diff --git a/src/oncall/__init__.py b/src/oncall/__init__.py index afced14..3f39079 100644 --- a/src/oncall/__init__.py +++ b/src/oncall/__init__.py @@ -1 +1 @@ -__version__ = '2.0.0' +__version__ = '2.0.1' diff --git a/src/oncall/auth/__init__.py b/src/oncall/auth/__init__.py index 103dd0a..646140e 100644 --- a/src/oncall/auth/__init__.py +++ b/src/oncall/auth/__init__.py @@ -7,6 +7,7 @@ import hmac import hashlib import base64 import importlib +from urllib.parse import quote from falcon import HTTPUnauthorized, HTTPForbidden, Request from .. import db @@ -127,6 +128,12 @@ def check_calendar_auth_by_id(team_id, req): def is_client_digest_valid(client_digest, api_key, window, method, path, body): + # calulate HMAC hash with quoted and unquoted path for legacy client backwards compatibility + text = '%s %s %s %s' % (window, method, quote(path), body) + HMAC = hmac.new(api_key, text.encode('utf-8'), hashlib.sha512) + digest = base64.urlsafe_b64encode(HMAC.digest()) + if hmac.compare_digest(bytes(client_digest, 'utf-8'), digest): + return True text = '%s %s %s %s' % (window, method, path, body) HMAC = hmac.new(api_key, text.encode('utf-8'), hashlib.sha512) digest = base64.urlsafe_b64encode(HMAC.digest())