diff --git a/rowers/mytypes.py b/rowers/mytypes.py index 6a10e967..e8b7aa9b 100644 --- a/rowers/mytypes.py +++ b/rowers/mytypes.py @@ -5,6 +5,9 @@ from __future__ import unicode_literals from six import iteritems import collections + + + workouttypes_ordered = collections.OrderedDict({ 'water':'Standard Racing Shell', 'rower':'Indoor Rower', @@ -289,7 +292,7 @@ workoutsources = ( ('ergstick','ergstick'), ('fit','fit'), ('unknown','unknown')) - + boattypes = ( ('1x', '1x (single)'), ('2x', '2x (double)'), diff --git a/rowers/views/workoutviews.py b/rowers/views/workoutviews.py index 743ecb71..39a88629 100644 --- a/rowers/views/workoutviews.py +++ b/rowers/views/workoutviews.py @@ -4394,6 +4394,15 @@ def workout_upload_api(request): message = {'status':'false','message':'this view cannot be accessed through GET'} return JSONResponse(status=403,data=message) + + # test if JSON + try: + json_data = json.loads(request.body) + secret = json_data['secret'] + post_data = json_data + except KeyError: + post_data = request.POST + # only allow local host hostt = request.get_host().split(':') if hostt[0] not in ['localhost','127.0.0.1']: @@ -4401,17 +4410,22 @@ def workout_upload_api(request): return JSONResponse(status=403,data=message) # check credentials here - secret = request.POST['secret'] + try: + secret = post_data['secret'] + except KeyError: + message = {'status': 'false', 'message':'missing credentials'} + return JSONResponse(status=400,data=message) if secret != settings.UPLOAD_SERVICE_SECRET: message = {'status':'false','message':'invalid credentials'} return JSONResponse(status=403,data=message) - form = DocumentsForm(request.POST) - optionsform = TeamUploadOptionsForm(request.POST) - rowerform = TeamInviteForm(request.POST) + form = DocumentsForm(post_data) + optionsform = TeamUploadOptionsForm(post_data) + rowerform = TeamInviteForm(post_data) rowerform.fields.pop('email') try: - fstr = request.POST['file'] + fstr = post_data['file'] + print(fstr) nn, ext = os.path.splitext(fstr) if ext== '.gz': nn, ext2 = os.path.splitext(nn) @@ -4433,8 +4447,8 @@ def workout_upload_api(request): if rowerform.is_valid(): u = rowerform.cleaned_data['user'] r = getrower(u) - elif 'useremail' in request.POST: - us = User.objects.filter(email=request.POST['useremail']) + elif 'useremail' in post_data: + us = User.objects.filter(email=post_data['useremail']) if len(us): u = us[0] r = getrower(u)