You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shindig.apache.org by Andreas Kohn <an...@gmail.com> on 2013/11/11 16:01:28 UTC
Review Request 15419: Really check that the user gave his authorization
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/15419/
-----------------------------------------------------------
Review request for shindig.
Bugs: SHINDIG-1945
https://issues.apache.org/jira/browse/SHINDIG-1945
Repository: shindig
Description
-------
Check the value of the submit button, not a parameter.
Previously the code would always assume the user authorized the request, because the parameter 'Authorize' was set in both cases (to 'Authorize' or 'Deny', respectively).
Diffs
-----
trunk/java/server-resources/src/main/webapp/WEB-INF/authorize.jsp 1534944
Diff: https://reviews.apache.org/r/15419/diff/
Testing
-------
Review only, I've removed all OAuth support in our app as it isn't needed, and parts of shindig explicitly says this code is *not* for production use.
Thanks,
Andreas Kohn
Re: Review Request 15419: Really check that the user gave his authorization
Posted by Ryan Baxter <rb...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/15419/#review28775
-----------------------------------------------------------
Ship it!
Committed revision 1541340. Please close the review.
- Ryan Baxter
On Nov. 11, 2013, 3:01 p.m., Andreas Kohn wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/15419/
> -----------------------------------------------------------
>
> (Updated Nov. 11, 2013, 3:01 p.m.)
>
>
> Review request for shindig.
>
>
> Bugs: SHINDIG-1945
> https://issues.apache.org/jira/browse/SHINDIG-1945
>
>
> Repository: shindig
>
>
> Description
> -------
>
> Check the value of the submit button, not a parameter.
>
> Previously the code would always assume the user authorized the request, because the parameter 'Authorize' was set in both cases (to 'Authorize' or 'Deny', respectively).
>
>
> Diffs
> -----
>
> trunk/java/server-resources/src/main/webapp/WEB-INF/authorize.jsp 1534944
>
> Diff: https://reviews.apache.org/r/15419/diff/
>
>
> Testing
> -------
>
> Review only, I've removed all OAuth support in our app as it isn't needed, and parts of shindig explicitly says this code is *not* for production use.
>
>
> Thanks,
>
> Andreas Kohn
>
>
Re: Review Request 15419: Really check that the user gave his authorization
Posted by Stanton Sievers <si...@gmail.com>.
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/15419/#review28730
-----------------------------------------------------------
Ship it!
Ship It!
- Stanton Sievers
On Nov. 11, 2013, 3:01 p.m., Andreas Kohn wrote:
>
> -----------------------------------------------------------
> This is an automatically generated e-mail. To reply, visit:
> https://reviews.apache.org/r/15419/
> -----------------------------------------------------------
>
> (Updated Nov. 11, 2013, 3:01 p.m.)
>
>
> Review request for shindig.
>
>
> Bugs: SHINDIG-1945
> https://issues.apache.org/jira/browse/SHINDIG-1945
>
>
> Repository: shindig
>
>
> Description
> -------
>
> Check the value of the submit button, not a parameter.
>
> Previously the code would always assume the user authorized the request, because the parameter 'Authorize' was set in both cases (to 'Authorize' or 'Deny', respectively).
>
>
> Diffs
> -----
>
> trunk/java/server-resources/src/main/webapp/WEB-INF/authorize.jsp 1534944
>
> Diff: https://reviews.apache.org/r/15419/diff/
>
>
> Testing
> -------
>
> Review only, I've removed all OAuth support in our app as it isn't needed, and parts of shindig explicitly says this code is *not* for production use.
>
>
> Thanks,
>
> Andreas Kohn
>
>