Help for ReefDose

[Elwinmage]

Hi, I'm currently developping a card for homeassistant system.
If someone with a Reefdose could execute the follwing script (with his credentials) it would help me to know if the uid of supplement depends on user or not.
Thx a lot

```
#!/usr/bin/python

import httpx
import json

uname="__TO_REPLACE__"
passwd="__TO_REPLACE__"

header={
"Authorization": "Basic Z0ZqSHRKcGE6Qzlmb2d3cmpEV09SVDJHWQ==",
"Content-Type": "application/x-www-form-urlencoded"
}
payload="grant_type=password&username=" + uname + "&password=" + passwd

r= httpx.post("https://cloud.reef-beat.com/oauth/token",data=payload,headers=header,verify=False)
token=r.json()["access_token"]
header={"Authorization": "Bearer %s"%token}
urls=["https://cloud.reef-beat.com/reef-dosing/supplement",
"https://cloud.reef-beat.com/reef-dosing/bundled-supplements/reef_care"]
for url in urls:
print('################################################################################')
print('# %s'%url)
r=httpx.get(url,headers=header)
if r.status_code != 200:
print(r.status_code)
print(json.dumps(r.json(),indent=4))
```

 

[cdemoss01]

Bumping.. the problem with this code is that there could be a script injector in here and you can steal people information.

 

[Elwinmage]

If you know a little python, or other programming language you will see that it's only connection to redsea serveur :-)

And script injection is not what you think, yout can not do script injection with get a URL without parameters.

The problem with forums is people who don't know anything but still give their opinion.
For your culture https://en.wikipedia.org/wiki/Code_...ript injection are,for HTML code or scripting.