
from __future__ import unicode_literals

from web.auth import authenticate, deauthenticate
from web.core import config, url
from web.core.http import HTTPFound

from brave.api.client import API


log = __import__('logging').getLogger(__name__)


class AuthenticationMixIn(object):
    def authorize(self):
        # Perform the initial API call and direct the user.
        
        api = API(config['api.endpoint'], config['api.identity'], config['api.private'], config['api.public'])
        
        success = str(url.complete('/authorized'))
        failure = str(url.complete('/nolove'))
        
        result = api.core.authorize(success=success, failure=failure)
        
        raise HTTPFound(location=result.location)
    
    def ciao(self):
        deauthenticate(True)
        
        raise HTTPFound(location='/')
    
    def authorized(self, token):
        # Capture the returned token and use it to look up the user details.
        # If we don't have this character, create them.
        # Store the token against this user account.
        # Note that our own 'sessions' may not last beyond the UTC date returned as 'expires'.
        # (Though they can be shorter!)
        
        # We request an authenticated session from the server.
        
        authenticate(token)
        
        raise HTTPFound(location='/')
    
    def nolove(self, token):
        return 'sound.irc.template.whynolove', dict()


from __future__ import unicode_literals

from web.auth import authenticate, deauthenticate
from web.core import config, url, session
from web.core.http import HTTPFound

from brave.api.client import API


log = __import__('logging').getLogger(__name__)


class AuthenticationMixIn(object):
    def authorize(self):
        # Perform the initial API call and direct the user.
        
        api = API(config['api.endpoint'], config['api.identity'], config['api.private'], config['api.public'])
        
        success = str(url.complete('/authorized'))
        failure = str(url.complete('/nolove'))
        
        result = api.core.authorize(success=success, failure=failure)
        
        raise HTTPFound(location=result.location)
    
    def ciao(self):
        deauthenticate(True)
        
        raise HTTPFound(location='/')
    
    def authorized(self, token):
        # Capture the returned token and use it to look up the user details.
        # If we don't have this character, create them.
        # Store the token against this user account.
        # Note that our own 'sessions' may not last beyond the UTC date returned as 'expires'.
        # (Though they can be shorter!)
        
        # Prevent users from specifying their session IDs (Some user-agents were sending null ids, leading to users
        # authenticated with a session id of null
        session.regenerate_id()

        # We request an authenticated session from the server.
        
        authenticate(token)
        
        raise HTTPFound(location='/')
    
    def nolove(self, token):
        return 'sound.irc.template.whynolove', dict()

Fix a bug where user-agents could specify their own session ID.
Fix a bug where user-agents could specify their own session ID.

  
  from __future__ import unicode_literals
  
  from web.auth import authenticate, deauthenticate
- from web.core import config, url
+ from web.core import config, url, session
  from web.core.http import HTTPFound
  
  from brave.api.client import API
  
  
  log = __import__('logging').getLogger(__name__)
  
  
  class AuthenticationMixIn(object):
      def authorize(self):
          # Perform the initial API call and direct the user.
          
          api = API(config['api.endpoint'], config['api.identity'], config['api.private'], config['api.public'])
          
          success = str(url.complete('/authorized'))
          failure = str(url.complete('/nolove'))
          
          result = api.core.authorize(success=success, failure=failure)
          
          raise HTTPFound(location=result.location)
      
      def ciao(self):
          deauthenticate(True)
          
          raise HTTPFound(location='/')
      
      def authorized(self, token):
          # Capture the returned token and use it to look up the user details.
          # If we don't have this character, create them.
          # Store the token against this user account.
          # Note that our own 'sessions' may not last beyond the UTC date returned as 'expires'.
          # (Though they can be shorter!)
          
+         # Prevent users from specifying their session IDs (Some user-agents were sending null ids, leading to users
+         # authenticated with a session id of null
+         session.regenerate_id()
+ 
          # We request an authenticated session from the server.
          
          authenticate(token)
          
          raise HTTPFound(location='/')
      
      def nolove(self, token):
          return 'sound.irc.template.whynolove', dict()
  
Fix a bug where user-agents could specify their own session ID.
## Code Before:

from __future__ import unicode_literals

from web.auth import authenticate, deauthenticate
from web.core import config, url
from web.core.http import HTTPFound

from brave.api.client import API


log = __import__('logging').getLogger(__name__)


class AuthenticationMixIn(object):
    def authorize(self):
        # Perform the initial API call and direct the user.
        
        api = API(config['api.endpoint'], config['api.identity'], config['api.private'], config['api.public'])
        
        success = str(url.complete('/authorized'))
        failure = str(url.complete('/nolove'))
        
        result = api.core.authorize(success=success, failure=failure)
        
        raise HTTPFound(location=result.location)
    
    def ciao(self):
        deauthenticate(True)
        
        raise HTTPFound(location='/')
    
    def authorized(self, token):
        # Capture the returned token and use it to look up the user details.
        # If we don't have this character, create them.
        # Store the token against this user account.
        # Note that our own 'sessions' may not last beyond the UTC date returned as 'expires'.
        # (Though they can be shorter!)
        
        # We request an authenticated session from the server.
        
        authenticate(token)
        
        raise HTTPFound(location='/')
    
    def nolove(self, token):
        return 'sound.irc.template.whynolove', dict()

## Instruction:
Fix a bug where user-agents could specify their own session ID.
## Code After:

from __future__ import unicode_literals

from web.auth import authenticate, deauthenticate
from web.core import config, url, session
from web.core.http import HTTPFound

from brave.api.client import API


log = __import__('logging').getLogger(__name__)


class AuthenticationMixIn(object):
    def authorize(self):
        # Perform the initial API call and direct the user.
        
        api = API(config['api.endpoint'], config['api.identity'], config['api.private'], config['api.public'])
        
        success = str(url.complete('/authorized'))
        failure = str(url.complete('/nolove'))
        
        result = api.core.authorize(success=success, failure=failure)
        
        raise HTTPFound(location=result.location)
    
    def ciao(self):
        deauthenticate(True)
        
        raise HTTPFound(location='/')
    
    def authorized(self, token):
        # Capture the returned token and use it to look up the user details.
        # If we don't have this character, create them.
        # Store the token against this user account.
        # Note that our own 'sessions' may not last beyond the UTC date returned as 'expires'.
        # (Though they can be shorter!)
        
        # Prevent users from specifying their session IDs (Some user-agents were sending null ids, leading to users
        # authenticated with a session id of null
        session.regenerate_id()

        # We request an authenticated session from the server.
        
        authenticate(token)
        
        raise HTTPFound(location='/')
    
    def nolove(self, token):
        return 'sound.irc.template.whynolove', dict()
