Action parameter doesn't longer have to be the first parameter

[GruberMischa]

Description:

The component no longer asumes, that the first parameter is the desired action. Looks throw the list and takes the first acceptable action.
Previously if the api_password parameter was passed and it was the first in the list, the component didn't work.

Pull request in home-assistant.github.io with documentation (if applicable): home-assistant/home-assistant.io#5497

Checklist:

• The code change is tested and works locally.
• Local tests pass with tox. Your PR cannot be merged unless tests pass

couldn't test with tox, because tox command doesn't continue after py35 installdeps:
but flake8, pylint, pydocstyle and py.test are passing

[homeassistant]

Hi @GruberMischa,

It seems you haven't yet signed a CLA. Please do so here.

Once you do that we will be able to review and accept this pull request.

Thanks!

[MartinHjelmare]

button_action = next((
    parameter for parameter in data
    if parameter in self.supported_actions), None)

[GruberMischa]

Added @MartinHjelmare's suggestion

[MartinHjelmare]

Great!

[fabaff]

Documentation update attached because I left api_password out in the first place.

[fabaff]

Works with Firmware 2.56

2018-06-05 17:29:40 INFO (MainThread) [homeassistant.components.http.view] Serving /api/mystrom to 192.168.0.227 (auth: True)
2018-06-05 17:29:40 INFO (MainThread) [homeassistant.components.binary_sensor.mystrom] New myStrom button/action detected: button_green/single
2018-06-05 17:29:40 INFO (MainThread) [homeassistant.core] Bus:Handling <Event state_changed[L]: entity_id=binary_sensor.button_green_single, old_state=None, new_state=<state binary_sensor.button_green_single=off; friendly_name=button_green_single @ 2018-06-05T17:29:40.458983+02:00>>

Now there is an issue: If there is no password provided for one action of the button and that action is triggered then it's logged as login attempt.

2018-06-05 17:30:15 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.0.227

If one uses, let's says, has set login_attempts_threshold: 3 then the IP address is banned and the button is no longer functional even if the other "actions" contain the api_password. A restart of Home Assistant will not help as the IP address is stored in ip_bans.yaml.

[GruberMischa]

So what do you suggest? Adding a warning about this scenario in the docs?
I mean we can't disable the authenticaion for this component, because then this would be vulnerable to brute force attacks.

[fabaff]

So what do you suggest? Adding a warning about this scenario in the docs?

Yes, we will cover this in the docs (55580b9).

[fabaff]

🐦