From 477dd6645287f8709af436d6f922f56a05994257 Mon Sep 17 00:00:00 2001 From: khushal Date: Wed, 22 Jan 2025 16:34:25 +0530 Subject: [PATCH] (20250122) User-info fetching mistake. --- api/blueprints/message/mail/send/send.py | 35 ++++++++++++------------ 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/api/blueprints/message/mail/send/send.py b/api/blueprints/message/mail/send/send.py index ec6087f..da5d587 100644 --- a/api/blueprints/message/mail/send/send.py +++ b/api/blueprints/message/mail/send/send.py @@ -233,26 +233,27 @@ async def send_one_mail( # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛ ┗┛┛┗┗ ┗┛┗ # ┛ - # We test ownership only in API calls made from outside: + # Get the token based on the key: + auth_token = await current_app.mail_controller.get_token_from_key( + mongo_data_conn = current_app.data_mongo, + token_key = inbound_data.tokenKey + ) + + # Get the user's info: if inbound_headers["Remote-IP"] not in current_app.whitelisted_ips: - - # Get the token based on the key: - auth_token = await current_app.mail_controller.get_token_from_key( - mongo_data_conn = current_app.data_mongo, - token_key = inbound_data.tokenKey - ) user_info = CoreUserInfoModel(**kwargs["session_info"]) + else: user_info = auth_token.user - # We check if the token that was used to fetch the mail is owned by this user: - if not await token_check.is_authorized( - mongo_data_conn = current_app.data_mongo, - user_info = user_info, - token_ids = [auth_token.authTokenId] - ): return ResponseModel( - status_code = StatusCodes.FAILED, - http_code = HttpCodes.UNAUTHORIZED, - message = "The account does not belong to this user." - ) + # We check if the token that was used to fetch the mail is owned by this user: + if not await token_check.is_authorized( + mongo_data_conn = current_app.data_mongo, + user_info = user_info, + token_ids = [auth_token.authTokenId] + ): return ResponseModel( + status_code = StatusCodes.FAILED, + http_code = HttpCodes.UNAUTHORIZED, + message = "The account does not belong to this user." + ) # ┏┓ ┓ ┳┳┓ •┓ # ┗┓┏┓┏┓┏┫ ┃┃┃┏┓┓┃