)]}'
{"mistral/context.py":[{"author":{"_account_id":19206,"name":"Dawid Deja","email":"dawdej@gmail.com","username":"ddeja"},"change_message_id":"e178f69afed548e6a69ffbbc387060e380a504ff","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                       else token_info.get(\u0027token\u0027, {}))"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":128,"context_line":"    is_admin \u003d True if \u0027admin\u0027 in roles else False"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    return MistralContext("},{"line_number":131,"context_line":"        auth_uri\u003dauth_uri,"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_f409b732","line":128,"range":{"start_line":128,"start_character":4,"end_line":128,"end_character":50},"updated":"2017-01-03 10:11:48.000000000","message":"This seems like a potential security issue. One can easily add such header to the request and therefore got an admin privileges? Or maybe I miss something and it is secure?","commit_id":"965db538aaa3933fa1e7e744a0b47eb5e7432977"},{"author":{"_account_id":19206,"name":"Dawid Deja","email":"dawdej@gmail.com","username":"ddeja"},"change_message_id":"eb60f5c50e5acfeb781f84148b7d58c79ce0260e","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                       else token_info.get(\u0027token\u0027, {}))"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":128,"context_line":"    is_admin \u003d True if \u0027admin\u0027 in roles else False"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    return MistralContext("},{"line_number":131,"context_line":"        auth_uri\u003dauth_uri,"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_a493baff","line":128,"range":{"start_line":128,"start_character":4,"end_line":128,"end_character":50},"in_reply_to":"ba5201f7_aa0ce03b","updated":"2017-01-09 11:11:49.000000000","message":"OK, thanks for clarification.","commit_id":"965db538aaa3933fa1e7e744a0b47eb5e7432977"},{"author":{"_account_id":6732,"name":"Lingxian Kong","email":"anlin.kong@gmail.com","username":"kong"},"change_message_id":"11ec10f2ea9b67d01fb3a8900cbe35bda9663b81","unresolved":false,"context_lines":[{"line_number":125,"context_line":"                       else token_info.get(\u0027token\u0027, {}))"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"    roles \u003d headers.get(\u0027X-Roles\u0027, \"\").split(\",\")"},{"line_number":128,"context_line":"    is_admin \u003d True if \u0027admin\u0027 in roles else False"},{"line_number":129,"context_line":""},{"line_number":130,"context_line":"    return MistralContext("},{"line_number":131,"context_line":"        auth_uri\u003dauth_uri,"}],"source_content_type":"text/x-python","patch_set":2,"id":"ba5201f7_aa0ce03b","line":128,"range":{"start_line":128,"start_character":4,"end_line":128,"end_character":50},"in_reply_to":"ba5201f7_f409b732","updated":"2017-01-04 22:07:12.000000000","message":"No, auth middleware will only get the headers it\u0027s interested in (such as X-Auth-Token) and get rid of others, after authentication, it will set correct headers accordingly.","commit_id":"965db538aaa3933fa1e7e744a0b47eb5e7432977"}]}