centralcloud/oncall-engine
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #820 from grafana/mderynck/twilio-api-key-permission

Browse source 
Twilio add simple check if using API key instead of AUTH token
This commit is contained in:
Michael Derynck 2022-11-10 08:23:32 -07:00 • committed by GitHub
commit 5143393e4b
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
engine/apps/twilioapp/views.py
View file

@ -19,12 +19,17 @@ class AllowOnlyTwilio(BasePermission):
def has_permission(self, request, view):
# https://www.twilio.com/docs/usage/tutorials/how-to-secure-your-django-project-by-validating-incoming-twilio-requests
# https://www.django-rest-framework.org/api-guide/permissions/
validator = RequestValidator(live_settings.TWILIO_AUTH_TOKEN)
location = create_engine_url(request.get_full_path())
request_valid = validator.validate(
request.build_absolute_uri(location=location), request.POST, request.META.get("HTTP_X_TWILIO_SIGNATURE", "")
)
return request_valid
if live_settings.TWILIO_AUTH_TOKEN:
validator = RequestValidator(live_settings.TWILIO_AUTH_TOKEN)
location = create_engine_url(request.get_full_path())
request_valid = validator.validate(
request.build_absolute_uri(location=location),
request.POST,
request.META.get("HTTP_X_TWILIO_SIGNATURE", ""),
)
return request_valid
else:
return live_settings.TWILIO_ACCOUNT_SID == request.data["AccountSid"]
class HealthCheckView(APIView):