kumi/django-oidc-provider
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Merge pull request #84 from wojtek-fliposports/v0.3.x

Browse source 
Fixing missing verification of client response type and encoding the client secret.
This commit is contained in:
Juan Ignacio Fiorentino 2016-03-08 18:48:44 -03:00
parent d43bad80dc 08033bb9ad
commit a2809307cf
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
oidc_provider/admin.py
View file

@ -33,7 +33,7 @@ class ClientForm(ModelForm):
if instance and instance.pk:
return instance.client_secret
else:
return md5(str(uuid4())).hexdigest()
return md5(uuid4().hex.encode()).hexdigest()
@admin.register(Client)

4
oidc_provider/lib/endpoints/authorize.py
View file

@ -76,6 +76,10 @@ class AuthorizeEndpoint(object):
raise AuthorizeError(self.params.redirect_uri, 'invalid_request',
self.grant_type)
if self.is_authentication and self.params.response_type != self.client.response_type:
raise AuthorizeError(self.params.redirect_uri, 'invalid_request',
self.grant_type)
clean_redirect_uri = urlsplit(self.params.redirect_uri)
clean_redirect_uri = urlunsplit(clean_redirect_uri._replace(query=''))
if not (clean_redirect_uri in self.client.redirect_uris):