How to set schedules direct username/password?

[reven]

Hi,

I'm trying to set the username/password for schedules direct via the API.

I'm able to decode the username/password using

Code:

NShared.SchedulesDirectEPGSource.GetStoredUsername();
NShared.SchedulesDirectEPGSource.GetStoredPassword();

But not sure how I can set them, is there any API call? Or can you tell me the encryption method used (assuming its using some kinda of machine specific secret?)

Cheers

[mvallevand]

I would refuse to accept other apps could get my SD account information without my permission. I can trust web console to a point but the access is open source so it quickly exposes this method to others. If sub goes ahead with this I will make my objects known to SD for both NextPVR and Web Consoles approved use. Bottom line is this should be entered again (how hard is that) and stored securely be web console.

Martin

[sub]

I'd have to agree with Martin on this one. I was careful enough with user's data to encrypt these details in the config files, but I hadn't really anticipated plugins calling my own internal functions for decrypting them.

If you need this information, you'll really need to ask the user for it. You can call SchedulesDirectEPGSource.UpdateCache(username, password) to store it after they've entered it, and the system will then be able to use it when it updates the EPG. I'd suggest you don't store copies of this info yourself, other than maybe the username.

I've removed these GetStoredUsername/GetStoredPassword calls for the next release. (note to self...was I wrong to choose to not obfuscate the internals when I moved to nextpvr...)

[reven]

I don't really care about getting the actual password, I would like to still get the username. There is no serious security issue with allowing an app to get the username.

I want a username/password box on the page. The username will be plain text, the password will be a password field.

I want an API call to update the schedules direct username/password if they have changed.

I'm using NextPVR api calls to retrieve the schedules direct data, and not calling SD directly, so that is why I dont actually need the password, just need to be able to set the password.

So can you please keep the ability to get the username of schedules direct and also add the ability to set the username/password which nextpvr would then encrypt and store?

[reven]

I would refuse to accept other apps could get my SD account information without my permission. I can trust web console to a point but the access is open source so it quickly exposes this method to others. If sub goes ahead with this I will make my objects known to SD for both NextPVR and Web Consoles approved use. Bottom line is this should be entered again (how hard is that) and stored securely be web console.

Martin

I'm not storing these, I only allowing an interface to set these in NextPVR. the webconsole is a web interface to configure nextpvr, so most settings/configuration are saved back into NextPVR and not saved to the webconsole database.

The only settings saved to the web console database are
- users
- channels (so if using the Users feature each user has their own channels)
- channel groups (so if using the Users feature each user has their own channel groups)
- web console specific settings
- some misc tables for speed, like xmltv sources, it stores the filename and list of channels so when you edit the channels it doesnt have to reread the xml file again and again.

I dont save things like
- Devices
- EPG guide data
- Recording info
- Scheduled recordings
- schedules direct auth details.

[sub]

I don't really care about getting the actual password, I would like to still get the username. There is no serious security issue with allowing an app to get the username.

I want a username/password box on the page. The username will be plain text, the password will be a password field.

I want an API call to update the schedules direct username/password if they have changed.

I'm using NextPVR api calls to retrieve the schedules direct data, and not calling SD directly, so that is why I dont actually need the password, just need to be able to set the password.

So can you please keep the ability to get the username of schedules direct and also add the ability to set the username/password which nextpvr would then encrypt and store?

Fair enough. I've reinstated SchedulesDirectEPGSource.GetStoredUsername() for the next build. You can use the SchedulesDirectEPGSource.UpdateCache() call to store the username/password.

[reven]

I see I can only update both the username and password at the same time.

But it is possible that someone changes the username field without changing the password field, in which case I won't know their password to update.

Can you make it so, if the passed in fields are blank, don't update that field. If they are empty then yes, update the fields to be empty.

eg

Code:

source.UpdateCache(null, "newpassword"); //only updates password
source.UpdateCache("new user", null); // only updates user
source.UpdateCache("", ""); // clears both username/password

?

[sub]

Ok. For the next release I've updated it to accept null, and treat that as 'unchanged'.

[reven]

cool thanks sub

[mvallevand]

Fair enough, I have no issue if the exposing the password isn't in question.

Martin