Skip to content

Do not pass login credentials via urlparameters - use BasicAuth instead #8

Closed
@commonism

Description

@commonism

To avoid passing username & password as GET parameters, having them plaintext in server logs I added the ability to use HTTP BasicAuth. Tested only with py3.

class BasicAuthTransport(xmlrpc.client.SafeTransport):
	def __init__(self, username, password):
		super().__init__()
		self._auth = base64.encodestring('{}:{}'.format(username, password).encode('ascii'))[:-1].decode('ascii')

	def send_headers(self, connection, headers):
		connection.putheader("Authorization", "Basic {}".format(self._auth))
		super().send_headers(connection, headers)


class DokuWiki(dokuwiki.DokuWiki):
	def __init__(self, url, user, password):
		t = BasicAuthTransport(user, password)
		self.proxy = xmlrpc.client.ServerProxy("{url}/lib/exe/xmlrpc.php".format(url=url), transport=t)
		if not self.login(user, password):
			raise DokuWikiError('invalid login or password!')

		# Set "namespaces" for pages and medias functions.
		self.pages = dokuwiki._Pages(weakref.ref(self)())
		self.medias = dokuwiki._Medias(weakref.ref(self)())

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions