mirror of
https://github.com/kennethreitz-archive/www.gittip.com.git
synced 2026-06-21 15:50:59 +00:00
Chad Whitacre
31035e3e81
I tested connecting a Bitbucket account to an existing account in both merge and non-merge cases. I need to look at signing in using Bitbucket in the first place, making sure we have links in all the right places.
45 lines
1.3 KiB
HTML
45 lines
1.3 KiB
HTML
from aspen import Response
|
|
from gittip.elsewhere.bitbucket import BitbucketAccount
|
|
from gittip.elsewhere.github import GitHubAccount
|
|
from gittip.elsewhere.twitter import TwitterAccount
|
|
|
|
# ====== ^L
|
|
if user.ANON or not POST:
|
|
raise Response(404)
|
|
|
|
platform = body['platform']
|
|
if platform not in ('github', 'twitter', 'bitbucket'):
|
|
raise Response(400, "bad platform: %s" % platform)
|
|
|
|
user_id = body['user_id']
|
|
if not user_id:
|
|
raise Response(400, "no user_id")
|
|
|
|
|
|
# Look for a connect_token.
|
|
# =========================
|
|
# CSRF isn't enough to protect against unauthorized take_overs. Someone need
|
|
# only find their own CSRF header and use that. We need a token specific to the
|
|
# connection request.
|
|
|
|
connect_key = (user.id, platform, user_id)
|
|
expected = website.connect_tokens.pop(connect_key, None)
|
|
actual = body.get('connect_token')
|
|
if expected is None or actual != expected:
|
|
msg = str("Is %s gaming us? %s:%s" % (user.id, expected, actual))
|
|
raise Response(400, msg)
|
|
|
|
|
|
if platform == 'bitbucket':
|
|
Account = BitbucketAccount
|
|
elif platform == 'github':
|
|
Account = GitHubAccount
|
|
elif platform == 'twitter':
|
|
Account = TwitterAccount
|
|
|
|
account = Account(user_id)
|
|
user.take_over(account, have_confirmation=True)
|
|
request.redirect('/about/me.html')
|
|
|
|
# ====== ^L
|