IVLEDownloader icon indicating copy to clipboard operation
IVLEDownloader copied to clipboard

API key revoked?

Open denunciator opened this issue 6 years ago • 14 comments

See title >> I think your API key got revoked. ~~I'm new to all this (not major) so I don't know how you stored the API key and IDK if just pasting mine over in settingsdialog.cpp:42 and merging is a good idea~~

My key is dy1R6cs39qzjQamrIzX6U

Thanks :D

denunciator avatar Apr 10 '18 02:04 denunciator

https://github.com/yyjhao/IVLEDownloader/blob/6b33c505d7fbce7432a4c537b173da6803231770/IVLEDownloader.pro#L19-L22

Seems like replacing this line with a new API key should work!

I went to https://ivle.nus.edu.sg/api/login/?apikey=dy1R6cs39qzjQamrIzX6U (the page that no longer loads on the current app) and the relevant login page appears.

Also, in case anyone finds this useful/convenient: https://github.com/jamesdjuhartono/IVLE-Downloader/blob/master/src/config.template.py (this ivle downloader requires each user to generate their own API key and overwrite the config file)

luyangkenneth avatar Apr 11 '18 01:04 luyangkenneth

I forked the repo, made some changes, and managed to get it running for macOS! 🌟

See my updated README and download the updated app from here: https://github.com/luyangkenneth/IVLEDownloader

For anyone reading this, do give it a try and let me know whether this works for you! Especially if your Mac is not on High Sierra.

luyangkenneth avatar Apr 11 '18 03:04 luyangkenneth

Yup, that's what I figured. Since you've got it to work on mac I'm gonna try and get it working on windows as well. QT takes a bit of time to install though.

On the author's website, he said that they reduced the API polling rate; is it the case that it was revoked because the requests being sent out exceeded the permissible rate? If that's the case, releasing it into the wild with our API keys would just break it in a couple of days when our own get revoked.

While I try to get it working - any thoughts?

Edit: It looks like /ivlefetcher.cpp:106 and :114 give 5 minute polling intervals - maybe change that to an hour for the time being until we figure out what's safe?

denunciator avatar Apr 11 '18 10:04 denunciator

I've got it working on windows as well, please test

https://github.com/denunciator/IVLEDownloader

and reply here or open an issue. Thank you!

denunciator avatar Apr 11 '18 11:04 denunciator

Yeah that makes sense, I think once per hour is a very reasonable polling rate to switch to 🙂 I'll update the code on my end as well.

I think a longer-term approach might be to have a config file of some sort, and read in the API key from there. In this way, even if previous API keys get revoked, we no longer need to redeploy the entire app to substitute a fresh API key to get things working again.

Of course, this makes the app far less intuitive / user-friendly, as not everyone knows about API keys and how to go about generating their own key. But if the problem comes back then we may have to consider this option more seriously.

luyangkenneth avatar Apr 11 '18 12:04 luyangkenneth

Ah, I'm a little reluctant to do that because this says:

IVLE LAPI will soon be depreciated as we are in the process of revamping the entire API library and replacing it with one that is easier and more secure.

The new set of APIs will be inline with the new structure of the NUS LMS. This is expected to be ready for beta testing sometime in Jan 2018.

So presumably, everything is going to break and a major rework is going to have to be done to get it to work again, at which point working on the python dist might be a better idea.

Assuming the API doesn't undergo a major overhaul and the config is wanted (it's definitely a great idea!) - one could have a button that opens https://ivle.nus.edu.sg/LAPI/default.aspx the same way it opens the login prompt now, have the user authenticate and copy the LAPI key into a field, something like that? I'm not quite sure I'm up to the task but the framework looks to be there now.

denunciator avatar Apr 11 '18 13:04 denunciator

👍👍 I think that suggestion works really well. And you're right, we should probably wait till the new API launches before committing to any decision.

Hopefully we won't need to go down this path because API keys shouldn't be used like this haha.

luyangkenneth avatar Apr 11 '18 14:04 luyangkenneth

@luyangkenneth

I forked the repo, made some changes, and managed to get it running for macOS! 🌟

See my updated README and download the updated app from here: https://github.com/luyangkenneth/IVLEDownloader

For anyone reading this, do give it a try and let me know whether this works for you! Especially if your Mac is not on High Sierra.

Thanks for the work! I'm on 10.12.1 Sierra, it is currently not working with a warning to check with the developer if it is compatible. Unable to run.

Lightlce avatar Apr 15 '18 16:04 Lightlce

@Lightlce check to see if you have Qt 5.5 installed (installed via homebrew with brew install qt55). Don't just do brew install qt as it will probably install qt 5.10, which does not support capybara-webkit anymore (Check here for more info)

louislai avatar Apr 21 '18 03:04 louislai

To avoid having to recompile, we can do a simple patch on the original binary, replacing the hardcoded API key string with a new one. macOS example using @denunciator's API key:

perl -pi -e 's/k0z3B5Ng9rhy3MKVAKsGG/dy1R6cs39qzjQamrIzX6U/g' /path/to/IVLEDownloader.app/Contents/MacOS/IVLEDownloader 

For convenience, I've uploaded the result here: IVLEDownloader.app.zip Windows version: IVLEDownloader.zip

This has the benefit of retaining the statically-linked QT libraries within the .app, so Qt 5.5 is not required. Also, the app won't show up in the dock but will run in the background, just like the original. The drawback is that the new features (retina menu bar icon and lower polling rate) are not included.

whipermr5 avatar Apr 28 '18 08:04 whipermr5

@denunciator Looks like your API key dy1R6cs39qzjQamrIzX6U is not working anymore. https://ivle.nus.edu.sg/api/login/?apikey=dy1R6cs39qzjQamrIzX6U gives me 'nodata' page.

Meanwhile, I'll fork, change the API key to my own and recompile, hopefully it works!

EDIT: I've recompiled the sources, and for some reason it works on my desktop, but it does not on my laptop. Clicking on the 'Login' button results in a blank page, instead of an IVLE log in page.

I compiled the source using Qt 5.5.1, with minGW 4.9.2 as qmake.exe and g++ compiler.

EDIT 2: Recompiled the sources with Qt 5.1.1 with minGW 4.8.3... and it finally worked. Just replace your existing IVLEDownloader.exe with my own at the link below.

https://github.com/andrewome/IVLEDownloader/releases/tag/V1.1.1

Apparently it works on the computer that you're compiling the program on because of some voodoo magic. Lol (something to do with having all the sources/compilers present in the SDK causes it to work?)

andrewome avatar Oct 08 '18 07:10 andrewome

Since the old API key is not working anymore, those who are interested in getting your own API key, you can refer to Gan Soon Bing's comment at https://wiki.nus.edu.sg/display/ivlelapi/Getting+Started

After obtaining your own API key, you can follow @whipermr5 's reply above to get your MAC version of IVLEDownloader working properly without having to compile the source code.

To avoid having to recompile, we can do a simple patch on the original binary, replacing the hardcoded API key string with a new one. macOS example using @denunciator's API key:

perl -pi -e 's/k0z3B5Ng9rhy3MKVAKsGG/dy1R6cs39qzjQamrIzX6U/g' /path/to/IVLEDownloader.app/Contents/MacOS/IVLEDownloader 

For convenience, I've uploaded the result here: IVLEDownloader.app.zip Windows version: IVLEDownloader.zip

This has the benefit of retaining the statically-linked QT libraries within the .app, so Qt 5.5 is not required. Also, the app won't show up in the dock but will run in the background, just like the original. The drawback is that the new features (retina menu bar icon and lower polling rate) are not included.

thomaswqin avatar Oct 15 '18 08:10 thomaswqin

@andrewome Thanks! Mine actually got killed and I got an email:

We notice that you have created a program using LAPI key, which accessing IVLE Announcement, Forum and Files periodically. The pattern is exactly like a DOS attack on the system and it introduces a big drop on system performance. We have blocked your LAPI key. You can send us a request to unblock your LAPI key, after you proved that your program has removed the periodical api calling logic.

Which I thought was quite funny.

Bottom line is, you should probably drastically (and I do mean drastically, like from 1 hour to once every four or five hours or even less) reduce the polling rate and re-release in case yours gets blocked too.

@ me if and when you do this and I'll DL yours, otherwise I might end up contributing to the unfortunate early demise of your key.

denunciator avatar Oct 17 '18 02:10 denunciator

@denunciator Ah... So that is what happened.

After killing your API key, are you allowed to make a new one? If you are, then I am not too concerned; I'll just recompile a new one. But if you are not then I'm very concerned LOL

andrewome avatar Oct 17 '18 04:10 andrewome