fix: don't send callback request if data has been modified

Author: imperosol

api/tests/test_third_party_auth.py

@@ -47,14 +47,15 @@ def setUp(self):
         self.callback_data["signature"] = hmac_hexdigest(
             self.api_client.hmac_key, self.callback_data["user"]
         )
+        self.url = reverse("api-link:third-party-auth", query=self.query)
 
     def test_auth_ok(self):
         self.client.force_login(self.user)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        res = self.client.get(self.url)
         assert res.status_code == 200
         with mock.patch("requests.post", new_callable=mocked_post(ok=True)) as mocked:
             res = self.client.post(
-                reverse("api-link:third-party-auth"),
+                self.url,
                 data={"cgu_accepted": True, "is_username_valid": True, **self.query},
             )
             mocked.assert_called_once_with(
@@ -70,7 +71,7 @@ def test_callback_error(self):
         self.client.force_login(self.user)
         with mock.patch("requests.post", new_callable=mocked_post(ok=False)) as mocked:
             res = self.client.post(
-                reverse("api-link:third-party-auth"),
+                self.url,
                 data={"cgu_accepted": True, "is_username_valid": True, **self.query},
             )
             mocked.assert_called_once_with(
@@ -98,14 +99,17 @@ def test_wrong_signature(self):
             )
         ]
 
+        res = self.client.post(self.url, data=self.query)
+        assert res.status_code == 200
+
     def test_cgu_not_accepted(self):
         self.client.force_login(self.user)
-        res = self.client.get(reverse("api-link:third-party-auth", query=self.query))
+        res = self.client.get(self.url)
         assert res.status_code == 200
-        res = self.client.post(reverse("api-link:third-party-auth"), data=self.query)
+        res = self.client.post(self.url, data=self.query)
         assert res.status_code == 200  # no redirect means invalid form
         res = self.client.post(
-            reverse("api-link:third-party-auth"),
+            self.url,
             data={"cgu_accepted": False, "is_username_valid": False, **self.query},
         )
         assert res.status_code == 200
@@ -132,3 +136,5 @@ def test_missing_parameter(self):
                 message="Les données fournies pour l'authentification sont incorrectes.",
             )
         ]
+        res = self.client.post(self.url, data=self.query)
+        assert res.status_code == 200

api/views.py

@@ -39,16 +39,16 @@ def parse_params(self) -> ThirdPartyAuthParamsSchema | None:
         # the given parameters and their signature are checked during both
         # POST (for obvious reasons) and GET (in order not to make
         # the user fill a form just to get an error he won't understand)
-        params = self.request.GET or self.request.POST
-        params = {key: unquote(val) for key, val in params.items()}
+        params = self.request.GET if self.request.method == "GET" else self.request.POST
+        params = {key: unquote(val) for key, val in params.dict().items()}
         try:
             params = ThirdPartyAuthParamsSchema(**params)
         except pydantic.ValidationError:
             messages.error(
                 self.request, _("The data provided for authentication is incorrect")
             )
             return None
-        client: ApiClient = get_object_or_none(ApiClient, id=params.client_id)
+        client: ApiClient | None = get_object_or_none(ApiClient, id=params.client_id)
         if not client:
             messages.error(
                 self.request, _("The data provided for authentication is incorrect")
@@ -71,11 +71,11 @@ def parse_params(self) -> ThirdPartyAuthParamsSchema | None:
     def dispatch(self, request, *args, **kwargs):
         if not request.user.is_authenticated:
             return self.handle_no_permission()
-        self.params = self.parse_params()
-        if not self.params:
+        if (params := self.parse_params()) is None:
             # if parameters parsing failed, shortcut the operation and display
             # an empty page with just the error messages.
             return render(request, "core/base.jinja")
+        self.params = params
         return super().dispatch(request, *args, **kwargs)
 
     def get(self, *args, **kwargs):