neoris/core
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix missing unescape of basic auth username

Browse Source
This commit is contained in:
Ingo Oppermann 2023-06-27 10:15:49 +02:00
parent 9202f93bc2
commit ad53f3ab68
No known key found for this signature in database
GPG Key ID: 2AB32426E9DD229E
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
http/middleware/iam/iam.go
View File

@ -36,6 +36,7 @@ import (
"errors"
"fmt"
"net/http"
"net/url"
"path/filepath"
"sort"
"strings"
@ -289,6 +290,12 @@ func (m *iammiddleware) findIdentityFromBasicAuth(c echo.Context) (iamidentity.V
}
}
if name, err := url.QueryUnescape(username); err != nil {
return nil, ErrBadRequest
} else {
username = name
}
identity, err := m.iam.GetVerifier(username)
if err != nil {
m.logger.Debug().WithFields(log.Fields{