hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix(oauth): require security scopes to list and revoke tokens

Browse source 
/api/oauth_tokens skipped the scope check, so a token with any scope
could list the user's sessions and revoke them.
This commit is contained in:
Lain Soykaf 2026-10-26 12:21:47 +04:00
commit c686b701dd
No known key found for this signature in database
4 changed files with 50 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/pleroma/web/o_auth/token_controller.ex
View file

@ -13,7 +13,8 @@ defmodule Pleroma.Web.OAuth.TokenController do
require Logger
plug(:skip_auth when action == :confirm_email)
plug(:skip_plug, OAuthScopesPlug when action in [:oauth_tokens, :revoke_token])
plug(OAuthScopesPlug, %{scopes: ["read:security"]} when action == :oauth_tokens)
plug(OAuthScopesPlug, %{scopes: ["write:security"]} when action == :revoke_token)
action_fallback(:errors)