Defect #44654 ยป 0001-Fix-500-error-on-OAuth-API-requests-when-the-token-o.patch
| app/controllers/application_controller.rb | ||
|---|---|---|
| 155 | 155 |
# Oauth |
| 156 | 156 |
if access_token.accessible? |
| 157 | 157 |
user = User.active.find_by_id(access_token.resource_owner_id) |
| 158 |
user.oauth_scope = access_token.scopes.all.map(&:to_sym) |
|
| 158 |
user&.oauth_scope = access_token.scopes.all.map(&:to_sym)
|
|
| 159 | 159 |
else |
| 160 | 160 |
doorkeeper_render_error |
| 161 | 161 |
end |
| test/integration/api_test/my_test.rb | ||
|---|---|---|
| 138 | 138 |
) |
| 139 | 139 |
end |
| 140 |
test "GET /my/account.json authenticated via OAuth with a locked user should respond with 401" do |
|
| 141 |
application = Doorkeeper::Application.create!( |
|
| 142 |
:name => 'Test App', |
|
| 143 |
:redirect_uri => 'http://localhost/callback', |
|
| 144 |
:scopes => 'view_issues' |
|
| 145 |
) |
|
| 146 |
token = Doorkeeper::AccessToken.create!( |
|
| 147 |
:application_id => application.id, |
|
| 148 |
:resource_owner_id => 2, |
|
| 149 |
:scopes => 'view_issues', |
|
| 150 |
:expires_in => 7200 |
|
| 151 |
) |
|
| 152 |
User.find(2).update_column(:status, User::STATUS_LOCKED) |
|
| 153 | ||
| 154 |
get '/my/account.json', :headers => {'Authorization' => "Bearer #{token.plaintext_token}"}
|
|
| 155 | ||
| 156 |
assert_response :unauthorized |
|
| 157 |
end |
|
| 158 | ||
| 140 | 159 |
test "GET /my/account.json authenticated via API key should disclose the api_key" do |
| 141 | 160 |
key = User.find(2).api_key |