mirror of
https://github.com/kennethreitz-archive/www.gittip.com.git
synced 2026-06-21 15:50:59 +00:00
Chad Whitacre
28cb48c72a
I sort of did this one with the blast shield down. I haven't even run
the tests yet. The sorts of things I changed:
- SQL {elsewhere,exchanges}.participant_id => .participant
- SQL participants.id => .username
- ORM {user,participant,self}.id => .username
45 lines
1.3 KiB
HTML
45 lines
1.3 KiB
HTML
from aspen import Response
|
|
from gittip.elsewhere.bitbucket import BitbucketAccount
|
|
from gittip.elsewhere.github import GitHubAccount
|
|
from gittip.elsewhere.twitter import TwitterAccount
|
|
|
|
# ====== ^L
|
|
if user.ANON or not POST:
|
|
raise Response(404)
|
|
|
|
platform = body['platform']
|
|
if platform not in ('github', 'twitter', 'bitbucket'):
|
|
raise Response(400, "bad platform: %s" % platform)
|
|
|
|
user_id = body['user_id']
|
|
if not user_id:
|
|
raise Response(400, "no user_id")
|
|
|
|
|
|
# Look for a connect_token.
|
|
# =========================
|
|
# CSRF isn't enough to protect against unauthorized take_overs. Someone need
|
|
# only find their own CSRF header and use that. We need a token specific to the
|
|
# connection request.
|
|
|
|
connect_key = (user.username, platform, user_id)
|
|
expected = website.connect_tokens.pop(connect_key, None)
|
|
actual = body.get('connect_token')
|
|
if expected is None or actual != expected:
|
|
msg = str("Is %s gaming us? %s:%s" % (user.username, expected, actual))
|
|
raise Response(400, msg)
|
|
|
|
|
|
if platform == 'bitbucket':
|
|
Account = BitbucketAccount
|
|
elif platform == 'github':
|
|
Account = GitHubAccount
|
|
elif platform == 'twitter':
|
|
Account = TwitterAccount
|
|
|
|
account = Account(user_id)
|
|
user.take_over(account, have_confirmation=True)
|
|
request.redirect('/about/me.html')
|
|
|
|
# ====== ^L
|