hazza/jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/jupyterhub.git synced 2025-10-18 07:23:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed scope checking in UserTokenListAPIHandler

Browse Source
This commit is contained in:
0mar
2021-04-20 14:55:36 +02:00
parent b9958e9069
commit 399203e5d3
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
jupyterhub/apihandlers/users.py
View File

@@ -301,7 +301,6 @@ class UserTokenListAPIHandler(APIHandler):
self.write(json.dumps({'api_tokens': api_tokens})) self.write(json.dumps({'api_tokens': api_tokens}))
# @needs_scope('users:tokens') #Todo: needs internal scope checking
async def post(self, user_name): async def post(self, user_name):
body = self.get_json_body() or {} body = self.get_json_body() or {}
if not isinstance(body, dict): if not isinstance(body, dict):
@@ -330,13 +329,16 @@ class UserTokenListAPIHandler(APIHandler):
if requester is None: if requester is None:
# couldn't identify requester # couldn't identify requester
raise web.HTTPError(403) raise web.HTTPError(403)
self._jupyterhub_user = requester
self._resolve_scopes()
user = self.find_user(user_name) user = self.find_user(user_name)
if requester is not user and not requester.admin: kind = 'user' if isinstance(requester, User) else 'service'
raise web.HTTPError(403, "Only admins can request tokens for other users") scope_filter = self.get_scope_filter('users:tokens')
if not user: if user is None or not scope_filter(user, kind):
raise web.HTTPError(404, "No such user: %s" % user_name) raise web.HTTPError(
if requester is not user: 404,
kind = 'user' if isinstance(requester, User) else 'service' f"{kind.title()} {user_name} not found or no permissions to generate tokens",
)
note = body.get('note') note = body.get('note')
if not note: if not note:

2
jupyterhub/tests/test_api.py
View File

@@ -1311,7 +1311,7 @@ async def test_get_new_token(app, headers, status, note, expires_in):
[ [
('admin', 'other', 200), ('admin', 'other', 200),
('admin', 'missing', 404), ('admin', 'missing', 404),
('user', 'other', 403), ('user', 'other', 404),
('user', 'user', 200), ('user', 'user', 200),
], ],
) )