Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2026-09-10 04:30:23 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix: bug that allowed for bypass of GDPR interstitial on SSO registrations simply by cancelling the form

Browse Source
This commit is contained in:
Julian Lam
2022-10-11 10:42:30 -04:00
parent 2533a2e074
commit c285f72e12
2 changed files with 82 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/controllers/authentication.js
View File

@@ -209,18 +209,22 @@ authenticationController.registerComplete = async function (req, res) {
}
};
authenticationController.registerAbort = function (req, res) {
authenticationController.registerAbort = async (req, res) => {
if (req.uid) {
// Clear interstitial data and continue on...
delete req.session.registration;
res.redirect(nconf.get('relative_path') + (req.session.returnTo || '/'));
} else {
// End the session and redirect to home
req.session.destroy(() => {
res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());
res.redirect(`${nconf.get('relative_path')}/`);
});
// Email is the only cancelable interstitial
delete req.session.registration.updateEmail;
const { interstitials } = await user.interstitials.get(req, req.session.registration);
if (!interstitials.length) {
return res.redirect(nconf.get('relative_path') + (req.session.returnTo || '/'));
}
}
// End the session and redirect to home
req.session.destroy(() => {
res.clearCookie(nconf.get('sessionKey'), meta.configs.cookie.get());
res.redirect(`${nconf.get('relative_path')}/`);
});
};
authenticationController.login = async (req, res, next) => {