Fix access token being exposed after APIToken edit

app/blueprints/api/tokens.py

@@ -80,14 +80,13 @@ def create_edit_token(username, id=None):
 			token.owner = user
 			token.access_token = randomString(32)
 
+			# Store token so it can be shown in the edit page
+			session["token_" + str(token.id)] = token.access_token
+
 		form.populate_obj(token)
 		db.session.add(token)
-
 		db.session.commit() # save
 
-		# Store token so it can be shown in the edit page
-		session["token_" + str(token.id)] = token.access_token
-
 		return redirect(url_for("api.create_edit_token", username=username, id=token.id))
 
 	return render_template("api/create_edit_token.html", user=user, form=form, token=token, access_token=access_token)

app/blueprints/github/__init__.py

@@ -24,7 +24,7 @@ from sqlalchemy import func
 from flask_github import GitHub
 from app import github, csrf
 from app.models import db, User, APIToken, Package, Permission
-from app.utils import loginUser, randomString
+from app.utils import loginUser, randomString, abs_url_for
 from app.blueprints.api.support import error, handleCreateRelease
 import hmac, requests, json
 
@@ -33,7 +33,7 @@ from wtforms import SelectField, SubmitField
 
 @bp.route("/github/start/")
 def start():
-	return github.authorize("", redirect_uri=url_for("github.callback"))
+	return github.authorize("", redirect_uri=abs_url_for("github.callback"))
 
 @bp.route("/github/callback/")
 @github.authorized_handler
@@ -141,7 +141,7 @@ def webhook():
 
 
 class SetupWebhookForm(FlaskForm):
-	event   = SelectField("Event Type", choices=[('create', 'New tag'), ('push', 'Push')])
+	event   = SelectField("Event Type", choices=[('create', 'New tag or GitHub release'), ('push', 'Push')])
 	submit  = SubmitField("Save")
 
 
@@ -180,12 +180,12 @@ def setup_webhook():
 
 	if current_user.github_access_token is None:
 		return github.authorize("write:repo_hook", \
-			redirect_uri=url_for("github.callback_webhook", pid=pid, _external=True))
+			redirect_uri=abs_url_for("github.callback_webhook", pid=pid))
 
 	form = SetupWebhookForm(formdata=request.form)
 	if request.method == "POST" and form.validate():
 		token = APIToken()
-		token.name = "Github Webhook for " + package.title
+		token.name = "GitHub Webhook for " + package.title
 		token.owner = current_user
 		token.access_token = randomString(32)
 		token.package = package
@@ -196,6 +196,7 @@ def setup_webhook():
 
 		if handleMakeWebhook(gh_user, gh_repo, package, \
 				current_user.github_access_token, event, token):
+			flash("Successfully created webhook", "success")
 			return redirect(package.getDetailsURL())
 		else:
 			return redirect(url_for("github.setup_webhook", pid=package.id))
@@ -214,7 +215,7 @@ def handleMakeWebhook(gh_user, gh_repo, package, oauth, event, token):
 		"active": True,
 		"events": [event],
 		"config": {
-			"url": url_for("github.webhook", _external=True),
+			"url": abs_url_for("github.webhook"),
 			"content_type": "json",
 			"secret": token.access_token
 		},
@@ -235,7 +236,8 @@ def handleMakeWebhook(gh_user, gh_repo, package, oauth, event, token):
 		return False
 
 	for hook in r.json():
-		if hook["config"]["url"] == data["config"]["url"]:
+		if hook.get("config") and hook["config"].get("url") and \
+				hook["config"]["url"] == data["config"]["url"]:
 			flash("Failed to create webhook, as it already exists", "danger")
 			return False
 

app/flatpages/help/release_webhooks.md

@@ -2,6 +2,9 @@ title: Creating Releases using Webhooks
 
 ## What does this mean?
 
+A webhook is a notification from one service to another. Put simply, a webhook
+is used to notify ContentDB that the git repository has changed.
+
 ContentDB offers the ability to automatically create releases using webhooks
 from either Github or Gitlab. If you're not using either of those services,
 you can also use the [API](../api) to create releases.
@@ -12,7 +15,7 @@ The process is as follows:
    for Github.
 2. The user pushes a commit to the git host (Gitlab or Github).
 3. The git host posts a webhook notification to ContentDB, using the API token assigned to it.
-4. ContentDB checks the API token and issues a new releases.
+4. ContentDB checks the API token and issues a new release.
 
 <p class="alert alert-info">
 	This feature is in beta, and is only available for Trusted Members.
@@ -25,9 +28,14 @@ The process is as follows:
 1. Go to your package page.
 2. Make sure that the repository URL is set to a Github repository.
    Only github.com is supported.
-3. Click "Set up a webhook to create releases automatically" below the releases
-   panel on the side bar.
-4. Grant ContentDB the ability to manage Webhooks
+3. Go to "Create a release", and click "Setup webhook" at the top of the page.
+   If you do not see this, either the repository isn't using Github or you do
+   not have permission to use webhook releases (ie: you're not a Trusted Member).
+4. Grant ContentDB the ability to manage Webhooks.
+5. Set the event to either "New tag" or "Push". New tag is highlight recommended.
+
+   N.B.: GitHub uses tags to power GitHub Releases, meaning that creating a webhook
+   on "new tag" will sync GitHub and ContentDB releases.
 
 ### GitHub (manual)
 

app/tasks/emails.py

@@ -19,6 +19,7 @@ from flask import render_template, url_for
 from flask_mail import Message
 from app import mail
 from app.tasks import celery
+from app.utils import abs_url_for
 
 @celery.task()
 def sendVerifyEmail(newEmail, token):
@@ -34,7 +35,7 @@ def sendVerifyEmail(newEmail, token):
 			If this was you, then please click this link to verify the address:
 
 			{}
-		""".format(url_for('users.verify_email', token=token, _external=True))
+		""".format(abs_url_for('users.verify_email', token=token))
 
 	msg.html = render_template("emails/verify.html", token=token)
 	mail.send(msg)

app/tasks/importtasks.py

@@ -160,10 +160,7 @@ def cloneRepo(urlstr, ref=None, recursive=False):
 			origin = repo.create_remote("origin", url=gitUrl)
 			assert origin.exists()
 			origin.fetch()
-
-			new_head = repo.commit(ref) #repo.create_head("target", ref)
-			repo.head.reference = new_head
-			repo.head.reset(index=True, working_tree=True)
+			origin.pull(ref)
 
 		return gitDir, repo
 

app/templates/emails/verify.html

@@ -16,12 +16,12 @@
 	If this was you, then please click this link to verify the address:
 </p>
 
-<a class="btn" href="{{ url_for('users.verify_email', token=token, _external=True) }}">
+<a class="btn" href="{{ abs_url_for('users.verify_email', token=token) }}">
 	Confirm Email Address
 </a>
 
 <p style="font-size: 80%;">
-	Or paste this into your browser: {{ url_for('users.verify_email', token=token, _external=True) }}
+	Or paste this into your browser: {{ abs_url_for('users.verify_email', token=token) }}
 <p>
 
 {% endblock %}

app/utils.py

@@ -22,6 +22,12 @@ from app.models import *
 from app import app
 import random, string, os, imghdr
 
+
+@app.template_filter()
+def abs_url_for(path, **kwargs):
+	scheme = "https" if app.config["BASE_URL"][:5] == "https" else "http"
+	return url_for(path, _external=True, _scheme=scheme, **kwargs)
+
 def get_int_or_abort(v, default=None):
 	try:
 		return int(v or default)