[SECURITY] Enforce session validation on oauth authorize endpoint

2023-03-06 14:37:27 +01:00
parent b3ae675a14
commit ef7dd65194
5 changed files with 152 additions and 3 deletions
@@ -112,7 +112,7 @@ class PermissionMiddleware:
        url = resolve(request.path_info)
        url_name = url.url_name

-        if not request.path.startswith(get_script_prefix() + 'control'):
+        if not request.path.startswith(get_script_prefix() + 'control') and not (url.namespace.startswith("api-") and url_name == "authorize"):
            # This middleware should only touch the /control subpath
            return self.get_response(request)