summaryrefslogtreecommitdiff
path: root/lib/dashing
diff options
context:
space:
mode:
Diffstat (limited to 'lib/dashing')
-rw-r--r--lib/dashing/app.rb11
1 files changed, 7 insertions, 4 deletions
diff --git a/lib/dashing/app.rb b/lib/dashing/app.rb
index 0e7f7bb..b11352d 100644
--- a/lib/dashing/app.rb
+++ b/lib/dashing/app.rb
@@ -23,6 +23,11 @@ helpers do
def protected!
# override with auth logic
end
+
+ def authenticated?(token)
+ return true unless settings.auth_token
+ token && Rack::Utils.secure_compare(settings.auth_token, token)
+ end
end
set :root, Dir.pwd
@@ -89,8 +94,7 @@ post '/dashboards/:id' do
request.body.rewind
body = JSON.parse(request.body.read)
body['dashboard'] ||= params['id']
- auth_token = body.delete("auth_token")
- if !settings.auth_token || settings.auth_token == auth_token
+ if authenticated?(body.delete("auth_token"))
send_event(params['id'], body, 'dashboards')
204 # response without entity body
else
@@ -102,8 +106,7 @@ end
post '/widgets/:id' do
request.body.rewind
body = JSON.parse(request.body.read)
- auth_token = body.delete("auth_token")
- if !settings.auth_token || settings.auth_token == auth_token
+ if authenticated?(body.delete("auth_token"))
send_event(params['id'], body)
204 # response without entity body
else