tqt
/
Ghost
mirror of https://github.com/TryGhost/Ghost.git
2
1
Fork 0
Code Issues 1 Releases Wiki Activity

Ensure cors check happens for /authentication/token route (#9317) 

no issue

- otherwise external browser clients run into cors problems
This commit is contained in:
Katharina Irrgang 2017-12-15 10:35:48 +01:00 committed by Kevin Ansfield
parent 73c0bf554a
commit 6e94cedfa2
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
core/server/services/auth/authorize.js
View File

@ -29,7 +29,7 @@ authorize = {
// Requires the authenticated client to match specific client
requiresAuthorizedClient: function requiresAuthorizedClient(client) {
return function doAuthorizedClient(req, res, next) {
if (!req.client || !req.client.name || req.client.name !== client) {
if (client && (!req.client || !req.client.name || req.client.name !== client)) {
return next(new common.errors.NoPermissionError({message: common.i18n.t('errors.permissions.noPermissionToAction')}));
}

5
core/server/web/api/routes.js
View File

@ -158,10 +158,11 @@ module.exports = function apiRoutes() {
apiRouter.post('/authentication/setup', api.http(api.authentication.setup));
apiRouter.put('/authentication/setup', mw.authenticatePrivate, api.http(api.authentication.updateSetup));
apiRouter.get('/authentication/setup', api.http(api.authentication.isSetup));
apiRouter.post('/authentication/token',
mw.authenticateClient(),
brute.globalBlock,
brute.userLogin,
auth.authenticate.authenticateClient,
auth.oauth.generateAccessToken
);
@ -176,7 +177,7 @@ module.exports = function apiRoutes() {
api.http(api.uploads.add)
);
apiRouter.post('/db/backup', mw.authenticateClient('Ghost Backup'), api.http(api.db.backupContent));
apiRouter.post('/db/backup', mw.authenticateClient('Ghost Backup'), api.http(api.db.backupContent));
apiRouter.post('/uploads/icon',
mw.authenticatePrivate,