Skip to content

Hardening: Remove User.api_v2_token property (returns plaintext API token) #3057

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
hanu-14 wants to merge 1 commit into
base: main
Choose a base branch
from
+2 −11
Open

Hardening: Remove User.api_v2_token property (returns plaintext API token) #3057

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion apps/downloads/tests/test_views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
from apps.pages.factories import PageFactory
from apps.users.factories import UserFactory
from pydotorg.drf import BaseAPITestCase
from rest_framework.authtoken.models import Token

Comment on lines 18 to 20
User = get_user_model()

Expand Down Expand Up @@ -179,7 +180,7 @@ def setUp(self):
password="passworduser",
is_staff=True,
)
self.Authorization = f"Token {self.staff_user.api_v2_token}"
self.Authorization = f"Token {Token.objects.get(user=self.staff_user).key}"
self.Authorization_invalid = "Token invalid-token"

def get_json(self, response):
Expand Down
10 changes: 0 additions & 10 deletions apps/users/models.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,6 @@
from django.urls import reverse
from django.utils import timezone
from markupfield.fields import MarkupField
from rest_framework.authtoken.models import Token
from tastypie.models import create_api_key

from apps.users.managers import UserManager
Expand Down Expand Up @@ -73,15 +72,6 @@ def sponsorships(self):

return Sponsorship.objects.visible_to(self)

@property
def api_v2_token(self):
"""Return the user's DRF API token key, or empty string if none exists."""
try:
return Token.objects.get(user=self).key
except Token.DoesNotExist:
return ""


models.signals.post_save.connect(create_api_key, sender=User)


Expand Down