CodeMirror/appwrite
1
0
Fork 0
mirror of synced 2024-07-06 07:00:56 +12:00
Code Issues Projects Releases Wiki Activity

Fix not hiding tokens for clients via realtime

Browse source
This commit is contained in:
Jake Barnby 2024-03-26 18:59:56 +13:00
parent 7316a2da0a
commit d5d45c5076
No known key found for this signature in database
GPG key ID: C437A8CC85B96E9C
1 changed files with 28 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

78
app/controllers/api/account.php
View file

@ -1845,6 +1845,9 @@ App::post('/v1/account/tokens/magic-url')
'team' => '',
];
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $tokenSecret : '');
$queueForMails
->setSubject($subject)
->setBody($body)
@ -1853,23 +1856,16 @@ App::post('/v1/account/tokens/magic-url')
->trigger();
$queueForEvents->setPayload(
$response->output(
$token->setAttribute('secret', $tokenSecret),
Response::MODEL_TOKEN
)
$response->output($token, Response::MODEL_TOKEN)
);
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $tokenSecret : '');
if (!empty($phrase)) {
$token->setAttribute('phrase', $phrase);
}
$response
->setStatusCode(Response::STATUS_CODE_CREATED)
->dynamic($token, Response::MODEL_TOKEN)
;
->dynamic($token, Response::MODEL_TOKEN);
});
App::post('/v1/account/tokens/email')
@ -2074,6 +2070,9 @@ App::post('/v1/account/tokens/email')
'team' => '',
];
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $tokenSecret : '');
$queueForMails
->setSubject($subject)
->setBody($body)
@ -2082,23 +2081,16 @@ App::post('/v1/account/tokens/email')
->trigger();
$queueForEvents->setPayload(
$response->output(
$token->setAttribute('secret', $tokenSecret),
Response::MODEL_TOKEN
)
$response->output($token, Response::MODEL_TOKEN)
);
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $tokenSecret : '');
if (!empty($phrase)) {
$token->setAttribute('phrase', $phrase);
}
$response
->setStatusCode(Response::STATUS_CODE_CREATED)
->dynamic($token, Response::MODEL_TOKEN)
;
->dynamic($token, Response::MODEL_TOKEN);
});
App::put('/v1/account/sessions/magic-url')
@ -2309,6 +2301,9 @@ App::post('/v1/account/tokens/phone')
],
]);
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? Auth::encodeSession($user->getId(), $secret) : '');
$queueForMessaging
->setType(MESSAGE_SEND_TYPE_INTERNAL)
->setMessage($messageDoc)
@ -2316,19 +2311,12 @@ App::post('/v1/account/tokens/phone')
->setProviderType(MESSAGE_TYPE_SMS);
$queueForEvents->setPayload(
$response->output(
$token->setAttribute('secret', $secret),
Response::MODEL_TOKEN
)
$response->output($token, Response::MODEL_TOKEN)
);
// Hide secret for clients
$token->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? Auth::encodeSession($user->getId(), $secret) : '');
$response
->setStatusCode(Response::STATUS_CODE_CREATED)
->dynamic($token, Response::MODEL_TOKEN)
;
->dynamic($token, Response::MODEL_TOKEN);
});
App::post('/v1/account/jwt')
@ -2968,6 +2956,9 @@ App::post('/v1/account/recovery')
'team' => ''
];
// Hide secret for clients
$recovery->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $secret : '');
$queueForMails
->setRecipient($profile->getAttribute('email', ''))
->setName($profile->getAttribute('name', ''))
@ -2980,14 +2971,7 @@ App::post('/v1/account/recovery')
->setParam('userId', $profile->getId())
->setParam('tokenId', $recovery->getId())
->setUser($profile)
->setPayload($response->output(
$recovery->setAttribute('secret', $secret),
Response::MODEL_TOKEN
))
;
// Hide secret for clients
$recovery->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $secret : '');
->setPayload($response->output($recovery, Response::MODEL_TOKEN));
$response
->setStatusCode(Response::STATUS_CODE_CREATED)
@ -3158,6 +3142,7 @@ App::post('/v1/account/verification')
->setParam('{{footer}}', $locale->getText("emails.verification.footer"))
->setParam('{{thanks}}', $locale->getText("emails.verification.thanks"))
->setParam('{{signature}}', $locale->getText("emails.verification.signature"));
$body = $message->render();
$smtp = $project->getAttribute('smtp', []);
@ -3216,6 +3201,9 @@ App::post('/v1/account/verification')
'team' => '',
];
// Hide secret for clients
$verification->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $verificationSecret : '');
$queueForMails
->setSubject($subject)
->setBody($body)
@ -3227,13 +3215,7 @@ App::post('/v1/account/verification')
$queueForEvents
->setParam('userId', $user->getId())
->setParam('tokenId', $verification->getId())
->setPayload($response->output(
$verification->setAttribute('secret', $verificationSecret),
Response::MODEL_TOKEN
));
// Hide secret for clients
$verification->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $verificationSecret : '');
->setPayload($response->output($verification, Response::MODEL_TOKEN));
$response
->setStatusCode(Response::STATUS_CODE_CREATED)
@ -3389,6 +3371,9 @@ App::post('/v1/account/verification/phone')
],
]);
// Hide secret for clients
$verification->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $secret : '');
$queueForMessaging
->setType(MESSAGE_SEND_TYPE_INTERNAL)
->setMessage($messageDoc)
@ -3398,14 +3383,7 @@ App::post('/v1/account/verification/phone')
$queueForEvents
->setParam('userId', $user->getId())
->setParam('tokenId', $verification->getId())
->setPayload($response->output(
$verification->setAttribute('secret', $secret),
Response::MODEL_TOKEN
))
;
// Hide secret for clients
$verification->setAttribute('secret', ($isPrivilegedUser || $isAppUser) ? $secret : '');
->setPayload($response->output($verification, Response::MODEL_TOKEN));
$response
->setStatusCode(Response::STATUS_CODE_CREATED)