From b60b6ffc3f93b4d9a4c6869d1305258a1d844164 Mon Sep 17 00:00:00 2001 From: Dominion Date: Wed, 5 Apr 2023 00:16:26 -0400 Subject: [PATCH 1/4] @MrStonedOne MitM requested changes. --- README.md | 1 + build/Version.props | 2 +- .../Configuration/OAuthConfiguration.cs | 5 +++++ .../Security/OAuth/GenericOAuthValidator.cs | 4 +++- 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c314551797..2f9ca09eb9 100644 --- a/README.md +++ b/README.md @@ -173,6 +173,7 @@ Security: ClientSecret: "..." RedirectUrl: "..." ServerUrl: "..." + UserInformationUrlOverride: "..." # For power users, leave out of configuration for most cases. Not supported by GitHub provider. ``` The following providers use the `RedirectUrl` setting: diff --git a/build/Version.props b/build/Version.props index 8802116119..cbf5f2169e 100644 --- a/build/Version.props +++ b/build/Version.props @@ -4,7 +4,7 @@ 5.7.3 - 4.4.0 + 4.5.0 9.9.0 10.3.0 11.3.0 diff --git a/src/Tgstation.Server.Host/Configuration/OAuthConfiguration.cs b/src/Tgstation.Server.Host/Configuration/OAuthConfiguration.cs index 47c47d5083..1818a15d8b 100644 --- a/src/Tgstation.Server.Host/Configuration/OAuthConfiguration.cs +++ b/src/Tgstation.Server.Host/Configuration/OAuthConfiguration.cs @@ -16,5 +16,10 @@ namespace Tgstation.Server.Host.Configuration /// The authentication server URL. Not used by all providers. /// public Uri RedirectUrl { get; set; } + + /// + /// User information URL override. Not supported by the provider. + /// + public Uri UserInformationUrlOverride { get; set; } } } diff --git a/src/Tgstation.Server.Host/Security/OAuth/GenericOAuthValidator.cs b/src/Tgstation.Server.Host/Security/OAuth/GenericOAuthValidator.cs index 8eac45f2ad..f1cccb7437 100644 --- a/src/Tgstation.Server.Host/Security/OAuth/GenericOAuthValidator.cs +++ b/src/Tgstation.Server.Host/Security/OAuth/GenericOAuthValidator.cs @@ -121,7 +121,9 @@ namespace Tgstation.Server.Host.Security.OAuth } Logger.LogTrace("Getting user details..."); - using var userInformationRequest = new HttpRequestMessage(HttpMethod.Get, UserInformationUrl); + + var userInfoUrl = OAuthConfiguration?.UserInformationUrlOverride ?? UserInformationUrl; + using var userInformationRequest = new HttpRequestMessage(HttpMethod.Get, userInfoUrl); userInformationRequest.Headers.Authorization = new AuthenticationHeaderValue( ApiHeaders.BearerAuthenticationScheme, accessToken); From 458b79a052f3ff1b6d2cd9f84241c85637ebba47 Mon Sep 17 00:00:00 2001 From: Dominion Date: Wed, 5 Apr 2023 00:17:13 -0400 Subject: [PATCH 2/4] Bump bundled webpanel to 4.18.0 --- build/ControlPanelVersion.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/ControlPanelVersion.props b/build/ControlPanelVersion.props index ff4985b645..fa2a82aa30 100644 --- a/build/ControlPanelVersion.props +++ b/build/ControlPanelVersion.props @@ -1,6 +1,6 @@ - 4.17.0 + 4.18.0 From ced7324657b51eb0eb55f5f6bb7106f3ce40fd29 Mon Sep 17 00:00:00 2001 From: Dominion Date: Wed, 5 Apr 2023 00:17:30 -0400 Subject: [PATCH 3/4] Version bump to 5.8.0 --- build/Version.props | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build/Version.props b/build/Version.props index cbf5f2169e..3602e14394 100644 --- a/build/Version.props +++ b/build/Version.props @@ -3,7 +3,7 @@ - 5.7.3 + 5.8.0 4.5.0 9.9.0 10.3.0 From 300226d97ff54f6a95c775f5ff40b268c5928b3e Mon Sep 17 00:00:00 2001 From: Dominion Date: Wed, 5 Apr 2023 00:21:17 -0400 Subject: [PATCH 4/4] Fix README indentation --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2f9ca09eb9..022e5d860f 100644 --- a/README.md +++ b/README.md @@ -173,7 +173,7 @@ Security: ClientSecret: "..." RedirectUrl: "..." ServerUrl: "..." - UserInformationUrlOverride: "..." # For power users, leave out of configuration for most cases. Not supported by GitHub provider. + UserInformationUrlOverride: "..." # For power users, leave out of configuration for most cases. Not supported by GitHub provider. ``` The following providers use the `RedirectUrl` setting: