From cfae2c62c3e02e2add954ef234ac550b7b92619a Mon Sep 17 00:00:00 2001 From: Raphael Michel Date: Fri, 7 Feb 2025 18:04:46 +0100 Subject: [PATCH] OIDC: Fix incorrect error handling in server implementation --- src/pretix/presale/views/oidc_op.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/pretix/presale/views/oidc_op.py b/src/pretix/presale/views/oidc_op.py index cb6a66ec6..6630fd074 100644 --- a/src/pretix/presale/views/oidc_op.py +++ b/src/pretix/presale/views/oidc_op.py @@ -244,15 +244,16 @@ class AuthorizeView(View): response_mode, state) if "id_token_hint" in request_data: - self._redirect_error("invalid_request", "id_token_hint currently not supported by this server", - redirect_uri, response_mode, state) + return self._redirect_error("invalid_request", "id_token_hint currently not supported by this server", + redirect_uri, response_mode, state) has_valid_session = bool(request.customer) if has_valid_session and max_age: try: has_valid_session = int(time.time() - get_customer_auth_time(request)) < int(max_age) except ValueError: - self._redirect_error("invalid_request", "invalid max_age value", redirect_uri, response_mode, state) + return self._redirect_error("invalid_request", "invalid max_age value", redirect_uri, + response_mode, state) if not has_valid_session and prompt and prompt == "none": return self._redirect_error("interaction_required", "user is not logged in but no prompt is allowed",