Skip to content

Commit

Permalink
Validate Doorkeeper PreAuthorization to ensure the client is accessible
Browse files Browse the repository at this point in the history
As of doorkeeper-gem/doorkeeper#1296 Doorkeeper's
PreAuthorization controller is no longer passed the Client upon instantiation,
but instead retrieves it during validation.

To ensure that the we can access the application via the client, we explicitly
call pre_auth.authorizable in order to invoke `validate_client`
https://github.com/linhdangduy/doorkeeper/blob/a3458b00d89fb79e0f0a4efc733124c3bfe56db6/lib/doorkeeper/oauth/pre_authorization.rb#L71
  • Loading branch information
edwardkerry committed Mar 2, 2020
1 parent 411dae1 commit 38a8c9f
Showing 1 changed file with 6 additions and 1 deletion.
7 changes: 6 additions & 1 deletion app/controllers/signin_required_authorizations_controller.rb
Expand Up @@ -3,7 +3,7 @@ class SigninRequiredAuthorizationsController < Doorkeeper::AuthorizationsControl
EXPECTED_DOORKEEPER_VERSION = "5.2.0.rc3".freeze

def new
if pre_auth.authorizable?
if pre_authorizable?
if skip_authorization? || matching_token?
if user_has_signin_permission_to_application?
auth = authorization.authorize
Expand Down Expand Up @@ -31,6 +31,10 @@ def create

private

def pre_authorizable?
@pre_authorizable ||= pre_auth.authorizable?
end

def user_has_signin_permission_to_application?
return false if application.nil?
return false if current_resource_owner.nil?
Expand All @@ -39,6 +43,7 @@ def user_has_signin_permission_to_application?
end

def application
pre_authorizable? #Doorkeeper PreAuthorization controller must be validated in-order for the client to be instantiated.
pre_auth.try(:client).try(:application)
end
end

0 comments on commit 38a8c9f

Please sign in to comment.