erik/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2024-08-20 21:08:15 -07:00
Code Issues Projects Releases Wiki Activity

Remove OAuth Password Grant Type support

Browse source
This commit is contained in:
Emelia Smith 2024-07-08 20:57:57 +02:00
parent fa8e972722
commit 28ceb42daa
No known key found for this signature in database
1 changed files with 4 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
config/initializers/doorkeeper.rb
View file

@ -9,16 +9,9 @@ Doorkeeper.configure do
current_user || redirect_to(new_user_session_url) current_user || redirect_to(new_user_session_url)
end end
resource_owner_from_credentials do |_routes| # Disable Resource Owner Password Credentials Grant Flow
user = User.authenticate_with_ldap(email: request.params[:username], password: request.params[:password]) if Devise.ldap_authentication resource_owner_from_credentials do
user ||= User.authenticate_with_pam(email: request.params[:username], password: request.params[:password]) if Devise.pam_authentication nil
if user.nil?
user = User.find_by(email: request.params[:username])
user = nil unless user&.valid_password?(request.params[:password])
end
user unless user&.otp_required_for_login?
end end
# Doorkeeper provides some administrative interfaces for managing OAuth # Doorkeeper provides some administrative interfaces for managing OAuth
@ -170,7 +163,7 @@ Doorkeeper.configure do
# http://tools.ietf.org/html/rfc6819#section-4.4.3 # http://tools.ietf.org/html/rfc6819#section-4.4.3
# #
grant_flows %w(authorization_code password client_credentials) grant_flows %w(authorization_code client_credentials)
# Under some circumstances you might want to have applications auto-approved, # Under some circumstances you might want to have applications auto-approved,
# so that the user skips the authorization step. # so that the user skips the authorization step.