From ae3d4897a49e971ec2c2f1496efe4da4d7c5f90a Mon Sep 17 00:00:00 2001 From: Max Goodman Date: Tue, 24 Apr 2012 16:52:15 -0700 Subject: [PATCH] Remove unnecessary VUrl checks from OAuth2 redirect_uri. This was clashing with some submit-specific code in VUrl. It's safe to remove this validator since we use strict equality checks on redirect_uri wherever it's used. --- r2/r2/controllers/errors.py | 1 + r2/r2/controllers/oauth2.py | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/r2/r2/controllers/errors.py b/r2/r2/controllers/errors.py index 7fec8eb48..7803c17bf 100644 --- a/r2/r2/controllers/errors.py +++ b/r2/r2/controllers/errors.py @@ -90,6 +90,7 @@ error_list = dict(( ('TOO_MUCH_FLAIR_CSS', _('too many flair css classes')), ('BAD_FLAIR_TARGET', _('not a valid flair target')), ('OAUTH2_INVALID_CLIENT', _('invalid client id')), + ('OAUTH2_INVALID_REDIRECT_URI', _('invalid redirect_uri parameter')), ('OAUTH2_ACCESS_DENIED', _('access denied by the user')), ('CONFIRM', _("please confirm the form")), ('NO_API', _('cannot perform this action via the API')), diff --git a/r2/r2/controllers/oauth2.py b/r2/r2/controllers/oauth2.py index dd9e727c0..d71131aef 100644 --- a/r2/r2/controllers/oauth2.py +++ b/r2/r2/controllers/oauth2.py @@ -32,7 +32,7 @@ from r2.lib.db.thing import NotFound from r2.models import Account from r2.models.oauth2 import OAuth2Client, OAuth2AuthorizationCode, OAuth2AccessToken from r2.controllers.errors import errors -from validator import validate, VRequired, VOneOf, VUrl, VUser, VModhash +from validator import validate, VRequired, VOneOf, VUser, VModhash from r2.lib.pages import OAuth2AuthorizationPage from r2.lib.require import RequirementException, require, require_split @@ -85,7 +85,7 @@ class OAuth2FrontendController(RedditController): @validate(VUser(), response_type = VOneOf("response_type", ("code",)), client = VClientID(), - redirect_uri = VUrl("redirect_uri", allow_self=False, lookup=False), + redirect_uri = VRequired("redirect_uri", errors.OAUTH2_INVALID_REDIRECT_URI), scope = VOneOf("scope", scope_info.keys()), state = VRequired("state", errors.NO_TEXT)) def GET_authorize(self, response_type, client, redirect_uri, scope, state): @@ -123,7 +123,7 @@ class OAuth2FrontendController(RedditController): @validate(VUser(), VModhash(fatal=False), client = VClientID(), - redirect_uri = VUrl("redirect_uri", allow_self=False, lookup=False), + redirect_uri = VRequired("redirect_uri", errors.OAUTH2_INVALID_REDIRECT_URI), scope = VOneOf("scope", scope_info.keys()), state = VRequired("state", errors.NO_TEXT), authorize = VRequired("authorize", errors.OAUTH2_ACCESS_DENIED)) @@ -170,7 +170,7 @@ class OAuth2AccessController(MinimalController): @validate(grant_type = VOneOf("grant_type", ("authorization_code",)), code = VRequired("code", errors.NO_TEXT), - redirect_uri = VUrl("redirect_uri", allow_self=False, lookup=False)) + redirect_uri = VRequired("redirect_uri", errors.OAUTH2_INVALID_REDIRECT_URI)) def POST_access_token(self, grant_type, code, redirect_uri): """ Exchange an [OAuth 2.0](http://oauth.net/2/) authorization code