ynerant/synchronize-dolibarr-to-ldap
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't trust Webhook data

Browse Source
This commit is contained in:
Emmy D'Anello 2025-02-17 13:42:46 +01:00
parent 0aa2b4f220
commit bc3252b1f6
Signed by: ynerant
GPG Key ID: 3A75C55819C8CF85
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
main.py
View File

@ -132,12 +132,15 @@ def webhook_receiver():
abort(400)
triggercode = data['triggercode']
obj = data['object']
dolibarr_client = Dolibarrpy(url=config.DOLIBARR_API_BASE, token=config.DOLIBARR_API_TOKEN, timeout=16, debug=config.DOLIBARR_API_DEBUG)
ldap_server = Server(config.LDAP_HOST, config.LDAP_PORT, get_info=ALL)
if triggercode.startswith('USER_'):
with Connection(ldap_server, config.LDAP_BIND_USER, config.LDAP_BIND_PASSWORD) as ldap_conn:
manage_user_extra_fields(ldap_conn, obj)
dolibarr_user = dolibarr_client.get_user_by_uid(obj['id'])
manage_user_extra_fields(ldap_conn, dolibarr_user)
elif triggercode.startswith('USERGROUP_'):
with Connection(ldap_server, config.LDAP_BIND_USER, config.LDAP_BIND_PASSWORD) as ldap_conn:
dolibarr_group = dolibarr_client.call_get_api(f"users/groups/{obj['id']}")
manage_group_extra_fields(ldap_conn, obj)
else:
abort(400)