opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-09-19 10:51:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

Prevent API access with deleted key

Browse Source
This commit is contained in:
Jonathan Laperle
2023-06-27 08:45:35 -07:00
committed by Martin Cech
parent 0b1a41bd86
commit c8fbf8fa51
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/managers/users.py
+1 -1
View File
@@ -275,7 +275,7 @@ class UserManager(base.ModelManager, deletable.PurgableManagerMixin):
return schema.BootstrapAdminUser()
sa_session = sa_session or self.app.model.session
try:
provided_key = sa_session.query(self.app.model.APIKeys).filter(self.app.model.APIKeys.key == api_key).one()
provided_key = sa_session.query(self.app.model.APIKeys).filter_by(key=api_key, deleted=False).one()
except NoResultFound:
raise exceptions.AuthenticationFailed("Provided API key is not valid.")
if provided_key.user.deleted:
lib/galaxy_test/api/test_users.py
+2 -2
View File
@@ -158,9 +158,9 @@ class TestUsersApi(ApiTestCase):
# Delete user API key
response = self._delete(f"users/{user_id}/api_key")
self._assert_status_code_is(response, 204)
# No API key anymore, so the detailed request returns no content 204
# No API key anymore, so the detailed request returns unauthorized
response = self._get(f"users/{user_id}/api_key/detailed")
self._assert_status_code_is(response, 204)
self._assert_status_code_is(response, 401)
# create new as admin
response = self._post(f"users/{user_id}/api_key", admin=True)
self._assert_status_code_is_ok(response)