paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-15 11:22:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

decorator: Add localhost/Tornado hack to access_user_by_api_key.

Browse Source 
This should make it possible to share that code with other code paths.
This commit is contained in:
Tim Abbott
2017-08-14 15:42:16 -07:00
parent 1144eed48b
commit 3c37795675
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
zerver/decorator.py
View File

@@ -236,8 +236,12 @@ def access_user_by_api_key(request, api_key):
if user_profile.realm.deactivated: if user_profile.realm.deactivated:
raise JsonableError(_("Realm for account has been deactivated")) raise JsonableError(_("Realm for account has been deactivated"))
if not check_subdomain(get_subdomain(request), user_profile.realm.subdomain): if (not check_subdomain(get_subdomain(request), user_profile.realm.subdomain) and
logging.warning("User %s attempted to access webhook API on wrong subdomain %s" % ( # Allow access to localhost for Tornado
not (settings.RUNNING_INSIDE_TORNADO and
request.META["SERVER_NAME"] == "127.0.0.1" and
request.META["REMOTE_ADDR"] == "127.0.0.1")):
logging.warning("User %s attempted to access API on wrong subdomain %s" % (
user_profile.email, get_subdomain(request))) user_profile.email, get_subdomain(request)))
raise JsonableError(_("Account is not associated with this subdomain")) raise JsonableError(_("Account is not associated with this subdomain"))

4
zerver/tests/test_decorators.py
View File

@@ -247,7 +247,7 @@ class DecoratorTestCase(TestCase):
api_result = my_webhook(request) api_result = my_webhook(request)
mock_warning.assert_called_with( mock_warning.assert_called_with(
"User {} attempted to access webhook API on wrong " "User {} attempted to access API on wrong "
"subdomain {}".format(webhook_bot_email, '')) "subdomain {}".format(webhook_bot_email, ''))
with mock.patch('logging.warning') as mock_warning: with mock.patch('logging.warning') as mock_warning:
@@ -257,7 +257,7 @@ class DecoratorTestCase(TestCase):
api_result = my_webhook(request) api_result = my_webhook(request)
mock_warning.assert_called_with( mock_warning.assert_called_with(
"User {} attempted to access webhook API on wrong " "User {} attempted to access API on wrong "
"subdomain {}".format(webhook_bot_email, 'acme')) "subdomain {}".format(webhook_bot_email, 'acme'))
# Test when content_type is application/json and request.body # Test when content_type is application/json and request.body