hj/pleroma
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[#3112] Allowed revoking same-user token from any apps. Added tests.

Browse source
This commit is contained in:
Ivan Tashkinov 2020-11-30 21:55:48 +03:00
commit d50a3345ae
3 changed files with 39 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/pleroma/web/masto_fe_controller.ex
View file

@ -6,8 +6,8 @@ defmodule Pleroma.Web.MastoFEController do
use Pleroma.Web, :controller
alias Pleroma.User
alias Pleroma.Web.OAuth.Token
alias Pleroma.Web.MastodonAPI.AuthController
alias Pleroma.Web.OAuth.Token
alias Pleroma.Web.Plugs.EnsurePublicOrAuthenticatedPlug
alias Pleroma.Web.Plugs.OAuthScopesPlug

6
lib/pleroma/web/o_auth/o_auth_controller.ex
View file

@ -379,9 +379,9 @@ defmodule Pleroma.Web.OAuth.OAuthController do
render_invalid_credentials_error(conn)
end
def token_revoke(%Plug.Conn{} = conn, %{"token" => _token} = params) do
with {:ok, app} <- Token.Utils.fetch_app(conn),
{:ok, %Token{} = oauth_token} <- RevokeToken.revoke(app, params) do
def token_revoke(%Plug.Conn{} = conn, %{"token" => token}) do
with {:ok, %Token{} = oauth_token} <- Token.get_by_token(token),
{:ok, oauth_token} <- RevokeToken.revoke(oauth_token) do
conn =
with session_token = AuthHelper.get_session_token(conn),
%Token{token: ^session_token} <- oauth_token do