Consume secret from uwsgi

api.wsgi

@@ -28,6 +28,7 @@ ap.add_argument('--demo', help='enable automatic user creation', action='store_t
 ap.add_argument('--insecure', help='allow user info as urlencoded param', action='store_true', default=False)
 ap.add_argument('--central_uri', help='scitran central api', default='https://sdmc.scitran.io/api')
 ap.add_argument('--log_level', help='log level [info]', default='info')
+ap.add_argument('--secret', help='Shared secret', required=True)
 args = ap.parse_args()
 
 # HACK to allow setting the --site_name in the same way as api.py
@@ -43,6 +44,8 @@ log = logging.getLogger('scitran')
 application = api.app
 application.config = vars(args)
 
+application.secret = args.secret
+
 if not os.path.exists(application.config['data_path']):
     os.makedirs(application.config['data_path'])
 if not os.path.exists(application.config['quarantine_path']):

base.py

@@ -55,7 +55,7 @@ class RequestHandler(webapp2.RequestHandler):
 
         # Drone shared secret authentication
         elif drone_auth != None and self.request.user_agent.startswith('SciTran Drone '):
-            if drone_auth == "change-me":
+            if drone_auth == self.app.secret:
                 log.info('Drone ' + self.request.user_agent.replace('SciTran Drone ', '') + ' request accepted')
                 self.drone_request = True
                 self.public_request = False