vbatts/registry
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Ensure that unset Context.Name only allowed on base route

Browse source 
If Context.Name is not set, the acceess controller may allow an unintended
request through. By only allowing a request to proceed without a name on the
base route, we provide some protection if future bugs forget to set the context
properly.
This commit is contained in:
Stephen J Day 2014-12-18 17:20:35 -08:00
parent e50fcc0ab9
commit b1f36c3fe5
3 changed files with 55 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

2
auth/silly/access.go
View file

@ -51,7 +51,7 @@ func (ac *accessController) Authorized(req *http.Request, accessRecords ...auth.
if len(accessRecords) > 0 {
var scopes []string
for _, access := range accessRecords {
scopes = append(scopes, fmt.Sprintf("%s:%s:%s", access.Type, access.Resource, access.Action))
scopes = append(scopes, fmt.Sprintf("%s:%s:%s", access.Type, access.Resource.Name, access.Action))
}
challenge.scope = strings.Join(scopes, " ")
}