fix breach in award points that allows user to award infinite points

[osqa.git] / forum_modules / oauthauth / authentication.py

diff --git a/forum_modules/oauthauth/authentication.py b/forum_modules/oauthauth/authentication.py
index 93cdc593422df145343699bc1117c7a6ac23f3b7..d353de495d87f620a5235f5a0ebeeee08760aa6b 100644 (file)
--- a/forum_modules/oauthauth/authentication.py
+++ b/forum_modules/oauthauth/authentication.py
@@ -1,12 +1,9 @@
+import json
+
 from consumer import OAuthAbstractAuthConsumer
 from forum.authentication.base import ConsumerTemplateContext
 
-try:
-    import json as simplejson
-except ImportError:
-    from django.utils import simplejson
-
-from lib import oauth
+from lib import oauth2
 import settings
 
 class TwitterAuthConsumer(OAuthAbstractAuthConsumer):
@@ -15,16 +12,16 @@ class TwitterAuthConsumer(OAuthAbstractAuthConsumer):
                 str(settings.TWITTER_CONSUMER_KEY),
                 str(settings.TWITTER_CONSUMER_SECRET),
                 "twitter.com",
-                "https://twitter.com/oauth/request_token",
-                "https://twitter.com/oauth/access_token",
-                "https://twitter.com/oauth/authorize",
+                "https://api.twitter.com/oauth/request_token",
+                "https://api.twitter.com/oauth/access_token",
+                "https://api.twitter.com/oauth/authorize",
         )
 
     def get_user_data(self, key):
         json = self.fetch_data(key, "https://twitter.com/account/verify_credentials.json")
         
         if 'screen_name' in json:
-            creds = simplejson.loads(json)
+            creds = json.loads(json)
 
             return {
                 'username': creds['screen_name']
@@ -38,4 +35,4 @@ class TwitterAuthContext(ConsumerTemplateContext):
     type = 'DIRECT'
     weight = 150
     human_name = 'Twitter'
-    icon = '/media/images/openid/twitter.png'
\ No newline at end of file
+    icon = '/media/images/openid/twitter.png'