xerusmsp / msp-py

A minimalistic and fast Python handler for requests to the MSP API.
Do What The F*ck You Want To Public License
14 stars 13 forks source link

error Unauthorized for requests including datetime #4

Closed hatns closed 1 year ago

hatns commented 1 year ago

Requests including dates do not get past the checksum check.

def post_wall(target_id, message):
    _, resp = invoke_method(
        "gb",
        "MovieStarPlanet.WebService.Profile.AMFProfileService.PostToWallWithModerationCall",
        [
            ticket_header(actor.ticket),
            target_id,
            actor.actor_id,
            actor.username,
            message,
            datetime.datetime.now(),
            False,
            0,
            False
        ],
        get_session_id()
    )
    return resp
print(post_wall(63521612, "test"))

Returns ErrorFault level=error code='Server.Processing' description='Unauthorized'

It is possible to verifiy the datetime is causing the issue, modifying datetime to an integer will allow the request through and return None. Only in the situation where there is no datetime present will the request return None, otherwise always Unauthorized.

Looking into checksum the problem becomes less obvious,

#msp-py checksum
if isinstance(obj, (date, datetime)):
    return obj.strftime('%Y%m%d')
// msp actionscript checksum
if(param1 is Date)
    {
        _loc2_ = param1 as Date;
        return _loc2_.fullYearUTC + String(_loc2_.monthUTC) + _loc2_.dateUTC;
    }

Comparing the two almost makes the issue more confusing, they look the same at a first glance. Maybe the problem stems somewhere from the precision of date? However more likely is the issue stemming in the formatting. Python datetime module .strftime() pads with 0's while actionscript does not. Potential fix (which does not work):

if isinstance(obj, (date, datetime)):
    Y = obj.strftime("%Y")
    M = obj.strftime("%m").removeprefix("0")
    D = obj.strftime("%d").removeprefix("0")
    return Y+M+D
The issue MAY stem from requiring a connection to a websocket, but highly unlikely.