From fc8b3f132c5629f95df8d865f47961b2775277cd Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Jul 12 2018 14:17:00 +0000 Subject: [PATCH 1/3] Check if the user is authenticated in the UI before resetting the values Signed-off-by: Pierre-Yves Chibon --- diff --git a/pagure/api/__init__.py b/pagure/api/__init__.py index 0e822ee..af5de20 100644 --- a/pagure/api/__init__.py +++ b/pagure/api/__init__.py @@ -122,14 +122,14 @@ def check_api_acls(acls, optional=False): ''' Checks if the user provided an API token with its request and if this token allows the user to access the endpoint desired. ''' + if authenticated(): + return + flask.g.token = None - flask.g.user = None + flask.g.fas_user = None token = None token_str = None - if authenticated(): - return - if 'Authorization' in flask.request.headers: authorization = flask.request.headers['Authorization'] if 'token' in authorization: From 7186a488c553a1bbb6e2de9fc0ecc14b63e6c6bc Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Jul 12 2018 14:17:00 +0000 Subject: [PATCH 2/3] Allow using the subscribe to PR API while authenticated in the UI Signed-off-by: Pierre-Yves Chibon --- diff --git a/pagure/api/fork.py b/pagure/api/fork.py index 3cb7311..6fe6569 100644 --- a/pagure/api/fork.py +++ b/pagure/api/fork.py @@ -24,7 +24,7 @@ import pagure.lib.tasks from pagure.api import (API, api_method, api_login_required, APIERROR, get_authorized_api_project, get_request_data) from pagure.config import config as pagure_config -from pagure.utils import is_repo_committer, is_true +from pagure.utils import authenticated, is_repo_committer, is_true _log = logging.getLogger(__name__) @@ -852,7 +852,7 @@ def api_subscribe_pull_request( raise pagure.exceptions.APIError( 404, error_code=APIERROR.EPULLREQUESTSDISABLED) - if flask.g.token and flask.g.token.project \ + if not authenticated() and flask.g.token and flask.g.token.project \ and repo != flask.g.token.project: raise pagure.exceptions.APIError( 401, error_code=APIERROR.EINVALIDTOK) diff --git a/tests/test_pagure_flask_api_fork.py b/tests/test_pagure_flask_api_fork.py index 1442f29..f552382 100644 --- a/tests/test_pagure_flask_api_fork.py +++ b/tests/test_pagure_flask_api_fork.py @@ -1006,11 +1006,11 @@ class PagureFlaskApiForktests(tests.Modeltests): # Valid token, wrong project output = self.app.post( '/api/0/test2/pull-request/1/subscribe', headers=headers) - self.assertEqual(output.status_code, 401) + self.assertEqual(output.status_code, 404) data = json.loads(output.get_data(as_text=True)) - self.assertEqual(pagure.api.APIERROR.EINVALIDTOK.name, + self.assertEqual(pagure.api.APIERROR.ENOREQ.name, data['error_code']) - self.assertEqual(pagure.api.APIERROR.EINVALIDTOK.value, data['error']) + self.assertEqual(pagure.api.APIERROR.ENOREQ.value, data['error']) # No input output = self.app.post( From 0b9b6b7b15c4c5b15f8bfa28d2bb68f9dddf308d Mon Sep 17 00:00:00 2001 From: Pierre-Yves Chibon Date: Jul 12 2018 14:17:00 +0000 Subject: [PATCH 3/3] Prefix the version and error_code API endpoint with -/ This way we're sure there will be no conflict with potential project name since these names aren't blacklisted. We keep the old URL mapping for backward compatibility purposes. Signed-off-by: Pierre-Yves Chibon --- diff --git a/pagure/api/__init__.py b/pagure/api/__init__.py index af5de20..394a33e 100644 --- a/pagure/api/__init__.py +++ b/pagure/api/__init__.py @@ -261,6 +261,7 @@ if pagure_config.get('PAGURE_CI_SERVICES', False): @API.route('/version/') @API.route('/version') +@API.route('/-/version') def api_version(): ''' API Version @@ -269,7 +270,7 @@ def api_version(): :: - GET /api/0/version + GET /api/0/-/version Sample response ^^^^^^^^^^^^^^^ @@ -457,6 +458,7 @@ def api_project_tags(repo, username=None): @API.route('/error_codes/') @API.route('/error_codes') +@API.route('/-/error_codes') def api_error_codes(): ''' Error codes @@ -465,7 +467,7 @@ def api_error_codes(): :: - GET /api/0/error_codes + GET /api/0/-/error_codes Sample response ^^^^^^^^^^^^^^^ diff --git a/tests/test_pagure_flask_api.py b/tests/test_pagure_flask_api.py index 4a9e9fc..dc54ce5 100644 --- a/tests/test_pagure_flask_api.py +++ b/tests/test_pagure_flask_api.py @@ -45,15 +45,22 @@ class PagureFlaskApitests(tests.SimplePagureTest): content_type='application/json'): self.assertEqual(pagure.api.get_request_data()['foo'], 'bar') - def test_api_version(self): + def test_api_version_old_url(self): """ Test the api_version function. """ - output = self.app.get('/api/0/version') self.assertEqual(output.status_code, 200) data = json.loads(output.get_data(as_text=True)) self.assertEqual(data['version'], pagure.__api_version__) self.assertEqual(sorted(data.keys()), ['version']) + def test_api_version_new_url(self): + """ Test the api_version function at its new url. """ + output = self.app.get('/api/0/-/version') + self.assertEqual(output.status_code, 200) + data = json.loads(output.get_data(as_text=True)) + self.assertEqual(data['version'], pagure.__api_version__) + self.assertEqual(sorted(data.keys()), ['version']) + def test_api_project_tags(self): """ Test the api_project_tags function. """ tests.create_projects(self.session)