medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

bugfix: Crash in OAuth2 userdata, and option to log user data (#631)

This commit is contained in:
James Read 2025-07-28 22:46:08 +01:00 committed by GitHub
parent 81ef166d78
commit 2d4a3fc048
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
service/internal/config/config.go
View File

@ -138,6 +138,7 @@ type Config struct {
CronSupportForSeconds bool
SectionNavigationStyle string
DefaultPopupOnStart string
InsecureAllowDumpOAuth2UserData bool
InsecureAllowDumpVars bool
InsecureAllowDumpSos bool
InsecureAllowDumpActionMap bool

17
service/internal/httpservers/restapi_auth_oauth2.go
View File

@ -250,7 +250,7 @@ func handleOAuthCallback(w http.ResponseWriter, r *http.Request) {
Timeout: clientSettings.Timeout,
}
userinfo := getUserInfo(userInfoClient, cfg.AuthOAuth2Providers[registeredState.providerName])
userinfo := getUserInfo(cfg, userInfoClient, cfg.AuthOAuth2Providers[registeredState.providerName])
registeredStates[state].Username = userinfo.Username
registeredStates[state].Usergroup = userinfo.Usergroup
@ -274,7 +274,7 @@ type UserInfo struct {
}
//gocyclo:ignore
func getUserInfo(client *http.Client, provider *config.OAuth2Provider) *UserInfo {
func getUserInfo(cfg *config.Config, client *http.Client, provider *config.OAuth2Provider) *UserInfo {
ret := &UserInfo{}
res, err := client.Get(provider.WhoamiUrl)
@ -300,6 +300,10 @@ func getUserInfo(client *http.Client, provider *config.OAuth2Provider) *UserInfo
var userData map[string]any
if cfg.InsecureAllowDumpOAuth2UserData {
log.Debugf("OAuth2 User Data: %v+", string(contents))
}
err = json.Unmarshal([]byte(contents), &userData)
if err != nil {
@ -327,7 +331,14 @@ func getDataField(data map[string]any, field string) string {
return ""
}
return val.(string)
stringVal, ok := val.(string)
if !ok {
log.Errorf("Field %v is not a string: %v", field, val)
return ""
}
return stringVal
}
func parseOAuth2Cookie(r *http.Request) (string, string, string) {