Fixed a horrible security issue in the OAuth plugin.

Also added some real triggering logic to the OAuthAuth Auth object.

mediagoblin/plugins/oauth/__init__.py

@@ -48,8 +48,11 @@ def setup_plugin():
 
 class OAuthAuth(Auth):
     def trigger(self, request):
+        if 'access_token' in request.GET:
             return True
 
+        return False
+
     def __call__(self, request, *args, **kw):
         access_token = request.GET.get('access_token')
         if access_token:
@@ -60,9 +63,9 @@ class OAuthAuth(Auth):
                 return False
 
             request.user = token.user
-
             return True
 
+        return False
 
 hooks = {
     'setup': setup_plugin,