spla/Mastodonplus.py
1
0
Fork 0
Codi Incidències Sol·licituds Pull repo.project Llançaments Paquets Wiki Activitat

log_in(): check if granted scopes are a superset of requested

Explorar la Font 
Currently, Pleroma does not actually have scopes, but grants "read write
follow" in all cases. For compatibility, log_in() now checks if the
granted scopes include all of the requested scopes, instead of checking
if they match exactly.
This commit is contained in:
D Anzorge 2018-06-26 14:48:59 +02:00
pare e1891a1fed
commit 4319283bcd
S'han modificat 1 arxius amb 6 adicions i 6 eliminacions
Mostrar estadístiques Descarregar el fitxer de pedaç Descarregar el fitxer de diferències Expand all files Collapse all files

12
mastodon/Mastodon.py
Veure arxiu

@ -342,8 +342,9 @@ class Mastodon:
Handles password and OAuth-based authorization. Handles password and OAuth-based authorization.
Will throw a `MastodonIllegalArgumentError` if username / password Will throw a `MastodonIllegalArgumentError` if the OAuth or the
are wrong, scopes are not valid or granted scopes differ from requested. username / password credentials given are incorrect, and
`MastodonAPIError` if all of the requested scopes were not granted.
For OAuth2 documentation, compare For OAuth2 documentation, compare
https://github.com/doorkeeper-gem/doorkeeper/wiki/Interacting-as-an-OAuth-client-with-Doorkeeper https://github.com/doorkeeper-gem/doorkeeper/wiki/Interacting-as-an-OAuth-client-with-Doorkeeper
@ -379,12 +380,11 @@ class Mastodon:
else: else:
raise MastodonIllegalArgumentError('Invalid request: %s' % e) raise MastodonIllegalArgumentError('Invalid request: %s' % e)
requested_scopes = " ".join(sorted(scopes)) received_scopes = response["scope"].split(" ")
received_scopes = " ".join(sorted(response["scope"].split(" ")))
if requested_scopes != received_scopes: if not set(scopes) <= set(received_scopes):
raise MastodonAPIError( raise MastodonAPIError(
'Granted scopes "' + received_scopes + '" differ from requested scopes "' + requested_scopes + '".') 'Granted scopes "' + " ".join(received_scopes) + '" do not contain all of the requested scopes "' + " ".join(scopes) + '".')
if to_file is not None: if to_file is not None:
with open(to_file, 'w') as token_file: with open(to_file, 'w') as token_file: