Matrix-Mirrors/matrix-dimension
1
0
Fork 0
mirror of https://github.com/turt2live/matrix-dimension.git synced 2024-10-01 01:05:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

Require ?v=1.1 on Scalar /register and /account

Browse Source 
For upstream compatibility and security.
This commit is contained in:
Travis Ralston 2019-03-15 20:02:21 -06:00
parent 0287e472f8
commit dce6bcde56
4 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/api/scalar/ScalarService.ts
View File

@ -49,7 +49,11 @@ export class ScalarService {
@POST @POST
@Path("register") @Path("register")
public async register(request: RegisterRequest): Promise<ScalarRegisterResponse> { public async register(request: RegisterRequest, @QueryParam("v") apiVersion: string): Promise<ScalarRegisterResponse> {
if (apiVersion !== "1.1") {
throw new ApiError(401, "Invalid API version.");
}
const mxClient = new MatrixOpenIdClient(<OpenId>request); const mxClient = new MatrixOpenIdClient(<OpenId>request);
const mxUserId = await mxClient.getUserId(); const mxUserId = await mxClient.getUserId();
@ -95,7 +99,11 @@ export class ScalarService {
@GET @GET
@Path("account") @Path("account")
public async getAccount(@QueryParam("scalar_token") scalarToken: string): Promise<ScalarAccountResponse> { public async getAccount(@QueryParam("scalar_token") scalarToken: string, @QueryParam("v") apiVersion: string): Promise<ScalarAccountResponse> {
if (apiVersion !== "1.1") {
throw new ApiError(401, "Invalid API version.");
}
const userId = await ScalarService.getTokenOwner(scalarToken); const userId = await ScalarService.getTokenOwner(scalarToken);
return {user_id: userId}; return {user_id: userId};
} }

2
src/scalar/ScalarClient.ts
View File

@ -3,6 +3,7 @@ import { ScalarRegisterResponse } from "../models/ScalarResponses";
import * as request from "request"; import * as request from "request";
import { LogService } from "matrix-js-snippets"; import { LogService } from "matrix-js-snippets";
import Upstream from "../db/models/Upstream"; import Upstream from "../db/models/Upstream";
import { SCALAR_API_VERSION } from "../utils/common-constants";
export class ScalarClient { export class ScalarClient {
constructor(private upstream: Upstream) { constructor(private upstream: Upstream) {
@ -14,6 +15,7 @@ export class ScalarClient {
request({ request({
method: "POST", method: "POST",
url: this.upstream.scalarUrl + "/register", url: this.upstream.scalarUrl + "/register",
qs: {v: SCALAR_API_VERSION},
json: openId, json: openId,
}, (err, res, _body) => { }, (err, res, _body) => {
if (err) { if (err) {

1
src/utils/common-constants.ts Normal file
View File

@ -0,0 +1 @@
export const SCALAR_API_VERSION = "1.1";

7
web/app/shared/services/scalar/scalar-server-api.service.ts
View File

@ -6,6 +6,7 @@ import {
FE_ScalarRegisterResponse FE_ScalarRegisterResponse
} from "../../models/scalar-server-responses"; } from "../../models/scalar-server-responses";
import { AuthedApi } from "../authed-api"; import { AuthedApi } from "../authed-api";
import { SCALAR_API_VERSION } from "../../../../../src/utils/common-constants";
@Injectable() @Injectable()
export class ScalarServerApiService extends AuthedApi { export class ScalarServerApiService extends AuthedApi {
@ -14,10 +15,12 @@ export class ScalarServerApiService extends AuthedApi {
} }
public getAccount(): Promise<FE_ScalarAccountResponse> { public getAccount(): Promise<FE_ScalarAccountResponse> {
return this.authedGet("/api/v1/scalar/account").map(res => res.json()).toPromise(); return this.authedGet("/api/v1/scalar/account", {v: SCALAR_API_VERSION}).map(res => res.json()).toPromise();
} }
public register(openId: FE_ScalarOpenIdRequestBody): Promise<FE_ScalarRegisterResponse> { public register(openId: FE_ScalarOpenIdRequestBody): Promise<FE_ScalarRegisterResponse> {
return this.http.post("/api/v1/scalar/register", openId).map(res => res.json()).toPromise(); return this.http.post("/api/v1/scalar/register", openId, {
params: {v: SCALAR_API_VERSION},
}).map(res => res.json()).toPromise();
} }
} }