From 2c68cf7e9ee6718f83f2209e6b009b02b50bc8f4 Mon Sep 17 00:00:00 2001 From: Ivan Tashkinov Date: Thu, 7 Feb 2019 22:14:06 +0300 Subject: OAuth2 security fixes: redirect URI validation, "Mastodon-Local" security breach fix. (`POST /api/v1/apps` could create "Mastodon-Local" app wth any redirect_uris, and if that happened before /web/login is accessed for the first time then Pleroma used this externally created record with arbitrary redirect_uris and client_secret known by creator). --- lib/pleroma/web/oauth/oauth_controller.ex | 1 + 1 file changed, 1 insertion(+) (limited to 'lib/pleroma/web/oauth/oauth_controller.ex') diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index 4d4e85836..8ec963c79 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -37,6 +37,7 @@ defmodule Pleroma.Web.OAuth.OAuthController do true <- Pbkdf2.checkpw(password, user.password_hash), {:auth_active, true} <- {:auth_active, User.auth_active?(user)}, %App{} = app <- Repo.get_by(App, client_id: client_id), + true <- redirect_uri in String.split(app.redirect_uris), {:ok, auth} <- Authorization.create_authorization(app, user) do # Special case: Local MastodonFE. redirect_uri = -- cgit v1.2.3 From 6a6a5b3251f7137e30b687a9a8448e678446f8b0 Mon Sep 17 00:00:00 2001 From: "Haelwenn (lanodan) Monnier" Date: Sat, 9 Feb 2019 16:16:26 +0100 Subject: de-group alias/es --- lib/pleroma/web/oauth/oauth_controller.ex | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'lib/pleroma/web/oauth/oauth_controller.ex') diff --git a/lib/pleroma/web/oauth/oauth_controller.ex b/lib/pleroma/web/oauth/oauth_controller.ex index 8ec963c79..e4d0601f8 100644 --- a/lib/pleroma/web/oauth/oauth_controller.ex +++ b/lib/pleroma/web/oauth/oauth_controller.ex @@ -5,8 +5,11 @@ defmodule Pleroma.Web.OAuth.OAuthController do use Pleroma.Web, :controller - alias Pleroma.Web.OAuth.{Authorization, Token, App} - alias Pleroma.{Repo, User} + alias Pleroma.Web.OAuth.Authorization + alias Pleroma.Web.OAuth.Token + alias Pleroma.Web.OAuth.App + alias Pleroma.Repo + alias Pleroma.User alias Comeonin.Pbkdf2 plug(:fetch_session) -- cgit v1.2.3