mirrors/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2024-10-02 21:01:06 +02:00
Code Issues Projects Releases Wiki Activity

Remove OAuth Password Grant Type support (#30960)

Browse Source
This commit is contained in:
Emelia Smith 2024-10-01 11:56:58 +02:00 committed by GitHub
parent e975b55c24
commit 454d21ab5a
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
config/initializers/doorkeeper.rb
View File

@ -9,16 +9,9 @@ Doorkeeper.configure do
current_user || redirect_to(new_user_session_url)
end
resource_owner_from_credentials do |_routes|
user = User.authenticate_with_ldap(email: request.params[:username], password: request.params[:password]) if Devise.ldap_authentication
user ||= User.authenticate_with_pam(email: request.params[:username], password: request.params[:password]) if Devise.pam_authentication
if user.nil?
user = User.find_by(email: request.params[:username])
user = nil unless user&.valid_password?(request.params[:password])
end
user unless user&.otp_required_for_login?
# Disable Resource Owner Password Credentials Grant Flow
resource_owner_from_credentials do
nil
end
# Doorkeeper provides some administrative interfaces for managing OAuth
@ -169,7 +162,7 @@ Doorkeeper.configure do
# http://tools.ietf.org/html/rfc6819#section-4.4.3
#
grant_flows %w(authorization_code password client_credentials)
grant_flows %w(authorization_code client_credentials)
# Under some circumstances you might want to have applications auto-approved,
# so that the user skips the authorization step.