fix(1356): test if session variable is null (#1357)
* fix(1356): test if session variable is null
* fix(1356): adding changelog
Co-authored-by: Hedi Harzallah <hharzalla@talend.com>
commitccbb98acd9bba68ad3edce10deb02ddbf1543564
authorHedi Harzallah <hedi.harzallah@gmail.com>
dateThu 9 Sep 2021, 13:12 (5 years ago)
parent54d44cc
CHANGELOG.md+1
@@ -34,6 +34,7 @@
3434- [#1244](https://github.com/oauth2-proxy/oauth2-proxy/pull/1244) Update Alpine image version to 3.14 (@ahovgaard)
3535- [#1317](https://github.com/oauth2-proxy/oauth2-proxy/pull/1317) Fix incorrect `</form>` tag on the sing_in page when *not* using a custom template (@jord1e)
3636- [#1330](https://github.com/oauth2-proxy/oauth2-proxy/pull/1330) Allow specifying URL as input for custom sign in logo (@MaikuMori)
37+- [#1357](https://github.com/oauth2-proxy/oauth2-proxy/pull/1357) Fix unsafe access to session variable (@harzallah)
3738
3839# V7.1.3
3940
pkg/middleware/basic_session.go+3−1
@@ -31,7 +31,9 @@ func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, pre
3131 if preferEmail {
3232 getSession = func(validator basic.Validator, sessionGroups []string, req *http.Request) (*sessionsapi.SessionState, error) {
3333 session, err := getBasicSession(validator, sessionGroups, req)
34− session.Email = session.User
34+ if session != nil {
35+ session.Email = session.User
36+ }
3537 return session, err
3638 }
3739 }