CGM_Public/pretix_original
3
0
Fork 1
mirror of https://github.com/pretix/pretix.git synced 2026-08-18 12:06:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY] Enforce session validation on oauth authorize endpoint

Browse Source
This commit is contained in:
Raphael Michel
2023-03-06 14:58:24 +01:00
parent 3077292d15
commit cbfac15e23
5 changed files with 169 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pretix/control/middleware.py
+1 -1
View File
@@ -112,7 +112,7 @@ class PermissionMiddleware:
url = resolve(request.path_info)
url_name = url.url_name
if not request.path.startswith(get_script_prefix() + 'control'):
if not request.path.startswith(get_script_prefix() + 'control') and not (url.namespace.startswith("api-") and url_name == "authorize"):
# This middleware should only touch the /control subpath
return self.get_response(request)