summaryrefslogtreecommitdiffstats
path: root/api4/oauth.go
diff options
context:
space:
mode:
Diffstat (limited to 'api4/oauth.go')
-rw-r--r--api4/oauth.go9
1 files changed, 9 insertions, 0 deletions
diff --git a/api4/oauth.go b/api4/oauth.go
index ae5035fdc..392129143 100644
--- a/api4/oauth.go
+++ b/api4/oauth.go
@@ -57,6 +57,10 @@ func createOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
+ if !app.SessionHasPermissionTo(c.Session, model.PERMISSION_MANAGE_SYSTEM) {
+ oauthApp.IsTrusted = false
+ }
+
oauthApp.CreatorId = c.Session.UserId
rapp, err := app.CreateOAuthApp(oauthApp)
@@ -298,6 +302,11 @@ func authorizeOAuthPage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
+ if !oauthApp.IsValidRedirectURL(authRequest.RedirectUri) {
+ utils.RenderWebError(model.NewAppError("authorizeOAuthPage", "api.oauth.allow_oauth.redirect_callback.app_error", nil, "", http.StatusBadRequest), w, r)
+ return
+ }
+
isAuthorized := false
if _, err := app.GetPreferenceByCategoryAndNameForUser(c.Session.UserId, model.PREFERENCE_CATEGORY_AUTHORIZED_OAUTH_APP, authRequest.ClientId); err == nil {