mirror of
https://codeberg.org/forgejo/forgejo.git
synced 2024-11-30 09:41:11 -05:00
Merge pull request '[v7.0/forgejo] test(oauth): coverage for the redirection of a denied grant' (#4029) from bp-v7.0/forgejo-32c882a into v7.0/forgejo
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/4029 Reviewed-by: Earl Warren <earl-warren@noreply.codeberg.org>
This commit is contained in:
commit
e17e243624
5 changed files with 35 additions and 2 deletions
1
release-notes/8.0.0/fix/4026.md
Normal file
1
release-notes/8.0.0/fix/4026.md
Normal file
|
@ -0,0 +1 @@
|
|||
- when an OAuth grant request submitted to a Forgejo user is denied, the server from which the request originates is not notified that it has been denied
|
|
@ -540,6 +540,16 @@ func GrantApplicationOAuth(ctx *context.Context) {
|
|||
ctx.Error(http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
if !form.Granted {
|
||||
handleAuthorizeError(ctx, AuthorizeError{
|
||||
State: form.State,
|
||||
ErrorDescription: "the request is denied",
|
||||
ErrorCode: ErrorCodeAccessDenied,
|
||||
}, form.RedirectURI)
|
||||
return
|
||||
}
|
||||
|
||||
app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID)
|
||||
if err != nil {
|
||||
ctx.ServerError("GetOAuth2ApplicationByClientID", err)
|
||||
|
|
|
@ -162,6 +162,7 @@ func (f *AuthorizationForm) Validate(req *http.Request, errs binding.Errors) bin
|
|||
// GrantApplicationForm form for authorizing oauth2 clients
|
||||
type GrantApplicationForm struct {
|
||||
ClientID string `binding:"Required"`
|
||||
Granted bool
|
||||
RedirectURI string
|
||||
State string
|
||||
Scope string
|
||||
|
|
|
@ -23,8 +23,8 @@
|
|||
<input type="hidden" name="scope" value="{{.Scope}}">
|
||||
<input type="hidden" name="nonce" value="{{.Nonce}}">
|
||||
<input type="hidden" name="redirect_uri" value="{{.RedirectURI}}">
|
||||
<button type="submit" id="authorize-app" value="{{ctx.Locale.Tr "auth.authorize_application"}}" class="ui red inline button">{{ctx.Locale.Tr "auth.authorize_application"}}</button>
|
||||
<a href="{{.RedirectURI}}" class="ui basic primary inline button">Cancel</a>
|
||||
<button type="submit" id="authorize-app" name="granted" value="true" class="ui red inline button">{{ctx.Locale.Tr "auth.authorize_application"}}</button>
|
||||
<button type="submit" name="granted" value="false" class="ui basic primary inline button">{{ctx.Locale.Tr "cancel"}}</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
|
|
|
@ -554,3 +554,24 @@ func TestSignUpViaOAuthWithMissingFields(t *testing.T) {
|
|||
resp := MakeRequest(t, req, http.StatusSeeOther)
|
||||
assert.Equal(t, test.RedirectURL(resp), "/user/link_account")
|
||||
}
|
||||
|
||||
func TestOAuth_GrantApplicationOAuth(t *testing.T) {
|
||||
defer tests.PrepareTestEnv(t)()
|
||||
|
||||
req := NewRequest(t, "GET", "/login/oauth/authorize?client_id=da7da3ba-9a13-4167-856f-3899de0b0138&redirect_uri=a&response_type=code&state=thestate")
|
||||
ctx := loginUser(t, "user4")
|
||||
resp := ctx.MakeRequest(t, req, http.StatusOK)
|
||||
|
||||
htmlDoc := NewHTMLParser(t, resp.Body)
|
||||
htmlDoc.AssertElement(t, "#authorize-app", true)
|
||||
|
||||
req = NewRequestWithValues(t, "POST", "/login/oauth/grant", map[string]string{
|
||||
"_csrf": htmlDoc.GetCSRF(),
|
||||
"client_id": "da7da3ba-9a13-4167-856f-3899de0b0138",
|
||||
"redirect_uri": "a",
|
||||
"state": "thestate",
|
||||
"granted": "false",
|
||||
})
|
||||
resp = ctx.MakeRequest(t, req, http.StatusSeeOther)
|
||||
assert.Contains(t, test.RedirectURL(resp), "error=access_denied&error_description=the+request+is+denied")
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue