hazza/jupyterhub
1
0
Fork 0
mirror of https://github.com/jupyterhub/jupyterhub.git synced 2025-10-16 14:33:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3435 from 0mar/token_handler

Browse Source 
Fixed scope checking in UserTokenListAPIHandler
This commit is contained in:
Min RK
2021-04-22 13:52:13 +02:00
committed by GitHub
parent ad090560d0 103c6a406a
commit eb71e39c77
2 changed files with 10 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
jupyterhub/apihandlers/users.py
View File

@@ -301,7 +301,6 @@ class UserTokenListAPIHandler(APIHandler):
self.write(json.dumps({'api_tokens': api_tokens}))
# @needs_scope('users:tokens') #Todo: needs internal scope checking
async def post(self, user_name):
body = self.get_json_body() or {}
if not isinstance(body, dict):
@@ -330,13 +329,16 @@ class UserTokenListAPIHandler(APIHandler):
if requester is None:
# couldn't identify requester
raise web.HTTPError(403)
self._jupyterhub_user = requester
self._resolve_scopes()
user = self.find_user(user_name)
if requester is not user and not requester.admin:
raise web.HTTPError(403, "Only admins can request tokens for other users")
if not user:
raise web.HTTPError(404, "No such user: %s" % user_name)
if requester is not user:
kind = 'user' if isinstance(requester, User) else 'service'
kind = 'user' if isinstance(requester, User) else 'service'
scope_filter = self.get_scope_filter('users:tokens')
if user is None or not scope_filter(user, kind):
raise web.HTTPError(
403,
f"{kind.title()} {user_name} not found or no permissions to generate tokens",
)
note = body.get('note')
if not note: