fix: remove Cross-Account Data Leakage

myice/myice.py

@@ -594,16 +594,16 @@ mobile_headers = {
 }
 
 
-def curl_for_mobile_login(username: str, password: str) -> str:
+# def curl_for_mobile_login(username: str, password: str) -> str:
-    """Generate curl command to replicate mobile_login request."""
+#     """Generate curl command to replicate mobile_login request."""
-    import base64
+#     import base64
 
-    headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
-    encoded_username = base64.b64encode(username.encode()).decode()
+#     encoded_username = base64.b64encode(username.encode()).decode()
-    encoded_password = base64.b64encode(password.encode()).decode()
+#     encoded_password = base64.b64encode(password.encode()).decode()
-    return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/login" \
+#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/login" \
-{headers_str} \
+# {headers_str} \
--d 'login_email={encoded_username}&login_password={encoded_password}&language=FR&v=2'"""
+# -d 'login_email={encoded_username}&login_password={encoded_password}&language=FR&v=2'"""
 
 
 def mobile_login(config_section: str | None = None):
@@ -619,7 +619,7 @@ def mobile_login(config_section: str | None = None):
 
     print("Requesting token", file=sys.stderr)
     # Print curl equivalent for debugging
-    print(curl_for_mobile_login(username, password), file=sys.stderr)
+    # print(curl_for_mobile_login(username, password), file=sys.stderr)
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/login",
         headers=mobile_headers,
@@ -643,23 +643,26 @@ userdata = {
 }
 
 
-def curl_for_refresh_data(token: str, club_id: int) -> str:
+# def curl_for_refresh_data(token: str, club_id: int) -> str:
-    """Generate curl command to replicate refresh_data request."""
+#     """Generate curl command to replicate refresh_data request."""
-    headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
+#     headers_str = " ".join([f"-H '{k}: {v}'" for k, v in mobile_headers.items()])
-    return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/refreshdata" \
+#     return f"""curl -X POST "https://app.myice.hockey/api/mobilerest/refreshdata" \
-{headers_str} \
+# {headers_str} \
--d 'token={token}&id_club={club_id}&language=FR'"""
+# -d 'token={token}&id_club={club_id}&language=FR'"""
 
 
-def refresh_data():
+def refresh_data(user_data=None):
+    # Use provided user_data or fall back to global userdata for backward compatibility
+    if user_data is None:
+        user_data = userdata
     # Print curl equivalent for debugging
-    print(
+    # print(
-        curl_for_refresh_data(userdata["token"], userdata["id_club"]), file=sys.stderr
+    #     curl_for_refresh_data(user_data["token"], user_data["id_club"]), file=sys.stderr
-    )
+    # )
     with requests.post(
         "https://app.myice.hockey/api/mobilerest/refreshdata",
         headers=mobile_headers,
-        data=f"token={userdata['token']}&id_club={userdata['id_club']}&language=FR",
+        data=f"token={user_data['token']}&id_club={user_data['id_club']}&language=FR",
         # verify=False,
     ) as r:
         r.raise_for_status()

myice/webapi.py

@@ -352,15 +352,15 @@ async def schedule(
 
     try:
         if existing_token:
-            myice.userdata = {
+            user_data = {
                 "id": userid,
                 "id_club": club_id or 186,
                 "token": existing_token,
             }
         else:
-            myice.userdata = myice.mobile_login(config_section=account)
+            user_data = myice.mobile_login(config_section=account)
 
-        data = myice.refresh_data()
+        data = myice.refresh_data(user_data=user_data)
         if "club_games" in data:
             return data["club_games"]
         else:
@@ -433,13 +433,13 @@ async def game(
         config_section=account
     )
     if existing_token:
-        myice.userdata = {
+        user_data = {
             "id": userid,
             "id_club": club_id or 186,
             "token": existing_token,
         }
     else:
-        myice.userdata = myice.mobile_login(config_section=account)
+        user_data = myice.mobile_login(config_section=account)
 
     # data = refresh_data()
     with requests.post(
@@ -447,11 +447,11 @@ async def game(
         headers=myice.mobile_headers,
         data="&".join(
             [
-                f"token={myice.userdata['token']}",
+                f"token={user_data['token']}",
                 f"id_event={game_id}",
                 "type=games",
-                f"id_player={myice.userdata['id']}",
+                f"id_player={user_data['id']}",
-                f"id_club={myice.userdata['id_club']}",
+                f"id_club={user_data['id_club']}",
                 "language=FR",
             ]
         ),