From 524c4db8898bb2b0dd57c2322481ca940325222c Mon Sep 17 00:00:00 2001 From: Rene Luria Date: Mon, 29 Jun 2026 16:37:39 +0200 Subject: [PATCH] fix: Missing Authentication Checks --- myice/webapi.py | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/myice/webapi.py b/myice/webapi.py index 5d88139..3b05dd3 100644 --- a/myice/webapi.py +++ b/myice/webapi.py @@ -208,8 +208,14 @@ async def callback(code: str, state: str): @app.get("/exchange-token") -async def exchange_token(code: str): +async def exchange_token( + code: str, + headers: Annotated[AuthHeaders, Header()], +): """Exchange authorization code for access token""" + if not headers.authorized(): + raise HTTPException(401, detail="get out") + # Exchange authorization code for access token token_data = { "grant_type": "authorization_code", @@ -252,6 +258,9 @@ async def exchange_token(code: str): @app.get("/userinfo") async def userinfo(headers: Annotated[AuthHeaders, Header()]): """Get user info from access token""" + if not headers.authorized(): + raise HTTPException(401, detail="get out") + access_token = headers.token() userinfo_response = requests.get( @@ -355,6 +364,9 @@ async def game( game_id: int, account: str = "default", ): + if not headers.authorized(): + raise HTTPException(401, detail="get out") + username, password, userid, existing_token, club_id = myice.get_login( config_section=account )