Infrastructure/ghost
0
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2025-01-20 22:42:53 -05:00
Code Issues Activity

Updated OAuth middleware to use the correct URL helpers

Browse source 
no-ref

Hardcoded redirect URLs were breaking when admin and site URLs were
different, or when Ghost is configured with a subdirectory.
This commit is contained in:
Matt Hanley 2021-09-23 17:26:29 +01:00 • committed by GitHub
parent a3f46708e2
commit a9ea792d65
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
core/server/web/oauth/app.js
View file

@ -36,11 +36,10 @@ module.exports = function setupOAuthApp() {
*/ */
function googleOAuthMiddleware(clientId, secret) { function googleOAuthMiddleware(clientId, secret) {
return (req, res, next) => { return (req, res, next) => {
// TODO: use url config instead of the string /ghost const adminURL = urlUtils.urlFor('admin', true);
//Create the callback url to be sent to Google //Create the callback url to be sent to Google
const callbackUrl = new URL(urlUtils.getSiteUrl()); const callbackUrl = new URL('oauth/google/callback', adminURL);
callbackUrl.pathname = '/ghost/oauth/google/callback';
passport.authenticate(new GoogleStrategy({ passport.authenticate(new GoogleStrategy({
clientID: clientId, clientID: clientId,
@ -55,7 +54,7 @@ module.exports = function setupOAuthApp() {
const emails = profile.emails.filter(email => email.verified === true).map(email => email.value); const emails = profile.emails.filter(email => email.verified === true).map(email => email.value);
if (!emails.includes(req.user.get('email'))) { if (!emails.includes(req.user.get('email'))) {
return res.redirect('/ghost/#/staff/?message=oauth-linking-failed'); return res.redirect(new URL('#/staff?message=oauth-linking-failed', adminURL));
} }
// TODO: configure the oauth data for this user (row in the oauth table) // TODO: configure the oauth data for this user (row in the oauth table)
@ -70,7 +69,7 @@ module.exports = function setupOAuthApp() {
//TODO: instead find the oauth row with the email use the provider id //TODO: instead find the oauth row with the email use the provider id
const emails = profile.emails.filter(email => email.verified === true); const emails = profile.emails.filter(email => email.verified === true);
if (emails.length < 1) { if (emails.length < 1) {
return res.redirect('/ghost/#/signin?message=login-failed'); return res.redirect(new URL('#/signin?message=login-failed', adminURL));
} }
const email = emails[0].value; const email = emails[0].value;
@ -85,7 +84,7 @@ module.exports = function setupOAuthApp() {
let invite = await models.Invite.findOne({email, status: 'sent'}, options); let invite = await models.Invite.findOne({email, status: 'sent'}, options);
if (!invite || invite.get('expires') < Date.now()) { if (!invite || invite.get('expires') < Date.now()) {
return res.redirect('/ghost/#/signin?message=login-failed'); return res.redirect(new URL('#/signin?message=login-failed', adminURL));
} }
//Accept invite //Accept invite
@ -106,7 +105,7 @@ module.exports = function setupOAuthApp() {
await auth.session.sessionService.createSessionForUser(req, res, req.user); await auth.session.sessionService.createSessionForUser(req, res, req.user);
return res.redirect('/ghost/'); return res.redirect(adminURL);
}), { }), {
scope: ['profile', 'email'], scope: ['profile', 'email'],
session: false, session: false,
@ -133,7 +132,7 @@ module.exports = function setupOAuthApp() {
oauthApp.get('/:provider/callback', (req, res, next) => { oauthApp.get('/:provider/callback', (req, res, next) => {
// Set the referrer as the ghost instance domain so that the session is linked to the ghost instance domain // Set the referrer as the ghost instance domain so that the session is linked to the ghost instance domain
req.headers.referrer = urlUtils.getSiteUrl(); req.headers.referrer = urlUtils.getAdminUrl();
next(); next();
}, auth.authenticate.authenticateAdminApi, (req, res, next) => { }, auth.authenticate.authenticateAdminApi, (req, res, next) => {
if (req.params.provider !== 'google') { if (req.params.provider !== 'google') {