khushalps/api_utils_converse_v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

(20250122) User-info fetching mistake.

Browse Source
This commit is contained in:
khushal
2025-01-22 16:34:25 +05:30
parent 55ada94cda
commit 477dd66452
1 changed files with 18 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/blueprints/message/mail/send/send.py
+4 -3
View File
@@ -233,15 +233,16 @@ async def send_one_mail(
# ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛ ┗┛┛┗┗ ┗┛┗ # ┗┛┗┻┛┛┗┗ ┛ ┛┛┗┗┣┛ ┗┛┛┗┗ ┗┛┗
# ┛ # ┛
# We test ownership only in API calls made from outside:
if inbound_headers["Remote-IP"] not in current_app.whitelisted_ips:
# Get the token based on the key: # Get the token based on the key:
auth_token = await current_app.mail_controller.get_token_from_key( auth_token = await current_app.mail_controller.get_token_from_key(
mongo_data_conn = current_app.data_mongo, mongo_data_conn = current_app.data_mongo,
token_key = inbound_data.tokenKey token_key = inbound_data.tokenKey
) )
# Get the user's info:
if inbound_headers["Remote-IP"] not in current_app.whitelisted_ips:
user_info = CoreUserInfoModel(**kwargs["session_info"]) user_info = CoreUserInfoModel(**kwargs["session_info"])
else: user_info = auth_token.user
# We check if the token that was used to fetch the mail is owned by this user: # We check if the token that was used to fetch the mail is owned by this user:
if not await token_check.is_authorized( if not await token_check.is_authorized(