Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Restrict sensitive settings to admins on API #43

Merged
merged 2 commits into from
Oct 12, 2016
Merged

Restrict sensitive settings to admins on API #43

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ebee9c0
Restrict sensitive settings to admins on API
foosel Oct 7, 2016
0f2e508
Forgot current_user import
foosel Oct 7, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions octoprint_telegram/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@
import threading, requests, re, time, datetime, StringIO, json, random, logging, traceback, io, collections, os, flask,base64,PIL
import octoprint.plugin, octoprint.util, octoprint.filemanager
from flask.ext.babel import gettext
from flask.ext.login import current_user
from .telegramCommands import TCMD # telegramCommands.
from .telegramNotifications import TMSG # telegramNotifications
from .telegramNotifications import telegramMsgDict # dict of known notification messages
Expand Down Expand Up @@ -759,6 +760,21 @@ def on_settings_save(self, data):
else:
self.connection_state_str = gettext("No token given.")

def on_settings_load(self):
data = octoprint.plugin.SettingsPlugin.on_settings_load(self)

# only return our restricted settings to admin users - this is only needed for OctoPrint <= 1.2.16
restricted = ("token", "tracking_token")
for r in restricted:
if r in data and (current_user is None or current_user.is_anonymous() or not current_user.is_admin()):
data[r] = None

return data

def get_settings_restricted_paths(self):
# only used in OctoPrint versions > 1.2.16
return dict(admin=[["token"], ["tracking_token"]])

##########
### Softwareupdate API
##########
Expand Down