From 81b05340e9291e9af11727aee77f2c70a9d73498 Mon Sep 17 00:00:00 2001 From: Ivan Tashkinov Date: Thu, 12 Dec 2019 16:00:06 +0300 Subject: [#1427] Graceful clearance of OAuth admin scopes for non-admin users (no error raised). PleromaFE and other clients may safely request admin scope(s): if user isn't an admin, request is successful but only non-admin scopes from request are granted. --- lib/pleroma/web/oauth/scopes.ex | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'lib') diff --git a/lib/pleroma/web/oauth/scopes.ex b/lib/pleroma/web/oauth/scopes.ex index 5e04652c2..00da225b9 100644 --- a/lib/pleroma/web/oauth/scopes.ex +++ b/lib/pleroma/web/oauth/scopes.ex @@ -79,7 +79,9 @@ defmodule Pleroma.Web.OAuth.Scopes do if user.is_admin || !contains_admin_scopes?(scopes) || !contains_admin_scopes?(app_scopes) do {:ok, scopes} else - {:error, :unsupported_scopes} + # Gracefully dropping admin scopes from requested scopes if user isn't an admin (not raising) + scopes = scopes -- OAuthScopesPlug.filter_descendants(scopes, ["admin"]) + validate(scopes, app_scopes, user) end end -- cgit v1.2.3