hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#1427] Extra check that admin OAuth scope is used by admin. Adjusted tests.

Browse source
This commit is contained in:
Ivan Tashkinov 2019-12-07 17:49:53 +03:00
commit 1770602747
4 changed files with 67 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/pleroma/user.ex
View file

@ -1736,7 +1736,8 @@ defmodule Pleroma.User do
with {:ok, updated_user} <- update_and_set_cache(changeset) do
if user.is_admin && !updated_user.is_admin do
# Tokens & authorizations containing any admin scopes must be revoked (revoking all)
# Tokens & authorizations containing any admin scopes must be revoked (revoking all).
# This is an extra safety measure (tokens' admin scopes won't be accepted for non-admins).
global_sign_out(user)
end