Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/iprima.py (Python)

Code before:
        login_page = self._download_webpage(
            f'{self._AUTH_ROOT}/oauth2/login', None, note='Downloading login page',
            errnote='Downloading login page failed')

        login_form = self._hidden_inputs(login_page)

        login_form.update({
            '_email': username,
            '_password': password})

        profile_select_html, login_handle = self._download_webpage_handle(
            f'{self._AUTH_ROOT}/oauth2/login', None, data=urlencode_postdata(login_form),
            note='Logging in')

        # a profile may need to be selected first, even when there is only a single one
        if '/profile-select' in login_handle.geturl():
            profile_id = self._search_regex(
                r'data-identifier\s*=\s*["\']?(\w+)["\']?',
                profile_select_html, 'profile id')

            profile_select_url = f'{self._AUTH_ROOT}/user/profile-select-perform/{profile_id}'
            query = {'continueUrl': '/user/login?redirect_uri=/user/'}

            login_handle = self._request_webpage(
                profile_select_url, None, query=query,
                note='Selecting profile')

        code = traverse_obj(login_handle.geturl(), ({parse_qs}, 'code', 0))
        if not code:
            raise ExtractorError('Login failed', expected=True)

        token_request_data = {
            'scope': 'openid+email+profile+phone+address+offline_access',
            'client_id': 'prima_sso',
            'grant_type': 'authorization_code',
            'code': code,
            'redirect_uri': f'{self._AUTH_ROOT}/sso/auth-check'}

        token_data = self._download_json(
            f'{self._AUTH_ROOT}/oauth2/token', None,
            note='Downloading token', errnote='Downloading token failed',
            data=urlencode_postdata(token_request_data))

        self.access_token = token_data.get('access_token')
        if self.access_token is None:
            raise ExtractorError('Getting token failed', expected=True)

    def _real_initialize(self):
        if not self.access_token:
            self.raise_login_required('Login is required to access any iPrima content', method='password')


Review comment (security):
```suggestion
            login_handle = self._request_webpage(
                f'{self._AUTH_ROOT}/user/profile-select-perform/{profile_id}', None,
                query={'continueUrl': '/user/login?redirect_uri=/user/'}, note='Selecting profile')
```

Code after:
        login_page = self._download_webpage(
            f'{self._AUTH_ROOT}/oauth2/login', None, note='Downloading login page',
            errnote='Downloading login page failed')

        login_form = self._hidden_inputs(login_page)

        login_form.update({
            '_email': username,
            '_password': password})

        profile_select_html, login_handle = self._download_webpage_handle(
            f'{self._AUTH_ROOT}/oauth2/login', None, data=urlencode_postdata(login_form),
            note='Logging in')

        # a profile may need to be selected first, even when there is only a single one
        if '/profile-select' in login_handle.geturl():
            profile_id = self._search_regex(
                r'data-identifier\s*=\s*["\']?(\w+)', profile_select_html, 'profile id')

            login_handle = self._request_webpage(
                f'{self._AUTH_ROOT}/user/profile-select-perform/{profile_id}', None,
                query={'continueUrl': '/user/login?redirect_uri=/user/'}, note='Selecting profile')

        code = traverse_obj(login_handle.geturl(), ({parse_qs}, 'code', 0))
        if not code:
            raise ExtractorError('Login failed', expected=True)

        token_request_data = {
            'scope': 'openid+email+profile+phone+address+offline_access',
            'client_id': 'prima_sso',
            'grant_type': 'authorization_code',
            'code': code,
            'redirect_uri': f'{self._AUTH_ROOT}/sso/auth-check'}

        token_data = self._download_json(
            f'{self._AUTH_ROOT}/oauth2/token', None,
            note='Downloading token', errnote='Downloading token failed',
            data=urlencode_postdata(token_request_data))

        self.access_token = token_data.get('access_token')
        if self.access_token is None:
            raise ExtractorError('Getting token failed', expected=True)

    def _real_initialize(self):
        if not self.access_token:
            self.raise_login_required('Login is required to access any iPrima content', method='password')

    def _raise_access_error(self, error_code):
        if error_code == 'PLAY_GEOIP_DENIED':
            self.raise_geo_restricted(countries=['CZ'], metadata_available=True)
        elif error_code is not None: