Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
base_url="http://localhost",
roles="Instructor",
headers=None,
):
params = {}
if roles is not None:
params["roles"] = roles
urlparams = urlencode(params)
client = oauthlib.oauth1.Client(
"key",
client_secret="secret",
signature_method=oauthlib.oauth1.SIGNATURE_HMAC,
signature_type=oauthlib.oauth1.SIGNATURE_TYPE_QUERY,
)
signature = client.sign(
"{}{}?{}".format(base_url, url, urlparams),
body=body,
http_method=http_method,
headers=headers,
)
signed_url = signature[0]
new_url = signed_url[len(base_url) :]
return new_url
def test_replaceResult(self):
sourced_id = self.mk_sourced_id(self.lti_exercise, enrollment=self.student1_enrollment)
req_xml = self.BASE_OUTCOMES_REQUEST_XML.format(
msg_id='fudyhsgysywe374628mfgu',
operation='replaceResult',
sourced_id=sourced_id,
result=self.BASE_RESULT_XML.format(score='0.71'),
)
# OAuth1 signature and body hash for the HTTP request Authorization header
oauth_client = oauthlib.oauth1.Client(
client_key=self.lti_service.consumer_key,
client_secret=self.lti_service.consumer_secret,
signature_method=oauthlib.oauth1.SIGNATURE_HMAC,
signature_type=oauthlib.oauth1.SIGNATURE_TYPE_AUTH_HEADER,
)
oa_uri, oa_headers, oa_body = oauth_client.sign('http://aplus.local/api/v2/lti-outcomes',
http_method='POST',
body=req_xml,
headers={
'Content-Type': 'application/xml',
},
)
# make the test request
response = self.client.post(self.OUTCOMES_API_URL, data=req_xml, content_type='application/xml',
HTTP_AUTHORIZATION=oa_headers['Authorization'],
def test_replaceResult(self):
sourced_id = self.mk_sourced_id(self.lti_exercise, enrollment=self.student1_enrollment)
req_xml = self.BASE_OUTCOMES_REQUEST_XML.format(
msg_id='fudyhsgysywe374628mfgu',
operation='replaceResult',
sourced_id=sourced_id,
result=self.BASE_RESULT_XML.format(score='0.71'),
)
# OAuth1 signature and body hash for the HTTP request Authorization header
oauth_client = oauthlib.oauth1.Client(
client_key=self.lti_service.consumer_key,
client_secret=self.lti_service.consumer_secret,
signature_method=oauthlib.oauth1.SIGNATURE_HMAC,
signature_type=oauthlib.oauth1.SIGNATURE_TYPE_AUTH_HEADER,
)
oa_uri, oa_headers, oa_body = oauth_client.sign('http://aplus.local/api/v2/lti-outcomes',
http_method='POST',
body=req_xml,
headers={
'Content-Type': 'application/xml',
},
)
# make the test request
response = self.client.post(self.OUTCOMES_API_URL, data=req_xml, content_type='application/xml',
HTTP_AUTHORIZATION=oa_headers['Authorization'],
SERVER_NAME='aplus.local')
response_xml = response.content.decode('utf-8')
root = lxml.etree.fromstring(response_xml.encode('utf-8'))
response_msg_id = root.findtext('{ns}imsx_POXHeader/{ns}imsx_POXResponseHeaderInfo/{ns}imsx_messageIdentifier'.format(
def oauth_headers(url, consumer_key, token_key, token_secret, consumer_secret,
timestamp=None):
try:
import oauthlib.oauth1 as oauth1
except ImportError:
raise NotImplementedError('oauth support is not available')
if timestamp:
timestamp = str(timestamp)
else:
timestamp = None
client = oauth1.Client(
consumer_key,
client_secret=consumer_secret,
resource_owner_key=token_key,
resource_owner_secret=token_secret,
signature_method=oauth1.SIGNATURE_PLAINTEXT,
timestamp=timestamp)
_uri, signed_headers, _body = client.sign(url)
return signed_headers
def _get_oauth_headers(self, url):
client = oauth1.Client(
CONF.maas_oauth_consumer_key,
client_secret=CONF.maas_oauth_consumer_secret,
resource_owner_key=CONF.maas_oauth_token_key,
resource_owner_secret=CONF.maas_oauth_token_secret,
signature_method=oauth1.SIGNATURE_PLAINTEXT)
realm = _Realm("")
headers = client.sign(url, realm=realm)[1]
return headers
try:
import oauthlib.oauth1 as oauth1
except ImportError:
raise NotImplementedError('oauth support is not available')
if timestamp:
timestamp = str(timestamp)
else:
timestamp = None
client = oauth1.Client(
consumer_key,
client_secret=consumer_secret,
resource_owner_key=token_key,
resource_owner_secret=token_secret,
signature_method=oauth1.SIGNATURE_PLAINTEXT,
timestamp=timestamp)
_uri, signed_headers, _body = client.sign(url)
return signed_headers
try:
import oauthlib.oauth1 as oauth1
except ImportError:
raise NotImplementedError('oauth support is not available')
if timestamp:
timestamp = str(timestamp)
else:
timestamp = None
client = oauth1.Client(
consumer_key,
client_secret=consumer_secret,
resource_owner_key=token_key,
resource_owner_secret=token_secret,
signature_method=oauth1.SIGNATURE_PLAINTEXT,
timestamp=timestamp)
_uri, signed_headers, _body = client.sign(url)
return signed_headers
import commonware.log
from oauthlib import oauth1
from oauthlib.common import safe_string_equals
from amo.decorators import login_required
from amo.utils import urlparams
from mkt.api.models import Access, Nonce, Token, REQUEST_TOKEN, ACCESS_TOKEN
DUMMY_CLIENT_KEY = u'DummyOAuthClientKeyString'
DUMMY_TOKEN = u'DummyOAuthToken'
DUMMY_SECRET = u'DummyOAuthSecret'
log = commonware.log.getLogger('z.api')
class OAuthServer(oauth1.Server):
safe_characters = set(string.printable)
nonce_length = (7, 128)
access_token_length = (8, 128)
request_token_length = (8, 128)
verifier_length = (8, 128)
client_key_length = (8, 128)
enforce_ssl = False # SSL enforcement is handled by ops. :-)
def validate_client_key(self, key):
self.attempted_key = key
return Access.objects.filter(key=key).exists()
def get_client_secret(self, key):
# This method returns a dummy secret on failure so that auth
# success and failure take a codepath with the same run time,
# to prevent timing attacks.
def __init__(self, client_key, client_secret, content_base, metadata_base):
self.session = oauth1.Client(client_key, client_secret=client_secret)
self.content_base = content_base
self.metadata_base = metadata_base
def _get_oauth_headers(self, url):
client = oauth1.Client(
CONF.maas_oauth_consumer_key,
client_secret=CONF.maas_oauth_consumer_secret,
resource_owner_key=CONF.maas_oauth_token_key,
resource_owner_secret=CONF.maas_oauth_token_secret,
signature_method=oauth1.SIGNATURE_PLAINTEXT)
realm = _Realm("")
headers = client.sign(url, realm=realm)[1]
return headers