1
0
mirror of https://github.com/flarum/core.git synced 2025-08-16 13:24:11 +02:00

Compare commits

..

3 Commits

Author SHA1 Message Date
Toby Zerner
5bcf72dd49 Bump version 2018-11-09 21:22:11 +10:30
Toby Zerner
0536b208e1 Fix leak of private information when updating users 2018-11-09 21:21:21 +10:30
Clark Winkelmann
c6aeeeb3c1 Always apply attributes from token when registering
The change introduced in #1033 transformed any identification attribute returned from an OAuth provider to just a default value.

When the identification attribute used by the provider is the email or username, this allowed the user to supply a different email or username and still getting an already-enabled account with the credentials he entered.

Skipping attributes with an existing value makes no sense here because it's a always a fresh user and values from AbstractOAuth2Controller::getIdentification() should always be enforced.
2018-01-06 20:04:42 +10:30
3 changed files with 9 additions and 5 deletions

View File

@@ -11,6 +11,8 @@
namespace Flarum\Api\Controller;
use Flarum\Api\Serializer\CurrentUserSerializer;
use Flarum\Api\Serializer\UserSerializer;
use Flarum\Core\Command\EditUser;
use Flarum\Core\Exception\PermissionDeniedException;
use Illuminate\Contracts\Bus\Dispatcher;
@@ -22,7 +24,7 @@ class UpdateUserController extends AbstractResourceController
/**
* {@inheritdoc}
*/
public $serializer = 'Flarum\Api\Serializer\CurrentUserSerializer';
public $serializer = UserSerializer::class;
/**
* {@inheritdoc}
@@ -51,6 +53,10 @@ class UpdateUserController extends AbstractResourceController
$actor = $request->getAttribute('actor');
$data = array_get($request->getParsedBody(), 'data', []);
if ($actor->id == $id) {
$this->serializer = CurrentUserSerializer::class;
}
// Require the user's current password if they are attempting to change
// their own email address.
if (isset($data['attributes']['email']) && $actor->id == $id) {

View File

@@ -116,9 +116,7 @@ class RegisterUserHandler
// from the get-go.
if (isset($token)) {
foreach ($token->payload as $k => $v) {
if (in_array($user->$k, ['', null], true)) {
$user->$k = $v;
}
$user->$k = $v;
}
if (isset($token->payload['email'])) {

View File

@@ -25,7 +25,7 @@ class Application extends Container implements ApplicationContract
*
* @var string
*/
const VERSION = '0.1.0-beta.7';
const VERSION = '0.1.0-beta.7.2';
/**
* The base path for the Flarum installation.