Skip to content

Commit e4cbb5d

Browse files
committed
Prevent username and password to be passed as GET parameters.
For preventing to pass username and password as GET parameters, The 'user:password@host' syntax is managed by the xmlrpclib/xmlrpc.client library which allows set the 'Authorization' header. Fix #8
1 parent 0e27ac1 commit e4cbb5d

File tree

1 file changed

+8
-2
lines changed

1 file changed

+8
-2
lines changed

dokuwiki.py

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131

3232
ERR = 'XML or text declaration not at start of entity: line 2, column 0'
3333

34+
_URL_RE = re.compile(r'(?P<proto>https?)://(?P<host>[^/]*)(?P<uri>/.*)?')
35+
3436
def date(date):
3537
"""DokuWiki returns dates of `xmlrpclib`/`xmlrpc.client` ``DateTime``
3638
type and the format changes between DokuWiki versions ... This function
@@ -79,8 +81,12 @@ class DokuWiki(object):
7981
def __init__(self, url, user, password, **kwargs):
8082
"""Initialize the object by connecting to the XMLRPC server."""
8183
# Initialize XMLRPC client.
82-
url_params = urlencode({'u': user, 'p': password})
83-
url = '%s/lib/exe/xmlrpc.php?%s' % (url, url_params)
84+
try:
85+
params = _URL_RE.search(url).groupdict()
86+
url = '%s://%s:%s@%s%s/lib/exe/xmlrpc.php' % (
87+
params['proto'], user, password, params['host'], params['uri'] or '')
88+
except AttributeError:
89+
raise DokuwikiError("invalid url '%s'" % url)
8490
self.proxy = ServerProxy(url, **kwargs)
8591

8692
# Force login to check the connection.

0 commit comments

Comments
 (0)