go.tools/dashboard/app: only accept commits when given master key

R=dvyukov, rsc
CC=golang-dev
https://golang.org/cl/37790044

app/build/handler.go

@@ -17,6 +17,7 @@ import (
 
 	"appengine"
 	"appengine/datastore"
+
 	"cache"
 )
 
@@ -47,6 +48,9 @@ func commitHandler(r *http.Request) (interface{}, error) {
 	if r.Method != "POST" {
 		return nil, errBadMethod(r.Method)
 	}
+	if !isMasterKey(c, r.FormValue("key")) {
+		return nil, errors.New("can only POST commits with master key")
+	}
 
 	// POST request
 	defer r.Body.Close()
@@ -433,13 +437,11 @@ func validHash(hash string) bool {
 }
 
 func validKey(c appengine.Context, key, builder string) bool {
-	if appengine.IsDevAppServer() {
+	return isMasterKey(c, key) || key == builderKey(c, builder)
-		return true
+}
-	}
+
-	if key == secretKey(c) {
+func isMasterKey(c appengine.Context, key string) bool {
-		return true
+	return appengine.IsDevAppServer() || key == secretKey(c)
-	}
-	return key == builderKey(c, builder)
 }
 
 func builderKey(c appengine.Context, builder string) string {