def test_activity_state_put_then_wrong_scope(self):
        url = TEST_SERVER + '/XAPI/activities/state'
        testagent = '{"name":"jane","mbox":"mailto:jane@example.com"}'
        activityId = "http://www.iana.org/domains/example/"
        stateId = "id:the_state_id"
        activity = Activity(activity_id=activityId)
        activity.save()
        testparams = {"stateId": stateId, "activityId": activityId, "agent": testagent}
        teststate = {"test":"put activity state 1"}
        path = '%s?%s' % (url, urllib.urlencode(testparams))

        oauth_header_resource_params, access_token = self.oauth_handshake(scope_type='state')

        # from_token_and_callback takes a dictionary        
        param_list = oauth_header_resource_params.split(",")
        oauth_header_resource_params_dict = {}
        for p in param_list:
            item = p.split("=")
            oauth_header_resource_params_dict[str(item[0]).strip()] = str(item[1]).strip('"')
        # from_request ignores realm, must remove so not input to from_token_and_callback
        del oauth_header_resource_params_dict['OAuth realm']

        # Create oauth request and add signature
        oauth_request = oauth.Request.from_token_and_callback(access_token, http_method='PUT',
            http_url=path, parameters=oauth_header_resource_params_dict)
        signature_method = oauth.SignatureMethod_HMAC_SHA1()
        signature = signature_method.sign(oauth_request, self.consumer, access_token)
        oauth_header_resource_params += ',oauth_signature="%s"' % signature

        put = self.client.put(path, data=teststate, content_type="application/json",
            Authorization=oauth_header_resource_params, X_Experience_API_Version=settings.XAPI_VERSION)
        self.assertEqual(put.status_code, 204)
        # ==========================================================

        # Set up for Get
        guid = str(uuid.uuid1())
        stmt_data = {"id":guid,"actor":{"objectType": "Agent", "mbox":"mailto:t@t.com", "name":"bob"},
            "verb":{"id": "http://example.com/verbs/passed","display": {"en-US":"passed"}},
            "object": {"id":"act:test_simple_get"}, "authority":{"objectType":"Agent", "mbox":"mailto:jane@example.com"}}
        stmt_post = self.client.post(reverse('lrs:statements'), json.dumps(stmt_data), content_type="application/json",
            Authorization=self.jane_auth, X_Experience_API_Version=settings.XAPI_VERSION)
        self.assertEqual(stmt_post.status_code, 200)

        param = {"statementId":guid}
        path = ('http://testserver/XAPI/statements', urllib.urlencode(param)) % "%s?%s"

        # Use same oauth_headers as before and change the nonce
        oauth_header_resource_params_dict['oauth_nonce'] = 'differ_nonce'

        # create another oauth request
        oauth_request = oauth.Request.from_token_and_callback(access_token, http_method='GET',
            http_url=path, parameters=oauth_header_resource_params_dict)
        signature_method = oauth.SignatureMethod_HMAC_SHA1()
        signature2 = signature_method.sign(oauth_request, self.consumer, access_token)
        # Replace old signature with the new one
        oauth_header_resource_params_new = oauth_header_resource_params.replace('"%s"' % signature, '"%s"' % signature2) 
        # replace headers with the nonce you added in dict
        new_oauth_headers = oauth_header_resource_params_new.replace('oauth_nonce="resource_nonce"','oauth_nonce="differ_nonce"')        
        
        get = self.client.get(path, content_type="application/json",
            Authorization=new_oauth_headers, X_Experience_API_Version=settings.XAPI_VERSION)
        self.assertEqual(get.status_code, 403)
        self.assertEqual(get.content, 'Incorrect permissions to GET at /statements')
dataset/ETHPy150Open adlnet/ADL_LRS/lrs/tests/test_OAuth.py/OAuthTests.test_activity_state_put_then_wrong_scope/swapped operands of `%`