oppi.li / perf-test
loading up the forgejo repo on tangled to test page performance
0
fork

Configure Feed

Select the types of activity you want to include in your feed.

Return `access_denied` error when an OAuth2 request is denied (#30974)

According to [RFC
6749](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1),
when the resource owner or authorization server denied an request, an
`access_denied` error should be returned. But currently in this case
Gitea does not return any error.

For example, if the user clicks "Cancel" here, an `access_denied` error
should be returned.

<img width="360px"
src="https://github.com/go-gitea/gitea/assets/15528715/be31c09b-4c0a-4701-b7a4-f54b8fe3a6c5"
/>

(cherry picked from commit f1d9f18d96050d89a4085c961f572f07b1e653d1)

authored by

Zettat123 and committed by
Earl Warren 886a675f f6e50abd

+13 -2
+10
routers/web/auth/oauth.go
··· 542 542 ctx.Error(http.StatusBadRequest) 543 543 return 544 544 } 545 + 546 + if !form.Granted { 547 + handleAuthorizeError(ctx, AuthorizeError{ 548 + State: form.State, 549 + ErrorDescription: "the request is denied", 550 + ErrorCode: ErrorCodeAccessDenied, 551 + }, form.RedirectURI) 552 + return 553 + } 554 + 545 555 app, err := auth.GetOAuth2ApplicationByClientID(ctx, form.ClientID) 546 556 if err != nil { 547 557 ctx.ServerError("GetOAuth2ApplicationByClientID", err)
+1
services/forms/user_form.go
··· 162 162 // GrantApplicationForm form for authorizing oauth2 clients 163 163 type GrantApplicationForm struct { 164 164 ClientID string `binding:"Required"` 165 + Granted bool 165 166 RedirectURI string 166 167 State string 167 168 Scope string
+2 -2
templates/user/auth/grant.tmpl
··· 23 23 <input type="hidden" name="scope" value="{{.Scope}}"> 24 24 <input type="hidden" name="nonce" value="{{.Nonce}}"> 25 25 <input type="hidden" name="redirect_uri" value="{{.RedirectURI}}"> 26 - <button type="submit" id="authorize-app" value="{{ctx.Locale.Tr "auth.authorize_application"}}" class="ui red inline button">{{ctx.Locale.Tr "auth.authorize_application"}}</button> 27 - <a href="{{.RedirectURI}}" class="ui basic primary inline button">Cancel</a> 26 + <button type="submit" id="authorize-app" name="granted" value="true" class="ui red inline button">{{ctx.Locale.Tr "auth.authorize_application"}}</button> 27 + <button type="submit" name="granted" value="false" class="ui basic primary inline button">{{ctx.Locale.Tr "cancel"}}</button> 28 28 </form> 29 29 </div> 30 30 </div>