Mirrors/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2024-11-10 21:22:58 +01:00
Code Issues Releases Activity

Merge pull request #4978 from turbo124/v5-develop

Browse Source 
OAuth password protection routes
This commit is contained in:
David Bomba 2021-02-24 08:13:07 +11:00 committed by GitHub
commit 67ab0b9ad4
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 41 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION.txt
View File

@ -1 +1 @@
5.1.8
5.1.9

40
app/Http/Middleware/PasswordProtection.php
View File

@ -11,6 +11,8 @@
namespace App\Http\Middleware;
use App\Libraries\MultiDB;
use App\Libraries\OAuth\Providers\Google;
use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Cache;
@ -34,16 +36,52 @@ class PasswordProtection
'errors' => new stdClass,
];
if ($request->header('X-API-PASSWORD')) {
if($request->header('X-API-OAUTH-PASSWORD')){
//user is attempting to reauth with OAuth - check the token value
//todo expand this to include all OAuth providers
$user = false;
$google = new Google();
$user = $google->getTokenResponse(request()->header('X-API-OAUTH-PASSWORD'));
if (is_array($user)) {
$query = [
'oauth_user_id' => $google->harvestSubField($user),
'oauth_provider_id'=> 'google',
];
/* Cannot allow duplicates! */
if ($existing_user = MultiDB::hasUser($query)) {
return $next($request);
}
}
$error = [
'message' => 'Access denied',
'errors' => new stdClass,
];
return response()->json($error, 412);
}elseif ($request->header('X-API-PASSWORD')) {
//user is attempting to reauth with regular password
//
if (! Hash::check($request->header('X-API-PASSWORD'), auth()->user()->password)) {
return response()->json($error, 403);
}
} elseif (Cache::get(auth()->user()->email.'_logged_in')) {
Cache::pull(auth()->user()->email.'_logged_in');
Cache::add(auth()->user()->email.'_logged_in', Str::random(64), now()->addMinutes(30));
return $next($request);
} else {
$error = [
'message' => 'Access denied',
'errors' => new stdClass,

2
config/ninja.php
View File

@ -13,7 +13,7 @@ return [
'require_https' => env('REQUIRE_HTTPS', true),
'app_url' => rtrim(env('APP_URL', ''), '/'),
'app_domain' => env('APP_DOMAIN', ''),
'app_version' => '5.1.8',
'app_version' => '5.1.9',
'minimum_client_version' => '5.0.16',
'terms_version' => '1.0.1',
'api_secret' => env('API_SECRET', false),