1 files changed, 7 insertions, 2 deletions

@@ -14,8 +14,13 @@ class UploaderController < ApplicationController
       login = request.headers["X-User-Login"].presence
       token = request.headers["X-User-Token"].presence
 
-      # TODO: Replace this.
-      unless authenticate_pokeviewer(login, token)
+      unless login == Rails.application.credentials.uploader_username
+        head :unauthorized
+      end
+
+      unless ActiveSupport::SecurityUtils.secure_compare(
+        ::Digest::SHA256.hexdigest(Rails.application.credentials.uploader_token),
+        ::Digest::SHA256.hexdigest(token))
         head :unauthorized
       end
     end