Changeset 2225 for trunk/grails-app/services/api/ApiService.groovy

Timestamp:

Apr 25, 2012, 10:42:52 PM (10 years ago)

Author:

work@…

Message:

• changed application wide secret into a user specific api key which is automatically generated when a user is created. The key is available in the user's profile or through the user administration pages

File:

• trunk/grails-app/services/api/ApiService.groovy (modified) (3 diffs)

trunk/grails-app/services/api/ApiService.groovy

@@ -25 +25 @@
     // inject the module communication service
     def moduleCommunicationService
-
-    // the shared secret used to validate api calls
-    static final String API_SECRET = "th!s_sH0uld^Pr0bab7y_m0v3_t%_th3_uSeR_d0Ma!n_ins7ead!"
 
     // transactional
@@ -72 +69 @@
         // disable validation check on development and ci
         if (['development', 'ci'].contains(grails.util.GrailsUtil.environment)) {
-            return true
+//            return true
         }
 
@@ -85 +82 @@
             // generate the validation checksum
             MessageDigest digest = MessageDigest.getInstance("MD5")
-            String validationSum = new BigInteger(1,digest.digest("${token.deviceToken}${token.sequence}${API_SECRET}".getBytes())).toString(16).padLeft(32,"0")
+            String validationSum = new BigInteger(1,digest.digest("${token.deviceToken}${token.sequence}${token.user.apiKey}".getBytes())).toString(16).padLeft(32,"0")
 
             // check if the validation confirms