idan/oauthlib — pull request #187 by Ryan-K (2013-07-03 03:13:03+00:00)
Title: Check to ensure that the requested realm is actually the required realm

There's some issues with the way that realms are handled, but I think this change solves all of the use cases that I'm aware of. I'm not entirely sure what the `(not require_resource_owner and not request.realm)` condition supports and its very possible that this change breaks that.

As of 0.4.2, the only condition that needs to be met is that the supplied realm is permitted by the supplied client_key. `required_realm` is never checked and the realm check could be bypassed entirely by simply not specifying a realm header!

One could even argue that the header isn't necessary as the required realm is specified in the call to `verify_request`, client key is also known via the headers, and there's a `validate_requested_realm` provided that ensures that pair is valid.

It's possible that there's an issue with the way that flask_oauthprovider is interacting with oauthlib, but this seems like a glaring issue. I understand that the Server is being refactored, but until that happens and flask_oauthprovider gets updated, this change will be necessary.