From bd5f8d54dfd23dcfddc39d6e6c257a78dcbf3be3 Mon Sep 17 00:00:00 2001 From: MAEDA Go Date: Thu, 22 Oct 2026 09:47:11 +0900 Subject: [PATCH] Fix 500 error on OAuth API requests when the token owner is not active --- app/controllers/application_controller.rb | 2 +- test/integration/api_test/my_test.rb | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 4bfec81bf..01a6822f9 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -155,7 +155,7 @@ class ApplicationController < ActionController::Base # Oauth if access_token.accessible? user = User.active.find_by_id(access_token.resource_owner_id) - user.oauth_scope = access_token.scopes.all.map(&:to_sym) + user&.oauth_scope = access_token.scopes.all.map(&:to_sym) else doorkeeper_render_error end diff --git a/test/integration/api_test/my_test.rb b/test/integration/api_test/my_test.rb index c5514d4c6..2263b0e28 100644 --- a/test/integration/api_test/my_test.rb +++ b/test/integration/api_test/my_test.rb @@ -138,6 +138,25 @@ class Redmine::ApiTest::MyTest < Redmine::ApiTest::Base ) end + test "GET /my/account.json authenticated via OAuth with a locked user should respond with 401" do + application = Doorkeeper::Application.create!( + :name => 'Test App', + :redirect_uri => 'http://localhost/callback', + :scopes => 'view_issues' + ) + token = Doorkeeper::AccessToken.create!( + :application_id => application.id, + :resource_owner_id => 2, + :scopes => 'view_issues', + :expires_in => 7200 + ) + User.find(2).update_column(:status, User::STATUS_LOCKED) + + get '/my/account.json', :headers => {'Authorization' => "Bearer #{token.plaintext_token}"} + + assert_response :unauthorized + end + test "GET /my/account.json authenticated via API key should disclose the api_key" do key = User.find(2).api_key -- 2.55.0