1
=== modified file 'lib/canonical/launchpad/browser/oauth.py'
2
--- lib/canonical/launchpad/browser/oauth.py	2010-03-30 15:36:27 +0000
3
+++ lib/canonical/launchpad/browser/oauth.py	2010-07-13 15:48:51 +0000
4
@@ -245,15 +245,23 @@
5
245
        token = consumer.getRequestToken(form.get('oauth_token'))
245
        token = consumer.getRequestToken(form.get('oauth_token'))
6
246
        if token is None:
246
        if token is None:
7
247
            self.request.unauthorized(OAUTH_CHALLENGE)
247
            self.request.unauthorized(OAUTH_CHALLENGE)
9
248
            return u''
248
            return u'No request token specified.'
10
249
249
11
250
        if not check_oauth_signature(self.request, consumer, token):
250
        if not check_oauth_signature(self.request, consumer, token):
13
251
            return u''
251
            return u'Invalid OAuth signature.'
14
252
252
17
253
        if (not token.is_reviewed
253
        if not token.is_reviewed:
16
254
            or token.permission == OAuthPermission.UNAUTHORIZED):
18
255
            self.request.unauthorized(OAUTH_CHALLENGE)
254
            self.request.unauthorized(OAUTH_CHALLENGE)
20
256
            return u''
255
            return u'Request token has not yet been reviewed. Try again later.'
21
256
22
257
        if token.permission == OAuthPermission.UNAUTHORIZED:
23
258
            # The end-user explicitly refused to authorize this
24
259
            # token. We send 403 ("Forbidden") instead of 401
25
260
            # ("Unauthorized") to distinguish this case and to
26
261
            # indicate that, as RFC2616 says, "authorization will not
27
262
            # help."
28
263
            self.request.response.setStatus(403)
29
264
            return u'End-user refused to authorize request token.'
30
257
265
31
258
        access_token = token.createAccessToken()
266
        access_token = token.createAccessToken()
32
259
        context_name = None
267
        context_name = None
33
260
268
34
=== modified file 'lib/canonical/launchpad/pagetests/oauth/access-token.txt'
35
--- lib/canonical/launchpad/pagetests/oauth/access-token.txt	2009-10-22 13:02:12 +0000
36
+++ lib/canonical/launchpad/pagetests/oauth/access-token.txt	2010-07-13 15:48:51 +0000
37
@@ -74,9 +74,10 @@
38
74
    ... """ % urlencode(data2))
74
    ... """ % urlencode(data2))
39
75
    HTTP/1.1 401 Unauthorized
75
    HTTP/1.1 401 Unauthorized
40
76
    ...
76
    ...
41
77
    Request token has not yet been reviewed. Try again later.
42
77
78
45
78
The same will happen if the signature is wrong or if the token's
79
If the token is missing or the signature is wrong the response will
46
79
permission is UNAUTHORIZED.
80
also be 401.
47
80
81
48
81
    >>> data2['oauth_signature'] = '&'.join(['foobar', token.secret])
82
    >>> data2['oauth_signature'] = '&'.join(['foobar', token.secret])
49
82
    >>> print http(r"""
83
    >>> print http(r"""
50
@@ -85,6 +86,22 @@
51
85
    ... """ % urlencode(data2))
86
    ... """ % urlencode(data2))
52
86
    HTTP/1.1 401 Unauthorized
87
    HTTP/1.1 401 Unauthorized
53
87
    ...
88
    ...
54
89
    Invalid OAuth signature.
55
90
56
91
    >>> data3 = data.copy()
57
92
    >>> del(data3['oauth_token'])
58
93
    >>> print http(r"""
59
94
    ... GET /+access-token?%s HTTP/1.1
60
95
    ... Host: launchpad.dev
61
96
    ... """ % urlencode(data3))
62
97
    HTTP/1.1 401 Unauthorized
63
98
    ...
64
99
    No request token specified.
65
100
66
101
It the token's permission is set to UNAUTHORIZED, the response code is
67
102
403 ("Forbidden"). This conveys that (to quote the HTTP RFC)
68
103
"authorization will not help" and that the token will _never_ be
69
104
exchanged for an access token.
70
88
105
71
89
    >>> token.review(salgado, OAuthPermission.UNAUTHORIZED)
106
    >>> token.review(salgado, OAuthPermission.UNAUTHORIZED)
72
90
    >>> data2['oauth_signature'] = '&'.join([consumer.secret, token.secret])
107
    >>> data2['oauth_signature'] = '&'.join([consumer.secret, token.secret])
73
@@ -92,6 +109,7 @@
74
92
    ... GET /+access-token?%s HTTP/1.1
109
    ... GET /+access-token?%s HTTP/1.1
75
93
    ... Host: launchpad.dev
110
    ... Host: launchpad.dev
76
94
    ... """ % urlencode(data2))
111
    ... """ % urlencode(data2))
78
95
    HTTP/1.1 401 Unauthorized
112
    HTTP/1.1 403 Forbidden
79
96
    ...
113
    ...
80
114
    End-user refused to authorize request token.
81
97
115
Status:	Merged
Merge reported by:	Leonard Richardson
Merged at revision:	not available
Proposed branch:	lp:~leonardr/launchpad/distinguish-between-unauthorized-and-forbidden
Merge into:	lp:launchpad/db-devel
Diff against target:	80 lines (+34/-8) 2 files modified lib/canonical/launchpad/browser/oauth.py (+13/-5) lib/canonical/launchpad/pagetests/oauth/access-token.txt (+21/-3)
To merge this branch:	bzr merge lp:~leonardr/launchpad/distinguish-between-unauthorized-and-forbidden
Related bugs:	Link a bug report
Reviewer	Review Type	Date Requested	Status
Guilherme Salgado (community)		2010-07-13	Approve on 2010-07-13
Review via email: mp+29803@code.launchpad.net