Get mailinglist api secret from env variables

website/mailinglists/api/permissions.py

-import hashlib
-
 from rest_framework import permissions
 
+from thaliawebsite import settings
+
 
 class MailingListPermission(permissions.BasePermission):
     """
@@ -13,7 +13,6 @@ class MailingListPermission(permissions.BasePermission):
             return True
 
         if 'secret' in request.GET:
-            apihash = hashlib.sha1(request.GET['secret']
-                                   .encode('utf-8')).hexdigest()
-            return apihash == 'cb004452d9c80e295bebfc778871b3b082d70ad8'
+            return (request.GET['secret'].encode('utf-8')
+                    == settings.MAILINGLIST_API_SECRET)
         return False

website/thaliawebsite/settings/production.py

@@ -79,6 +79,7 @@ PASSWORD_HASHERS = [
 WIKI_API_KEY = os.environ.get('WIKI_API_KEY', 'changeme')
 MIGRATION_KEY = os.environ.get('MIGRATION_KEY')
 PUSH_NOTIFICATIONS_API_KEY = os.environ.get('PUSH_NOTIFICATIONS_API_KEY', '')
+MAILINGLIST_API_SECRET = os.environ.get('MAILINGLIST_API_SECRET', '')
 
 if os.environ.get('DJANGO_SSLONLY'):
     SECURE_SSL_REDIRECT = True

website/thaliawebsite/settings/settings.py

@@ -265,6 +265,9 @@ PARTNER_EMAIL = "samenwerking@thalia.nu"
 # Push notifications API key
 PUSH_NOTIFICATIONS_API_KEY = ''
 
+# Mailinglist API key
+MAILINGLIST_API_SECRET = ''
+
 # Photos settings
 PHOTO_UPLOAD_SIZE = 1920, 1080