Merge remote-tracking branch 'sec_fixes/negate' into master

cps/gdrive.py

@@ -123,18 +123,17 @@ def revoke_watch_gdrive():
 
 @gdrive.route("/gdrive/watch/callback", methods=['GET', 'POST'])
 def on_received_watch_confirmation():
-    log.debug('%r', request.headers)
-    if request.headers.get('X-Goog-Channel-Token') == gdrive_watch_callback_token \
-            and request.headers.get('X-Goog-Resource-State') == 'change' \
-            and request.data:
-
-        data = request.data
+    if request.headers.get('X-Goog-Channel-Token') != gdrive_watch_callback_token \
+            or request.headers.get('X-Goog-Resource-State') != 'change' \
+            or not request.data:
+        return redirect(url_for('admin.configuration'))
 
-        def updateMetaData():
+    log.debug('%r', request.headers)
+    log.debug('%r', request.data)
     log.info('Change received from gdrive')
-            log.debug('%r', data)
+
     try:
-                j = json.loads(data)
+        j = json.loads(request.data)
         log.info('Getting change details')
         response = gdriveutils.getChangeById(gdriveutils.Gdrive.Instance().drive, j['id'])
         log.debug('%r', response)
@@ -156,5 +155,4 @@ def on_received_watch_confirmation():
                 calibre_db.reconnect_db(config, ub.app_DB_path)
     except Exception as e:
         log.exception(e)
-        updateMetaData()
     return ''