Commit 18c63b3b authored by Mickaël Desfrênes's avatar Mickaël Desfrênes
Browse files

harden basic auth for rpc

parent 4994a35a
Loading
Loading
Loading
Loading
+7 −3
Original line number Diff line number Diff line
@@ -128,10 +128,13 @@ def _get_user_from_request(request: HttpRequest) -> Union[User, None]:
            return None
    if "Authorization" in request.headers:
        try:
            auth_header = request.headers["Authorization"]
            if not auth_header.startswith("Basic "):
                raise ValueError("Unsupported authorization scheme")
            auth_u, auth_p = (
                base64.decodebytes(request.headers["Authorization"][6:].encode("utf-8"))
                base64.decodebytes(auth_header[6:].encode("utf-8"))
                .decode("utf-8")
                .split(":")
                .split(":", 1)
            )
            user = authenticate(username=auth_u, password=auth_p)
            if not user:
@@ -139,7 +142,7 @@ def _get_user_from_request(request: HttpRequest) -> Union[User, None]:
                    "Authorization was given in request headers but user was not authenticated"
                )
            return user
        except KeyError:
        except (KeyError, ValueError, UnicodeDecodeError, binascii.Error):
            logger.warning("Authorization was malformed")
            return None
    return None
@@ -478,6 +481,7 @@ def download_metas_xls(request: HttpRequest, collection_id):
    wb = Workbook()
    ws = wb.active
    row_number = 2  # /!\ Index starts at 1. Leave the first row for headers.
    r = {}
    for r in collection_instance.yield_resource_data_for_export():
        col_number = 1
        for value in r.values():