Skip to content

Commit

Permalink
Add AuthKeys
Browse files Browse the repository at this point in the history
  • Loading branch information
hc-sousa committed Feb 4, 2024
1 parent 19b0d28 commit ba5dd18
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 17 deletions.
3 changes: 2 additions & 1 deletion src/SaoMiguelBus/settings.py
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
environ.Env.read_env()

GOOGLE_MAPS_API_KEY = env('GOOGLE_MAPS_API_KEY')
AUTH_KEY = env('AUTH_KEY')

# Build paths inside the project like this: os.path.join(BASE_DIR, ...)
BASE_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
Expand All @@ -31,7 +32,7 @@
SECRET_KEY = 'hjq2808rur(19m(zf$3ahcxi=!r74qdvkard7a4yc32j3^jwss'

# SECURITY WARNING: don't run with debug turned on in production!
DEBUG = False
DEBUG = True

ALLOWED_HOSTS = ['saomiguelbus-api.herokuapp.com', '127.0.0.1']

Expand Down
42 changes: 26 additions & 16 deletions src/app/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
from statistics import median
import requests
from django.http import JsonResponse

import pytz

#Get All Stops
@api_view(['GET'])
Expand Down Expand Up @@ -84,29 +84,39 @@ def get_gmaps_v1(request):
# variable = Variables.objects.all().first().__dict__
# if not variable['maps']:
# return JsonResponse({'error': 'Google Maps API is disabled'}, status=400)

print("here")
origin = request.GET.get('origin')
destination = request.GET.get('destination')
datetime_str = request.GET.get('datetime') # Expected in ISO format
language_code = request.GET.get('languageCode', 'en') # Default language set to English
arrival_departure = request.GET.get('arrival_departure', 'departure')

if not (origin and destination and datetime_str):
time = request.GET.get('time', "NA")
platform = request.GET.get('platform', 'NA')
version = request.GET.get('version', 'NA')
debug = request.GET.get('debug', False)
sessionToken = request.GET.get('sessionToken', 'NA')
key = request.GET.get('key', 'NA')
if key != settings.AUTH_KEY or int(version.split('.')[0]) < 5:
return JsonResponse({'error': 'Unauthorized'}, status=401)
if not debug:
debug = True

if time == "NA":
# Define the Azores timezone
azores_timezone = pytz.timezone('Atlantic/Azores')
# Get the current UTC time, aware of the timezone
current_utc_time = datetime.now(pytz.utc)
# Convert the current UTC time to Azores time
azores_time = current_utc_time.astimezone(azores_timezone)
# Convert Azores time to Unix timestamp in seconds
time = int(azores_time.timestamp())

if not (origin and destination):
return JsonResponse({'error': 'Missing required parameters'}, status=400)

# Convert datetime from ISO format to datetime object
try:
datetime_obj = datetime.fromisoformat(datetime_str)
except ValueError:
return JsonResponse({'error': 'Invalid datetime format'}, status=400)

# Build the Google Maps API URL
maps_url = f"https://maps.googleapis.com/maps/api/directions/json?origin={origin}&destination={destination}&mode=transit&key={settings.GOOGLE_MAPS_API_KEY}&language={language_code}&alternatives=true"

if arrival_departure == 'arrival':
maps_url += f"&arrival_time={int(datetime_obj.timestamp())}"
else:
maps_url += f"&departure_time={int(datetime_obj.timestamp())}"
maps_url += f"&arrival_time={time}" if arrival_departure == 'arrival' else f"&departure_time={time}"

try:
response = requests.get(maps_url)

Check warning

Code scanning / SonarCloud

Server-side requests should not be vulnerable to forging attacks Medium

Change this code to not construct the URL from user-controlled data. See more on SonarCloud
if response.status_code == 200:
Expand Down

0 comments on commit ba5dd18

Please sign in to comment.