Added authentication to Plex OAuth API endpoints to enforce authentication across all relevant routes.

morpheus65535 · morpheus65535 · commit f9a8a9514944 · 2026-03-31T20:03:38.000-04:00
diff --git a/bazarr/api/plex/oauth.py b/bazarr/api/plex/oauth.py
@@ -5,7 +5,6 @@
 import uuid
 import requests
 import xml.etree.ElementTree as ET
-import logging
 from datetime import datetime
 from concurrent.futures import ThreadPoolExecutor, as_completed
 from urllib.parse import quote_plus
@@ -21,6 +20,7 @@
 from app.config import settings, write_config
 from app.logger import logger
 from utilities.plex_utils import _get_library_locations
+from ..utils import authenticate
 
 def _update_plexapi_headers():
     """Update plexapi headers to show Bazarr identity in Plex.
@@ -241,6 +241,7 @@ class PlexPin(Resource):
     post_request_parser = reqparse.RequestParser()
     post_request_parser.add_argument('clientId', type=str, required=False, help='Client ID')
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -304,12 +305,14 @@ def post(self):
                 'code': 'PLEX_CONNECTION_ERROR'
             }, 503
 
+    @authenticate
     def get(self):
         abort(405, "Method not allowed. Use POST.")
 
 
 @api_ns_plex.route('plex/oauth/pin/<string:pin_id>/check')
 class PlexPinCheck(Resource):
+    @authenticate
     def get(self, pin_id):
         try:
             state_param = request.args.get('state')
@@ -406,6 +409,7 @@ def get(self, pin_id):
 
 @api_ns_plex.route('plex/oauth/validate')
 class PlexValidate(Resource):
+    @authenticate
     def get(self):
         try:
             auth_method = settings.plex.get('auth_method', 'apikey')
@@ -441,6 +445,7 @@ def get(self):
 
 @api_ns_plex.route('plex/oauth/servers')
 class PlexServers(Resource):
+    @authenticate
     def get(self):
         try:
             decrypted_token = get_decrypted_token()
@@ -582,6 +587,7 @@ def test_connection_wrapper(conn_data):
 
 @api_ns_plex.route('plex/oauth/libraries')
 class PlexLibraries(Resource):
+    @authenticate
     def get(self):
         try:
             decrypted_token = get_decrypted_token()
@@ -737,6 +743,7 @@ def get(self):
 class PlexLogout(Resource):
     post_request_parser = reqparse.RequestParser()
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -769,6 +776,7 @@ def post(self):
 class PlexEncryptApiKey(Resource):
     post_request_parser = reqparse.RequestParser()
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -787,6 +795,7 @@ class PlexApiKey(Resource):
     post_request_parser = reqparse.RequestParser()
     post_request_parser.add_argument('apikey', type=str, required=True, help='API key')
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -817,6 +826,7 @@ class PlexTestConnection(Resource):
     post_request_parser = reqparse.RequestParser()
     post_request_parser.add_argument('uri', type=str, required=True, help='Server URI')
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         args = self.post_request_parser.parse_args()
@@ -853,12 +863,14 @@ def post(self):
         except Exception as e:
             return {'success': False, 'error': str(e)}
 
+    @authenticate
     def get(self):
         abort(405, "Method not allowed. Use POST.")
 
 
 @api_ns_plex.route('plex/select-server')
 class PlexSelectServer(Resource):
+    @authenticate
     def get(self):
         try:
             server_info = {
@@ -883,6 +895,7 @@ def get(self):
     post_request_parser.add_argument('local', type=str, required=False, default='false', help='Is local connection')
     post_request_parser.add_argument('connections', type=list, location='json', required=False, help='All available connection URIs')
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         args = self.post_request_parser.parse_args()
@@ -917,6 +930,7 @@ def post(self):
 class PlexWebhookCreate(Resource):
     post_request_parser = reqparse.RequestParser()
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -1035,6 +1049,7 @@ def post(self):
 
 @api_ns_plex.route('plex/webhook/list')
 class PlexWebhookList(Resource):
+    @authenticate
     def get(self):
         try:
             decrypted_token = get_decrypted_token()
@@ -1090,6 +1105,7 @@ class PlexWebhookDelete(Resource):
     post_request_parser = reqparse.RequestParser()
     post_request_parser.add_argument('webhook_url', type=str, required=True, help='Webhook URL to delete')
 
+    @authenticate
     @api_ns_plex.doc(parser=post_request_parser)
     def post(self):
         try:
@@ -1133,6 +1149,7 @@ def post(self):
 class PlexAutopulseConfig(Resource):
     get_request_parser = reqparse.RequestParser()
 
+    @authenticate
     @api_ns_plex.doc(parser=get_request_parser)
     def get(self):
         try:
