Skip to content

Use POST instead of GET to avoid plain text passwords in logs. #27

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jlrgraham wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Use POST instead of GET to avoid plain text passwords in logs. #27

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 9 additions & 5 deletions fullykiosk/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ def __init__(self, session, host, port, password, use_ssl=False, verify_ssl=Fals
self._settings = None

async def sendCommand(self, cmd, **kwargs):
data = await self._rh.get(
data = await self._rh.post(
cmd=cmd, password=self._password, type="json", **kwargs
)

Expand Down Expand Up @@ -201,20 +201,24 @@ def __init__(self, session: aiohttp.ClientSession, host, port, use_ssl=False,
self.use_ssl = use_ssl
self.verify_ssl = verify_ssl

async def get(self, **kwargs):
async def post(self, **kwargs):
url = f"http{'s' if self.use_ssl else ''}://{self.host}:{self.port}"
params = []
payload = {}

for key, value in kwargs.items():
if value is not None:
params.append((key, str(value)))
req_params = {"url": url, "headers": self.headers, "params": params}
if key == "password":
payload[key] = str(value)
else:
params.append((key, str(value)))
req_params = {"url": url, "headers": self.headers, "params": params, "data": payload}
if not self.verify_ssl:
req_params["ssl"] = False

_LOGGER.debug("Sending request to: %s", url)
_LOGGER.debug("Parameters: %s", params)
async with self.session.get(**req_params) as response:
async with self.session.post(**req_params) as response:
if response.status != 200:
_LOGGER.warning(
"Invalid response from Fully Kiosk Browser API: %s", response.status
Expand Down