Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-02-03 23:00:14 -05:00
Code Issues Activity

Protected against empty admin api key

Browse source 
refs #9865
This commit is contained in:
kirrg001 2019-01-18 17:32:41 +01:00
parent 1b5b95e198
commit 3f758c6a0a
3 changed files with 12 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
core/server/services/auth/api-key/admin.js
View file

@ -61,6 +61,13 @@ const authenticate = (req, res, next) => {
const apiKeyId = decoded.payload.kid; const apiKeyId = decoded.payload.kid;
if (!apiKeyId) {
return next(new common.errors.BadRequestError({
message: common.i18n.t('errors.middleware.auth.adminApiKeyMissing'),
code: 'MISSING_ADMIN_API_KEY'
}));
}
models.ApiKey.findOne({id: apiKeyId}).then((apiKey) => { models.ApiKey.findOne({id: apiKeyId}).then((apiKey) => {
if (!apiKey) { if (!apiKey) {
return next(new common.errors.UnauthorizedError({ return next(new common.errors.UnauthorizedError({

1
core/server/translations/en.json
View file

@ -79,6 +79,7 @@
"accessDenied": "Access denied.", "accessDenied": "Access denied.",
"pleaseSignIn": "Please Sign In", "pleaseSignIn": "Please Sign In",
"pleaseSignInOrAuthenticate": "Please sign in or authenticate with an API Key", "pleaseSignInOrAuthenticate": "Please sign in or authenticate with an API Key",
"adminApiKeyMissing": "Admin API Key missing.",
"unknownAdminApiKey": "Unknown Admin API Key", "unknownAdminApiKey": "Unknown Admin API Key",
"unknownContentApiKey": "Unknown Content API Key", "unknownContentApiKey": "Unknown Content API Key",
"invalidApiKeyType": "Invalid API Key type", "invalidApiKeyType": "Invalid API Key type",

7
core/test/unit/services/auth/api-key/admin_spec.js
View file

@ -96,12 +96,13 @@ describe('Admin API Key Auth', function () {
}); });
it('shouldn\'t authenticate with invalid/unknown key', function (done) { it('shouldn\'t authenticate with invalid/unknown key', function (done) {
const token = jwt.sign({}, this.secret, { const token = jwt.sign({
kid: 'unknown'
}, this.secret, {
algorithm: 'HS256', algorithm: 'HS256',
expiresIn: '5m', expiresIn: '5m',
audience: '/test/', audience: '/test/',
issuer: 'unknown', issuer: 'unknown'
keyid: 'unknown'
}); });
const req = { const req = {