eventbrite / deskapi Goto Github PK

The documentation at https://pypi.python.org/pypi/deskapi shows the import statement as:

from deskapi.models import DeskSession

I continued getting the AttributeError when using this import. When using the import documented in github, everything worked fine:

from deskapi.models import DeskApi2

Could not figure out how to submit an issue at https://pypi.python.org/pypi/deskapi.

For users who use custom domains with Desk (https://support.desk.com/customer/en/portal/articles/1548-using-your-own-domain-name).

To reproduce:

1. enable requests SSL verification by removing verify=False in models.py
2. set the sitename as you normally would and make a request (to desk account that uses custom domain)

Result:

  File "/Users/dmatt/Projects/deskpush/deskpush/lib/python2.7/site-packages/requests/adapters.py", line 447, in send
    raise SSLError(e, request=request)
requests.exceptions.SSLError: hostname 'example.desk.com' doesn't match 'subdomain.example.com'

where example is your sitename and subdomain.example is your actual custom domain set up in Desk.com.

The source code in the project appears to be missing the LICENSE file defining the BSD

The DeskSessions class internally disables verification of the Desk API server's SSL cert for all HTTP requests it makes to it: https://github.com/eventbrite/deskapi/blob/master/src/deskapi/models.py#L50. This presents a security hazard for anyone using this library since it opens the door to someone performing a man-in-the-middle attack.