Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
api = falcon.API(middleware=[
ReqBodyMiddleware(),
])
api.req_options.auto_parse_form_urlencoded = False
self.api = api
self.api.add_route('/login', login)
self.api.add_route('/logout', logout)
self.api.add_route('/dummy/{user}', self.UserDummy())
self.api.add_route('/dummy2/{team}', self.TeamDummy())
self.api = SessionMiddleware(self.api, self.session_opts)
self.user_name = 'test_login_user'
self.admin_name = 'test_login_admin'
self.team_name = 'test_login_team'
connection = db.connect()
cursor = connection.cursor()
# Create users
cursor.execute("INSERT INTO `user` (`name`, `active`) VALUES (%s, 1)", self.user_name)
self.user_id = cursor.lastrowid
cursor.execute("INSERT INTO `user` (`name`, `active`) VALUES (%s, 1)", self.admin_name)
self.admin_id = cursor.lastrowid
# Set up team
cursor.execute("INSERT INTO `team` (`name`) VALUES (%s)", self.team_name)
self.team_id = cursor.lastrowid
cursor.execute("INSERT INTO `team_user` VALUES (%s, %s)", (self.team_id, self.user_id))
cursor.execute("INSERT INTO `team_user` VALUES (%s, %s)", (self.team_id, self.admin_id))
cursor.execute("INSERT INTO `team_admin` VALUES (%s, %s)", (self.team_id, self.admin_id))
connection.commit()
cursor.close()
def tearDown(self):
connection = db.connect()
cursor = connection.cursor()
cursor.execute("DELETE FROM `team` WHERE `name` = %s", self.team_name)
cursor.execute("DELETE FROM `user` WHERE `name` IN %s", ([self.user_name, self.admin_name],))
connection.commit()
cursor.close()
connection.close()
slack_users = {}
for m in slack_members:
if m['name'] == 'slackbot' or m['deleted']:
continue
user_profile = m['profile']
slack_users[m['name']] = {
'name': m['name'],
'full_name': user_profile['real_name'],
'photo_url': user_profile['image_512'],
'email': user_profile['email'],
}
if 'phone' in user_profile:
slack_users[m['name']]['phone'] = normalize_phone_number(user_profile['phone'])
connection = db.connect()
# cache mode ids
cursor = connection.cursor()
cursor.execute('SELECT `id`, `name` FROM `contact_mode`')
mode_ids = {row[1]: row[0] for row in cursor}
cursor.close()
slack_usernames = set(slack_users.viewkeys())
oncall_usernames = set(fetch_oncall_usernames(connection))
users_to_insert = slack_usernames - oncall_usernames
users_to_delete = oncall_usernames - slack_usernames
logger.info('users to insert: %s', users_to_insert)
logger.info('users to delete: %s', users_to_delete)
insert_users(connection, slack_users, users_to_insert, mode_ids)
def on_post(req, resp):
login_info = uri.parse_query_string(req.context['body'])
user = login_info.get('username')
password = login_info.get('password')
if user is None or password is None:
raise HTTPBadRequest('Invalid login attempt', 'Missing user/password')
if not auth_manager.authenticate(user, password):
raise HTTPUnauthorized('Authentication failure', 'bad login credentials', '')
connection = db.connect()
cursor = connection.cursor(db.DictCursor)
data = get_user_data(None, {'name': user}, dbinfo=(connection, cursor))
if not data:
cursor.close()
connection.close()
raise HTTPNotFound()
session = req.env['beaker.session']
session['user'] = user
session.save()
csrf_token = '%x' % SystemRandom().getrandbits(128)
try:
cursor.execute('INSERT INTO `session` (`id`, `csrf_token`) VALUES (%s, %s)',
(req.env['beaker.session']['_id'], csrf_token))
except db.IntegrityError:
raise HTTPBadRequest('Invalid login attempt', 'User already logged in')
def send(self, message):
if time.time() - self.last_auth > self.refresh:
self.authenticate()
connection = db.connect()
cursor = connection.cursor()
try:
cursor.execute('''SELECT `destination` FROM `user_contact`
WHERE `user_id` = (SELECT `id` FROM `user` WHERE `name` = %s)
AND `mode_id` = (SELECT `id` FROM `contact_mode` WHERE `name` = 'rocketchat')''',
message['user'])
if cursor.rowcount == 0:
raise ValueError('Rocketchat username not found for %s' % message['user'])
target = cursor.fetchone()[0]
finally:
cursor.close()
connection.close()
re = requests.post(self.api_host + '/api/v1/chat.postMessage',
json={'channel': '@%s' % target,
'text': ' -- '.join([message['subject'], message['body']])},
headers={'X-User-Id': self.user_id,