X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/8bd001f1282b7a33a71c0565504e160dbe567d5d..387d130e87b79cb428f7554c1a233de5d0627ae9:/app/controllers/oauth_controller.rb diff --git a/app/controllers/oauth_controller.rb b/app/controllers/oauth_controller.rb index ae6d0983b..cd7e48277 100644 --- a/app/controllers/oauth_controller.rb +++ b/app/controllers/oauth_controller.rb @@ -1,21 +1,33 @@ -require "oauth/controllers/provider_controller" - class OauthController < ApplicationController include OAuth::Controllers::ProviderController + # The ProviderController will call login_required for any action that needs + # a login, but we want to check authorization on every action. + authorize_resource :class => false + layout "site" + def revoke + @token = current_user.oauth_tokens.find_by :token => params[:token] + if @token + @token.invalidate! + flash[:notice] = t(".flash", :application => @token.client_application.name) + end + redirect_to oauth_clients_url(:display_name => @token.user.display_name) + end + + protected + def login_required authorize_web set_locale - require_user end def user_authorizes_token? any_auth = false @token.client_application.permissions.each do |pref| - if params[pref] + if params[pref].to_i.nonzero? @token.write_attribute(pref, true) any_auth ||= true else @@ -26,19 +38,8 @@ class OauthController < ApplicationController any_auth end - def revoke - @token = current_user.oauth_tokens.find_by :token => params[:token] - if @token - @token.invalidate! - flash[:notice] = t(".flash", :application => @token.client_application.name) - end - redirect_to oauth_clients_url(:display_name => @token.user.display_name) - end - - protected - def oauth1_authorize - append_content_security_policy_directives(:form_action => %w[*]) + override_content_security_policy_directives(:form_action => []) if Settings.csp_enforce || Settings.key?(:csp_report_url) if @token.invalidated? @message = t "oauth.authorize_failure.invalid" @@ -65,7 +66,7 @@ class OauthController < ApplicationController @redirect_url.query += "&oauth_verifier=#{@token.verifier}" unless @token.oauth10? - redirect_to @redirect_url.to_s + redirect_to @redirect_url.to_s, :allow_other_host => true end else @token.invalidate!