nrd.li/akkoma
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Merge branch 'bugfix/oauth-token-padding' into 'develop'

Browse source 
oauth: never use base64 padding when returning tokens to applications

See merge request pleroma/pleroma!825
This commit is contained in:
lambda 2019-02-15 14:58:13 +00:00
parent 921571c19b e9ef4b8da6
commit 1ce1b7b58d
4 changed files with 12 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
lib/pleroma/web/oauth/app.ex
View file

@ -25,8 +25,14 @@ def register_changeset(struct, params \\ %{}) do
if changeset.valid? do if changeset.valid? do
changeset changeset
|> put_change(:client_id, :crypto.strong_rand_bytes(32) |> Base.url_encode64()) |> put_change(
|> put_change(:client_secret, :crypto.strong_rand_bytes(32) |> Base.url_encode64()) :client_id,
:crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
)
|> put_change(
:client_secret,
:crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
)
else else
changeset changeset
end end

2
lib/pleroma/web/oauth/authorization.ex
View file

@ -24,7 +24,7 @@ defmodule Pleroma.Web.OAuth.Authorization do
end end
def create_authorization(%App{} = app, %User{} = user) do def create_authorization(%App{} = app, %User{} = user) do
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
authorization = %Authorization{ authorization = %Authorization{
token: token, token: token,

2
lib/pleroma/web/oauth/oauth_controller.ex
View file

@ -173,7 +173,7 @@ defp fix_padding(token) do
token token
|> URI.decode() |> URI.decode()
|> Base.url_decode64!(padding: false) |> Base.url_decode64!(padding: false)
|> Base.url_encode64() |> Base.url_encode64(padding: false)
end end
defp get_app_from_request(conn, params) do defp get_app_from_request(conn, params) do

4
lib/pleroma/web/oauth/token.ex
View file

@ -31,8 +31,8 @@ def exchange_token(app, auth) do
end end
def create_token(%App{} = app, %User{} = user) do def create_token(%App{} = app, %User{} = user) do
token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64() refresh_token = :crypto.strong_rand_bytes(32) |> Base.url_encode64(padding: false)
token = %Token{ token = %Token{
token: token, token: token,