hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge pull request 'OAuth: require security scopes for /api/oauth_tokens' (#8013) from lambadalambda/pleroma:fix/oauth-tokens-scopes into develop

Browse source 
Reviewed-on: https://git.pleroma.social/pleroma/pleroma/pulls/8013
This commit is contained in:
lain 2026-10-27 07:08:34 +00:00
commit 745926189f
4 changed files with 50 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/pleroma/web/o_auth/token_controller.ex
View file

@ -13,7 +13,8 @@ defmodule Pleroma.Web.OAuth.TokenController do
require Logger
plug(:skip_auth when action == :confirm_email)
plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])
plug(OAuthScopesPlug, %{scopes: ["read:security"]} when action == :oauth_tokens)
plug(OAuthScopesPlug, %{scopes: ["write:security"]} when action == :revoke_token)
action_fallback(:errors)