GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

wip42

Browse Source
This commit is contained in:
Diogo Peralta Cordeiro 2022-01-16 18:14:08 +00:00
parent 5ac764f3e5
commit b82818646f
Signed by: diogo
GPG Key ID: 18D2D35001FBFAB0
3 changed files with 7 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/packages/security.yaml
View File

@ -20,10 +20,6 @@ security:
dev: dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/ pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false security: false
oauth_token:
pattern: ^/oauth/(token|authorize)$
provider: local_user
security: false
api_apps: api_apps:
pattern: ^/api/v1/apps$ pattern: ^/api/v1/apps$
security: false security: false

12
plugins/OAuth2/OAuth2.php
View File

@ -33,7 +33,6 @@ declare(strict_types = 1);
namespace Plugin\OAuth2; namespace Plugin\OAuth2;
use App\Core\Event; use App\Core\Event;
use App\Core\Log;
use App\Core\Modules\Plugin; use App\Core\Modules\Plugin;
use App\Core\Router\RouteLoader; use App\Core\Router\RouteLoader;
use App\Core\Router\Router; use App\Core\Router\Router;
@ -44,8 +43,6 @@ use Nyholm\Psr7\Response;
use Plugin\OAuth2\Controller\Apps; use Plugin\OAuth2\Controller\Apps;
use Symfony\Component\EventDispatcher\EventSubscriberInterface; use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Exception\BadRequestException; use Symfony\Component\HttpFoundation\Exception\BadRequestException;
use Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface;
use Symfony\Component\Security\Core\User\UserProviderInterface;
use Trikoder\Bundle\OAuth2Bundle\Event\AuthorizationRequestResolveEvent; use Trikoder\Bundle\OAuth2Bundle\Event\AuthorizationRequestResolveEvent;
use Trikoder\Bundle\OAuth2Bundle\Event\UserResolveEvent; use Trikoder\Bundle\OAuth2Bundle\Event\UserResolveEvent;
use Trikoder\Bundle\OAuth2Bundle\OAuth2Events; use Trikoder\Bundle\OAuth2Bundle\OAuth2Events;
@ -94,19 +91,14 @@ class OAuth2 extends Plugin implements EventSubscriberInterface
return Event::next; return Event::next;
} }
public function userResolve(UserResolveEvent $event, UserProviderInterface $userProvider, UserPasswordEncoderInterface $userPasswordEncoder): void public function userResolve(UserResolveEvent $event): void
{ {
Log::debug('cenas: ', [$event, $userProvider, $userPasswordEncoder]); $user = Common::user();
$user = $userProvider->loadUserByUsername($event->getUsername());
if (\is_null($user)) { if (\is_null($user)) {
return; return;
} }
if (!$userPasswordEncoder->isPasswordValid($user, $event->getPassword())) {
return;
}
$event->setUser($user); $event->setUser($user);
} }

7
src/Controller/Security.php
View File

@ -36,6 +36,7 @@ use LogicException;
use Symfony\Component\Form\Extension\Core\Type\EmailType; use Symfony\Component\Form\Extension\Core\Type\EmailType;
use Symfony\Component\Form\Extension\Core\Type\SubmitType; use Symfony\Component\Form\Extension\Core\Type\SubmitType;
use Symfony\Component\Form\Extension\Core\Type\TextType; use Symfony\Component\Form\Extension\Core\Type\TextType;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request; use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response; use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface; use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
@ -49,11 +50,13 @@ class Security extends Controller
/** /**
* Log a user in * Log a user in
*/ */
public function login(AuthenticationUtils $authenticationUtils) public function login(AuthenticationUtils $authenticationUtils): RedirectResponse|array
{ {
// Skip if already logged in // Skip if already logged in
if ($this->getUser()) { if ($this->getUser()) {
return $this->redirectToRoute('root'); // TODO: Fix the Open Redirect security flaw here.
$targetPath = Common::getRequest()->query->get('returnUrl');
return \is_null($targetPath) ? $this->redirectToRoute('root') : new RedirectResponse($targetPath);
} }
// get the login error if there is one // get the login error if there is one