send access_tokens correctly

2 files changed, 10 insertions, 15 deletions

diff --git a/synapse/rest/client/v1/profile.py b/synapse/rest/client/v1/profile.py
index e95320a353..ab2c9cdb8c 100644
--- a/synapse/rest/client/v1/profile.py
+++ b/synapse/rest/client/v1/profile.py
@@ -73,11 +73,10 @@ class ProfileDisplaynameRestServlet(ClientV1RestServlet):
         # TODO: retries
         shadow_hs_url = self.hs.config.shadow_server.get("hs_url")
         as_token = self.hs.config.shadow_server.get("as_token")
-        body['access_token'] = as_token
 
         yield self.http_client.post_json_get_json(
-            "%s%s" % (
-                shadow_hs_url, ("/_matrix/client/r0/profile/%s/displayname" % user_id)
+            "%s/_matrix/client/r0/profile/%s/displayname?access_token=%s" % (
+                shadow_hs_url, user_id, as_token
             ),
             body
         )
@@ -133,11 +132,10 @@ class ProfileAvatarURLRestServlet(ClientV1RestServlet):
         # TODO: retries
         shadow_hs_url = self.hs.config.shadow_server.get("hs_url")
         as_token = self.hs.config.shadow_server.get("as_token")
-        body['access_token'] = as_token
 
         yield self.http_client.post_json_get_json(
-            "%s%s" % (
-                shadow_hs_url, ("/_matrix/client/r0/profile/%s/avatar_url" % user_id)
+            "%s/_matrix/client/r0/profile/%s/avatar_url?access_token=%s" % (
+                shadow_hs_url, user_id, as_token
             ),
             body
         )
diff --git a/synapse/rest/client/v2_alpha/account.py b/synapse/rest/client/v2_alpha/account.py
index d75a0558bf..8904882f01 100644
--- a/synapse/rest/client/v2_alpha/account.py
+++ b/synapse/rest/client/v2_alpha/account.py
@@ -191,11 +191,10 @@ class PasswordRestServlet(RestServlet):
         # TODO: retries
         shadow_hs_url = self.hs.config.shadow_server.get("hs_url")
         as_token = self.hs.config.shadow_server.get("as_token")
-        body['access_token'] = as_token
 
         yield self.http_client.post_json_get_json(
-            "%s%s" % (
-                shadow_hs_url, "/_matrix/client/r0/account/password"
+            "%s/_matrix/client/r0/account/password?access_token=%s" % (
+                shadow_hs_url, as_token
             ),
             body
         )
@@ -403,11 +402,10 @@ class ThreepidRestServlet(RestServlet):
         # TODO: retries
         shadow_hs_url = self.hs.config.shadow_server.get("hs_url")
         as_token = self.hs.config.shadow_server.get("as_token")
-        body['access_token'] = as_token
 
         yield self.http_client.post_json_get_json(
-            "%s%s" % (
-                shadow_hs_url, "/_matrix/client/r0/account/3pid"
+            "%s/_matrix/client/r0/account/3pid?access_token=%s" % (
+                shadow_hs_url, as_token
             ),
             body
         )
@@ -462,11 +460,10 @@ class ThreepidDeleteRestServlet(RestServlet):
         # TODO: retries
         shadow_hs_url = self.hs.config.shadow_server.get("hs_url")
         as_token = self.hs.config.shadow_server.get("as_token")
-        body['access_token'] = as_token
 
         yield self.http_client.post_json_get_json(
-            "%s%s" % (
-                shadow_hs_url, "/_matrix/client/r0/account/3pid/delete"
+            "%s/_matrix/client/r0/account/3pid/delete?access_token=%s" % (
+                shadow_hs_url, as_token
             ),
             body
         )