github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-28 13:51:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: Do not allow authentication with disabled plugin-supplied a… (#6071)

Browse Source 
Do not allow authentication with disabled plugin-supplied auth providers
This commit is contained in:
David Taylor
2018-07-09 05:25:58 +01:00
committed by Sam
parent 81188060d6
commit 9a813210b9
3 changed files with 43 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/controllers/users/omniauth_callbacks_controller.rb
View File

@ -93,16 +93,19 @@ class Users::OmniauthCallbacksController < ApplicationController
def self.find_authenticator(name)
BUILTIN_AUTH.each do |authenticator|
if authenticator.name == name
raise Discourse::InvalidAccess.new("provider is not enabled") unless SiteSetting.send("enable_#{name}_logins?")
raise Discourse::InvalidAccess.new(I18n.t("provider_not_enabled")) unless SiteSetting.send("enable_#{name}_logins?")
return authenticator
end
end
Discourse.auth_providers.each do |provider|
unless provider.enabled_setting.nil? || SiteSetting.send(provider.enabled_setting)
raise Discourse::InvalidAccess.new(I18n.t("provider_not_enabled"))
end
return provider.authenticator if provider.name == name
end
raise Discourse::InvalidAccess.new("provider is not found")
raise Discourse::InvalidAccess.new(I18n.t("provider_not_found"))
end
protected