/api/oauth_tokens skipped the scope check, so a token with any scope could list the user's sessions and revoke them. |
||
|---|---|---|
| .. | ||
| legacy-sequences.fix | ||
| oauth-tokens-scopes.security | ||
| release-2.11.0.skip | ||
/api/oauth_tokens skipped the scope check, so a token with any scope could list the user's sessions and revoke them. |
||
|---|---|---|
| .. | ||
| legacy-sequences.fix | ||
| oauth-tokens-scopes.security | ||
| release-2.11.0.skip | ||