diff options
| author | lambda <pleromagit@rogerbraun.net> | 2019-02-08 12:09:43 +0000 |
|---|---|---|
| committer | lambda <pleromagit@rogerbraun.net> | 2019-02-08 12:09:43 +0000 |
| commit | b4271de7700edc460e81fb72c60a4eb1662a5141 (patch) | |
| tree | 69d0992f5f10364a993989b6cc16a618b931c6d7 /lib/pleroma/web/oauth/oauth_controller.ex | |
| parent | d84392c9e05342a70d3a759ac380dcd41f22ed0e (diff) | |
| parent | 2c68cf7e9ee6718f83f2209e6b009b02b50bc8f4 (diff) | |
| download | pleroma-b4271de7700edc460e81fb72c60a4eb1662a5141.tar.gz | |
Merge branch 'oauth2_strengthening' into 'develop'
OAuth2 security fixes: redirect URI validation, "Mastodon-Local" security breach fix
See merge request pleroma/pleroma!793
Diffstat (limited to 'lib/pleroma/web/oauth/oauth_controller.ex')
| -rw-r--r-- | lib/pleroma/web/oauth/oauth_controller.ex | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index 4d4e85836..8ec963c79 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -37,6 +37,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do true <- Pbkdf2.checkpw(password, user.password_hash), {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, %App{} = app <- Repo.get_by(App, client_id: client_id), + true <- redirect_uri in String.split(app.redirect_uris), {:ok, auth} <- Authorization.create_authorization(app, user) do # Special case: Local MastodonFE. redirect_uri = |