diff options
Diffstat (limited to 'internal/api')
| -rw-r--r-- | internal/api/auth/authorize.go | 12 | ||||
| -rw-r--r-- | internal/api/auth/revoke.go | 8 | ||||
| -rw-r--r-- | internal/api/auth/signin.go | 6 | ||||
| -rw-r--r-- | internal/api/model/oauth.go | 6 |
4 files changed, 20 insertions, 12 deletions
diff --git a/internal/api/auth/authorize.go b/internal/api/auth/authorize.go index 3676fd417..5b3e6ea3c 100644 --- a/internal/api/auth/authorize.go +++ b/internal/api/auth/authorize.go @@ -20,6 +20,7 @@ package auth import ( "net/http" "net/url" + "strings" "github.com/gin-contrib/sessions" "github.com/gin-gonic/gin" @@ -229,8 +230,8 @@ func (m *Module) AuthorizePOSTHandler(c *gin.Context) { } // redirectAuthFormToSignIn binds an OAuthAuthorize form, -// stores the values in the form into the session, and -// redirects the user to the sign in page. +// presumed to be set as url query params, stores the values +// into the session, and redirects the user to the sign in page. func (m *Module) redirectAuthFormToSignIn(c *gin.Context) { s := sessions.Default(c) @@ -240,9 +241,14 @@ func (m *Module) redirectAuthFormToSignIn(c *gin.Context) { return } - // Set default scope to read. + // If scope isn't set default to read. + // + // Else massage submitted scope(s) from + // '+'-separated to space-separated. if form.Scope == "" { form.Scope = "read" + } else { + form.Scope = strings.ReplaceAll(form.Scope, "+", " ") } // Save these values from the form so we diff --git a/internal/api/auth/revoke.go b/internal/api/auth/revoke.go index bb621e5e0..7bd565308 100644 --- a/internal/api/auth/revoke.go +++ b/internal/api/auth/revoke.go @@ -80,10 +80,12 @@ func (m *Module) TokenRevokePOSTHandler(c *gin.Context) { return } + // Don't set `binding:"required"` on these + // fields as we want to validate them ourself. form := &struct { - ClientID string `form:"client_id" validate:"required"` - ClientSecret string `form:"client_secret" validate:"required"` - Token string `form:"token" validate:"required"` + ClientID string `form:"client_id"` + ClientSecret string `form:"client_secret"` + Token string `form:"token"` }{} if err := c.ShouldBind(form); err != nil { errWithCode := gtserror.NewErrorBadRequest(err, err.Error()) diff --git a/internal/api/auth/signin.go b/internal/api/auth/signin.go index 2820255db..3503f37bb 100644 --- a/internal/api/auth/signin.go +++ b/internal/api/auth/signin.go @@ -101,8 +101,8 @@ func (m *Module) SignInPOSTHandler(c *gin.Context) { // Parse email + password. form := &struct { - Email string `form:"username" validate:"required"` - Password string `form:"password" validate:"required"` + Email string `form:"username" binding:"required"` + Password string `form:"password" binding:"required"` }{} if err := c.ShouldBind(form); err != nil { m.clearSessionWithBadRequest(c, s, err, oauth.HelpfulAdvice) @@ -235,7 +235,7 @@ func (m *Module) TwoFactorCodePOSTHandler(c *gin.Context) { // Parse 2fa code. form := &struct { - Code string `form:"code" validate:"required"` + Code string `form:"code" binding:"required"` }{} if err := c.ShouldBind(form); err != nil { m.clearSessionWithBadRequest(c, s, err, oauth.HelpfulAdvice) diff --git a/internal/api/model/oauth.go b/internal/api/model/oauth.go index a4840b10a..8e903761e 100644 --- a/internal/api/model/oauth.go +++ b/internal/api/model/oauth.go @@ -22,13 +22,13 @@ type OAuthAuthorize struct { // Forces the user to re-login, which is necessary for authorizing with multiple accounts from the same instance. ForceLogin string `form:"force_login" json:"force_login"` // Should be set equal to `code`. - ResponseType string `form:"response_type" json:"response_type" validate:"required"` + ResponseType string `form:"response_type" json:"response_type" binding:"required"` // Client ID, obtained during app registration. - ClientID string `form:"client_id" json:"client_id" validate:"required"` + ClientID string `form:"client_id" json:"client_id" binding:"required"` // Set a URI to redirect the user to. // If this parameter is set to urn:ietf:wg:oauth:2.0:oob then the authorization code will be shown instead. // Must match one of the redirect URIs declared during app registration. - RedirectURI string `form:"redirect_uri" json:"redirect_uri" validate:"required"` + RedirectURI string `form:"redirect_uri" json:"redirect_uri" binding:"required"` // List of requested OAuth scopes, separated by spaces (or by pluses, if using query parameters). // Must be a subset of scopes declared during app registration. If not provided, defaults to read. Scope string `form:"scope" json:"scope"` |