w1cdn/spothole
1
0
Fork 0
mirror of https://git.ianrenton.com/ian/spothole.git synced 2026-09-20 22:37:44 +00:00
Code Issues 13 Packages Projects Releases Wiki Activity

Improve checking callsign validity by regex, and fix passing v1 type credentials into v2 APIs

Browse Source
This commit is contained in:
Ian Renton
2026-08-17 16:30:24 +01:00
parent 03164d747f
commit 38bc03a603
19 changed files with 48 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/handlers/api/addspot.py
+3 -3
View File
@@ -11,7 +11,7 @@ from tornado import httputil
from tornado.web import Application
from core.config import ALLOW_SPOTTING, ALLOW_UPSTREAM_SPOTTING, RECAPTCHA_SECRET_KEY
from core.constants import UNKNOWN_BAND
from core.constants import CALL_ONLY_PATTERN, UNKNOWN_BAND
from core.prometheus_metrics_handler import api_requests_counter
from core.sig_utils import get_ref_regex_for_sig
from core.utils import infer_band_from_freq, safe_json_dumps
@@ -121,13 +121,13 @@ class APISpotHandler(tornado.web.RequestHandler):
return
# Reject invalid-looking callsigns
if not re.match(r"^[A-Za-z0-9/\-]*$", spot.dx_call):
if not CALL_ONLY_PATTERN.match(spot.dx_call):
self.set_status(422)
self.write(safe_json_dumps(f"Error - '{spot.dx_call}' does not look like a valid callsign."))
self.set_header("Cache-Control", "no-store")
self.set_header("Content-Type", "application/json")
return
if not re.match(r"^[A-Za-z0-9/\-]*$", spot.de_call):
if not CALL_ONLY_PATTERN.match(spot.de_call):
self.set_status(422)
self.write(safe_json_dumps(f"Error - '{spot.de_call}' does not look like a valid callsign."))
self.set_header("Cache-Control", "no-store")
server/handlers/api/lookups.py
+2 -2
View File
@@ -9,7 +9,7 @@ from tornado import httputil
from tornado.web import Application
from core.call_lookup_helper import get_call_info
from core.constants import SIGS
from core.constants import CALL_ONLY_PATTERN, SIGS
from core.geo_utils import (
lat_lon_for_grid_sw_corner_plus_size,
lat_lon_to_cq_zone,
@@ -55,7 +55,7 @@ class APILookupCallHandler(tornado.web.RequestHandler):
# The "call" query param must exist and look like a callsign
if "call" in query_params:
call = str(query_params.get("call")).upper()
if re.match(r"^[A-Z0-9/\-]*$", call):
if CALL_ONLY_PATTERN.match(call):
credentials = extract_credentials(self.request.headers)
callsign_data = get_call_info(call, credentials)
self.write(safe_json_dumps(callsign_data))
server/handlers/api/v1_addspot.py
+3 -3
View File
@@ -9,7 +9,7 @@ from tornado import httputil
from tornado.web import Application
from core.config import ALLOW_SPOTTING
from core.constants import UNKNOWN_BAND
from core.constants import CALL_ONLY_PATTERN, UNKNOWN_BAND
from core.prometheus_metrics_handler import api_requests_counter
from core.sig_utils import get_ref_regex_for_sig
from core.utils import infer_band_from_freq, safe_json_dumps
@@ -83,13 +83,13 @@ class V1APISpotHandler(tornado.web.RequestHandler):
return
# Reject invalid-looking callsigns
if not re.match(r"^[A-Za-z0-9/\-]*$", spot.dx_call):
if not CALL_ONLY_PATTERN.match(spot.dx_call):
self.set_status(422)
self.write(safe_json_dumps(f"Error - '{spot.dx_call}' does not look like a valid callsign."))
self.set_header("Cache-Control", "no-store")
self.set_header("Content-Type", "application/json")
return
if not re.match(r"^[A-Za-z0-9/\-]*$", spot.de_call):
if not CALL_ONLY_PATTERN.match(spot.de_call):
self.set_status(422)
self.write(safe_json_dumps(f"Error - '{spot.de_call}' does not look like a valid callsign."))
self.set_header("Cache-Control", "no-store")
server/handlers/api/v1_compatability.py
+3 -3
View File
@@ -2,7 +2,6 @@ import tornado
from tornado.httpclient import AsyncHTTPClient
from tornado.httputil import HTTPHeaders
_LEGACY_PARAM_TO_HEADER_MAP = {
"qrz_username": "X-QRZ-Username",
"qrz_password": "X-QRZ-Password",
@@ -12,6 +11,7 @@ _LEGACY_PARAM_TO_HEADER_MAP = {
"hamqth_session_id": "X-HamQTH-Session-ID",
}
class V1RedirectHandler(tornado.web.RequestHandler):
"""Transparently proxies requests from the old API to the new one,
returning whatever the v2 endpoint returns, for endpoints with no breaking changes."""
@@ -34,7 +34,7 @@ class V1RedirectHandler(tornado.web.RequestHandler):
response = await client.fetch(
new_url,
method=self.request.method,
headers=self.request.headers,
headers=headers,
body=None if self.request.method == "GET" else (self.request.body or b""),
raise_error=False,
follow_redirects=False,
@@ -60,4 +60,4 @@ class V1RedirectHandler(tornado.web.RequestHandler):
await self._proxy(path)
async def post(self, path):
await self._proxy(path)
await self._proxy(path)