[Security/Privacy] Totally removed the main hubiC password from hubicfuse

Hello,

the oAuth philosophy is to grant a third party (the app) some privileges on part of the resources of the user, so that the app can work on this resources with its own credentials, and especially WITHOUT the main password of the user.

It is true hubiC implemented things partly, but now they did some effort on documentation.
See: https://api.hubic.com/docs/

So, running an 'app' (hubicfuse here) and having to give the main password, especially since this password is in clear text on a file is an obvious security and privacy risk.

The idea is then to run only with the app's credentials. On the documentation above, it is called: "server side flow". For that you need to get a refresh_token on top of the app's id/secret.

To get this refresh_token, you can run the script conveniently provided, or if you don't trust it (and don't want to bother trying to read it!), you can follow the hubic's documentation and do your own curl/wget.

Once you have that refresh token, all you need in the configuration file is:
client_id
client_secret
refresh_token

No more user's password !..

Silver lining, the connection to hubic is now done with only 1 single request, instead of 3 previously.


OPTION: optionally, hubicfuse could accept both modes of connection. For those who don't bother about very basic security, or even bother less running a script... it could still use the password as a fall-back when the refresh_token is NOT provided.

Anyway, if you chose to keep both connection modes:
- you should NOT grant more privileges than necessary (eg. credentials.r,usage.r is ALL you need)
- when/if using the password, you should use the "Implicit grant flow" (see link above) that is "only" 2 requests as it does not go through the 'code' and generation of a 'refresh_token', you directly get the 'access_token' after the 2nd request.


Best regards!


P.S.: with the script, is also included the French translation for messages of that script. If you prefer French messages, put the translation file and the script in the same directory.
... you can also translate to whatever language with the same technique!