Merge pull request #157 from sywesk/master

LyricTian · web-flow · commit b46cf9f1db65 · 2020-07-21T01:10:17.000+08:00
Fix client secret not being checked
diff --git a/manage/manager.go b/manage/manager.go
@@ -261,7 +261,7 @@ func (m *Manager) GenerateAccessToken(ctx context.Context, gt oauth2.GrantType,
 		if !cliPass.VerifyPassword(tgr.ClientSecret) {
 			return nil, errors.ErrInvalidClient
 		}
-	} else if len(tgr.ClientSecret) > 0 && tgr.ClientSecret != cli.GetSecret() {
+	} else if len(cli.GetSecret()) > 0 && tgr.ClientSecret != cli.GetSecret() {
 		return nil, errors.ErrInvalidClient
 	}
 	if tgr.RedirectURI != "" {

Original file line number	Diff line number	Diff line change
`@@ -261,7 +261,7 @@ func (m *Manager) GenerateAccessToken(ctx context.Context, gt oauth2.GrantType,`
`261`	`261`	`if !cliPass.VerifyPassword(tgr.ClientSecret) {`
`262`	`262`	`return nil, errors.ErrInvalidClient`
`263`	`263`	`}`
`264`		`- } else if len(tgr.ClientSecret) > 0 && tgr.ClientSecret != cli.GetSecret() {`
	`264`	`+ } else if len(cli.GetSecret()) > 0 && tgr.ClientSecret != cli.GetSecret() {`
`265`	`265`	`return nil, errors.ErrInvalidClient`
`266`	`266`	`}`
`267`	`267`	`if tgr.RedirectURI != "" {`