github/meteor
1
1
Fork 0
mirror of https://github.com/meteor/meteor.git synced 2026-05-02 03:01:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

Only allow users to configure login services that are actually part of the app.

Browse Source 
(Well, and services with names like "registerLoginHandler", but whatever.)

This prevents this attack:
  - Alice launches site with Facebook login
  - Mallory sends configureLoginService method to configure the Twitter service
  - Alice runs "meteor add accounts-twitter" and is impressed that Twitter integration
    Just Works with no configuration
  - Now the app is using Mallory's credentials
This commit is contained in:
David Glasser
2012-10-08 20:53:30 -07:00
parent 3c3540497c
commit 37201062e1
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
packages/accounts-base/accounts_server.js
View File

@@ -260,10 +260,14 @@
// to this collection are also allowed in insecure mode.
Meteor.methods({
"configureLoginService": function(options) {
if (!Accounts.configuration.findOne({service: options.service}))
Accounts.configuration.insert(options);
else
// Don't let random users configure a service we haven't added yet (so
// that when we do later add it, it's set up with their configuration
// instead of ours).
if (!Accounts[options.service])
throw new Meteor.Error(403, "Service unknown");
if (Accounts.configuration.findOne({service: options.service}))
throw new Meteor.Error(403, "Service " + options.service + " already configured");
Accounts.configuration.insert(options);
}
});

2
packages/accounts-ui-unstyled/login_buttons_dialogs.js
View File

@@ -170,7 +170,7 @@
// Configure this login service
Meteor.call("configureLoginService", configuration, function (error, result) {
if (error)
Meteor._debug("Error configurating login service " + serviceName, error);
Meteor._debug("Error configuring login service " + serviceName, error);
else
loginButtonsSession.set('configureLoginServiceDialogVisible', false);
});