mirror of
https://github.com/go-gitea/gitea
synced 2024-12-25 18:14:28 +00:00
Backport #31015 by @denyskon Do not try to create a new authorization grant when one exists already, thus preventing a DB-related authorization issue. Fix https://github.com/go-gitea/gitea/pull/30790#issuecomment-2118812426 Co-authored-by: Denys Konovalov <kontakt@denyskon.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
This commit is contained in:
parent
27a4c67992
commit
e3390e2441
@ -556,15 +556,30 @@ func GrantApplicationOAuth(ctx *context.Context) {
|
|||||||
ctx.ServerError("GetOAuth2ApplicationByClientID", err)
|
ctx.ServerError("GetOAuth2ApplicationByClientID", err)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
grant, err := app.CreateGrant(ctx, ctx.Doer.ID, form.Scope)
|
grant, err := app.GetGrantByUserID(ctx, ctx.Doer.ID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
handleServerError(ctx, form.State, form.RedirectURI)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
if grant == nil {
|
||||||
|
grant, err = app.CreateGrant(ctx, ctx.Doer.ID, form.Scope)
|
||||||
|
if err != nil {
|
||||||
|
handleAuthorizeError(ctx, AuthorizeError{
|
||||||
|
State: form.State,
|
||||||
|
ErrorDescription: "cannot create grant for user",
|
||||||
|
ErrorCode: ErrorCodeServerError,
|
||||||
|
}, form.RedirectURI)
|
||||||
|
return
|
||||||
|
}
|
||||||
|
} else if grant.Scope != form.Scope {
|
||||||
handleAuthorizeError(ctx, AuthorizeError{
|
handleAuthorizeError(ctx, AuthorizeError{
|
||||||
State: form.State,
|
State: form.State,
|
||||||
ErrorDescription: "cannot create grant for user",
|
ErrorDescription: "a grant exists with different scope",
|
||||||
ErrorCode: ErrorCodeServerError,
|
ErrorCode: ErrorCodeServerError,
|
||||||
}, form.RedirectURI)
|
}, form.RedirectURI)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
if len(form.Nonce) > 0 {
|
if len(form.Nonce) > 0 {
|
||||||
err := grant.SetNonce(ctx, form.Nonce)
|
err := grant.SetNonce(ctx, form.Nonce)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
Loading…
Reference in New Issue
Block a user