_frontend/coprs/views/misc.py
index 430604d..b2fc08c 100644
--- a/coprs_frontend/coprs/views/misc.py
+++ b/coprs_frontend/coprs/views/misc.py
@@ -56,7 +56,7 @@ def create_or_login(resp):
             + datetime.timedelta(days=30)
         user = models.User(openid_name = resp.identity_url, mail = resp.email,
             api_token = generate_api_token(),
-                api_token_expiration = expiration_date_token)
+            api_token_expiration = expiration_date_token)
         db.session.add(user)
         db.session.commit()
     flask.flash(u'Welcome, {0}'.format(user.name))
@@ -74,8 +74,21 @@ def logout():
 def login_required(f):
     @functools.wraps(f)
     def decorated_function(*args, **kwargs):
-        if flask.g.user is None:
-            return flask.redirect(flask.url_for('misc.login', next =
flask.request.url))
+        token = flask.request.form.get('token')
+        username = flask.request.form.get('username')
+        token_auth = False
+        if token and username:
+            user = models.User.query.filter(
+                models.User.openid_name == models.User.openidize_name(username)
+                ).first()
+            if user \
+                and user.api_token == token \
+                and user.api_token_expiration >= datetime.date.today():
+                token_auth = True
+                flask.g.user = user
+        if not token_auth and flask.g.user is None:
+            return flask.redirect(flask.url_for('misc.login',
+                next = flask.request.url))
         return f(*args, **kwargs)
     return decorated_function
 
@@ -97,7 +110,7 @@ def api():
                                  user=flask.g.user)
 
 
-(a)misc.route(&#39;/api/new&#39;)
+(a)misc.route(&#39;/api/new/&#39;, methods = ["POST"])
 @login_required
 def api_new_token():
     user = flask.g.user