arona/PyRIGS
1
0
Fork 0
mirror of https://github.com/nottinghamtec/PyRIGS.git synced 2026-01-21 15:32:14 +00:00
Code Issues Projects Releases Wiki Activity

More fiddling with auth

Browse Source
This commit is contained in:
FreneticScribbler
2023-06-27 00:42:22 +01:00
parent 63eb3bebef
commit 55aa41acfd
1 changed files with 12 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
RIGS/views/rigboard.py
View File

@@ -5,6 +5,7 @@ import premailer
import simplejson import simplejson
import urllib import urllib
import hmac import hmac
import hashlib
from envparse import env from envparse import env
from bs4 import BeautifulSoup from bs4 import BeautifulSoup
@@ -408,13 +409,15 @@ class RecieveForumWebhook(generic.View):
return super().dispatch(request, *args, **kwargs) return super().dispatch(request, *args, **kwargs)
def post(self, request, *args, **kwargs): def post(self, request, *args, **kwargs):
computed = f"sha256={hmac.new(env('FORUM_WEBHOOK_SECRET').encode(), request.body, digestmod='sha256').hexdigest()}" hmac = hmac.new(env('FORUM_WEBHOOK_SECRET').encode(), request.body, hashlib.sha256).hexdigest()
if request.POST.get('X-Discourse-Event-Signature') == computed: # and request.POST.get('X-Discourse-Event') == "topic_created": computed = f"sha256={hmac}"
body = json.loads(request.body.decode('utf-8')) if not hmac.compare_digest(request.POST.get('X-Discourse-Event-Signature'), computed):
event_id = int(body['title'][1:5]) # find the ID, force convert it to an int to eliminate leading zeros return HttpResponseForbidden('Invalid signature header')
event = models.Event.objects.filter(pk=event_id).first() body = json.loads(request.body.decode('utf-8'))
if event: event_id = int(body['title'][1:5]) # find the ID, force convert it to an int to eliminate leading zeros
event.forum_url = "https://forum.nottinghamtec.co.uk/t/{}" event = models.Event.objects.filter(pk=event_id).first()
event.save() if event:
return HttpResponse(status=200) event.forum_url = "https://forum.nottinghamtec.co.uk/t/{}"
event.save()
return HttpResponse(status=202)
return HttpResponse(status=204) return HttpResponse(status=204)