SHARE
TWEET

Untitled

a guest May 25th, 2019 112 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. from builtins import Exception
  2.  
  3. import base64
  4. from django.http import HttpResponse
  5. from functools import wraps
  6.  
  7. from app.logger import EmployeeLogger
  8.  
  9.  
  10. def http_basic_auth(func):
  11.     @wraps(func)
  12.     def _decorator(request, *args, **kwargs):
  13.         if 'HTTP_AUTHORIZATION' in request.META:
  14.             allowed_users = {
  15.                 'helloworld': 'VrDlKsoRlluYuQkoFIdcYoFS9w1XCT47',
  16.             }
  17.             read_only_users = [
  18.  
  19.             ]
  20.             authmeth, auth = request.META['HTTP_AUTHORIZATION'].split(' ', 1)
  21.             if authmeth.lower() == 'basic':
  22.                 try:
  23.                     auth = base64.b64decode(auth).decode()
  24.                 except Exception as e:
  25.                     EmployeeLogger.log("http_basic_auth() - error decoding base64 auth string: {0}".format(e))
  26.                     return HttpResponse(status=400, reason="Authorization string does not decode")
  27.                 username, password = auth.split(':', 1)
  28.                 EmployeeLogger.log('http_basic_auth() - username: {0}'.format(username))
  29.                 if username in allowed_users and password == allowed_users[username]:
  30.                     EmployeeLogger.log("http_basic_auth() - user {0} authenticated".format(username))
  31.                     EmployeeLogger.log(
  32.                         "http_basic_auth() - calling function '{0}' with request method {1}".format(func.__name__,
  33.                                                                                                     request.method))
  34.                     # Handle read-only users
  35.                     if username in read_only_users:
  36.                         # Allow access to any API using the GET method
  37.                         if request.method == 'GET':
  38.                             pass
  39.                         # Allow access to the members_get_or_update API using the POST method (it's read-only)
  40.                         elif request.method == 'POST':
  41.                             pass
  42.                         # Otherwise deny access
  43.                         else:
  44.                             EmployeeLogger.log(
  45.                                 "http_basic_auth() - read-only user '{}' not authorized to access '{}' with method '{}'".format(
  46.                                     username, func.__name__, request.method))
  47.                             return HttpResponse(status=401, reason="Read only user not authorized")
  48.  
  49.                     return func(request, *args, **kwargs)
  50.                 else:
  51.                     EmployeeLogger.log("http_basic_auth() - user {0} failed authentication".format(username))
  52.         response = HttpResponse(status=401)
  53.         return response
  54.  
  55.     return _decorator
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top