Merge pull request #167 from Sophist-UK/sophist_mblogin_calls_use_SSL

Use SSL for personal data, see PICARD-337.

NEWS.txt

@@ -11,6 +11,7 @@
  * Fix Options / File naming examples to handle primary/secondary release types (PICARD-516)
  * A new advanced option is available to permanently set the starting directory
    for the file browser and "Add files/folder" buttons.
+ * Requests to Musicbrainz against your own account e.g. for collections are now handled through SSL (PICARD-337)
 
 Version 1.2 - 2013-03-30
  * Picard now requires at least Python 2.6

picard/const.py

@@ -861,3 +861,9 @@ ALIAS_LOCALES = {
     u'zu': 'Zulu',
     u'zu_ZA': 'Zulu (South Africa)',
 }
+
+# List of official musicbrainz servers - must support SSL for mblogin requests (such as collections).
+MUSICBRAINZ_SERVERS = [
+    'musicbrainz.org',
+    'beta.musicbrainz.org',
+]

picard/ui/options/general.py

@@ -21,6 +21,7 @@ from picard import config
 from picard.ui.options import OptionsPage, register_options_page
 from picard.ui.ui_options_general import Ui_GeneralOptionsPage
 from picard.util import rot13
+from picard.const import MUSICBRAINZ_SERVERS
 
 
 class GeneralOptionsPage(OptionsPage):
@@ -32,7 +33,7 @@ class GeneralOptionsPage(OptionsPage):
     ACTIVE = True
 
     options = [
-        config.TextOption("setting", "server_host", "musicbrainz.org"),
+        config.TextOption("setting", "server_host", MUSICBRAINZ_SERVERS[0]),
         config.IntOption("setting", "server_port", 80),
         config.TextOption("setting", "username", ""),
         config.PasswordOption("setting", "password", ""),
@@ -44,10 +45,7 @@ class GeneralOptionsPage(OptionsPage):
         super(GeneralOptionsPage, self).__init__(parent)
         self.ui = Ui_GeneralOptionsPage()
         self.ui.setupUi(self)
-        mirror_servers = [
-            "musicbrainz.org",
-        ]
-        self.ui.server_host.addItems(sorted(mirror_servers))
+        self.ui.server_host.addItems(MUSICBRAINZ_SERVERS)
 
     def load(self):
         self.ui.server_host.setEditText(config.setting["server_host"])

picard/webservice.py

@@ -37,7 +37,8 @@ from picard.const import (ACOUSTID_KEY,
                           ACOUSTID_HOST,
                           ACOUSTID_PORT,
                           CAA_HOST,
-                          CAA_PORT)
+                          CAA_PORT,
+                          MUSICBRAINZ_SERVERS)
 
 
 REQUEST_DELAY = defaultdict(lambda: 1000)
@@ -168,8 +169,12 @@ class XmlWebService(QtCore.QObject):
 
     def _start_request(self, method, host, port, path, data, handler, xml,
                        mblogin=False, cacheloadcontrol=None):
-        log.debug("%s http://%s:%d%s", method, host, port, path)
-        url = QUrl.fromEncoded("http://%s:%d%s" % (host, port, path))
+        if mblogin and host in MUSICBRAINZ_SERVERS and port==80:
+            urlstring = "https://%s%s" % (host, path)
+        else:
+            urlstring = "http://%s:%d%s" % (host, port, path)
+        log.debug("%s %s", method, urlstring)
+        url = QUrl.fromEncoded(urlstring)
         if mblogin:
             url.setUserName(config.setting["username"])
             url.setPassword(config.setting["password"])