From c917f2df9b889dbb6df85fe571f86af36bd3405d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Bogus=C5=82awski?= <pawel.boguslawski@ib.pl>
Date: Wed, 9 Feb 2022 21:33:36 +0100
Subject: [PATCH] Disable unnecessary OpenID/OAuth2 elements (#18491)
This mod fixes disabling unnecessary OpenID elements.
Related: https://github.com/go-gitea/gitea/pull/13129
Author-Change-Id: IB#1115256
---
routers/web/web.go | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/routers/web/web.go b/routers/web/web.go
index 52eca9a0a6..d8c197fb96 100644
--- a/routers/web/web.go
+++ b/routers/web/web.go
@@ -190,6 +190,13 @@ func RegisterRoutes(m *web.Route) {
bindIgnErr := web.Bind
validation.AddBindingRules()
+ linkAccountEnabled := func(ctx *context.Context) {
+ if !setting.Service.EnableOpenIDSignIn && !setting.Service.EnableOpenIDSignUp && !setting.OAuth2.Enable {
+ ctx.Error(http.StatusForbidden)
+ return
+ }
+ }
+
openIDSignInEnabled := func(ctx *context.Context) {
if !setting.Service.EnableOpenIDSignIn {
ctx.Error(http.StatusForbidden)
@@ -279,9 +286,9 @@ func RegisterRoutes(m *web.Route) {
m.Get("/{provider}", auth.SignInOAuth)
m.Get("/{provider}/callback", auth.SignInOAuthCallback)
})
- m.Get("/link_account", auth.LinkAccount)
- m.Post("/link_account_signin", bindIgnErr(forms.SignInForm{}), auth.LinkAccountPostSignIn)
- m.Post("/link_account_signup", bindIgnErr(forms.RegisterForm{}), auth.LinkAccountPostRegister)
+ m.Get("/link_account", linkAccountEnabled, auth.LinkAccount)
+ m.Post("/link_account_signin", linkAccountEnabled, bindIgnErr(forms.SignInForm{}), auth.LinkAccountPostSignIn)
+ m.Post("/link_account_signup", linkAccountEnabled, bindIgnErr(forms.RegisterForm{}), auth.LinkAccountPostRegister)
m.Group("/two_factor", func() {
m.Get("", auth.TwoFactor)
m.Post("", bindIgnErr(forms.TwoFactorAuthForm{}), auth.TwoFactorPost)
@@ -345,7 +352,7 @@ func RegisterRoutes(m *web.Route) {
m.Post("/delete", security.DeleteOpenID)
m.Post("/toggle_visibility", security.ToggleOpenIDVisibility)
}, openIDSignInEnabled)
- m.Post("/account_link", security.DeleteAccountLink)
+ m.Post("/account_link", linkAccountEnabled, security.DeleteAccountLink)
})
m.Group("/applications/oauth2", func() {
m.Get("/{id}", user_setting.OAuth2ApplicationShow)