git.iko.soy/typeable/oauth2-proxy
on master help sign in
fix(1356): test if session variable is null (#1357)
ccbb98aHedi Harzallah
CHANGELOG.md+1
compare with master
unifiedsplit
@@ -34,6 +34,7 @@
34- [#1244](https://github.com/oauth2-proxy/oauth2-proxy/pull/1244) Update Alpine image version to 3.14 (@ahovgaard)
34- [#1244](https://github.com/oauth2-proxy/oauth2-proxy/pull/1244) Update Alpine image version to 3.14 (@ahovgaard)
35- [#1317](https://github.com/oauth2-proxy/oauth2-proxy/pull/1317) Fix incorrect `</form>` tag on the sing_in page when *not* using a custom template (@jord1e)
35- [#1317](https://github.com/oauth2-proxy/oauth2-proxy/pull/1317) Fix incorrect `</form>` tag on the sing_in page when *not* using a custom template (@jord1e)
36- [#1330](https://github.com/oauth2-proxy/oauth2-proxy/pull/1330) Allow specifying URL as input for custom sign in logo (@MaikuMori)
36- [#1330](https://github.com/oauth2-proxy/oauth2-proxy/pull/1330) Allow specifying URL as input for custom sign in logo (@MaikuMori)
37+- [#1357](https://github.com/oauth2-proxy/oauth2-proxy/pull/1357) Fix unsafe access to session variable (@harzallah)
37
38
38# V7.1.3
39# V7.1.3
39
40
pkg/middleware/basic_session.go+3−1
@@ -31,7 +31,9 @@ func loadBasicAuthSession(validator basic.Validator, sessionGroups []string, pre
31 if preferEmail {
31 if preferEmail {
32 getSession = func(validator basic.Validator, sessionGroups []string, req *http.Request) (*sessionsapi.SessionState, error) {
32 getSession = func(validator basic.Validator, sessionGroups []string, req *http.Request) (*sessionsapi.SessionState, error) {
33 session, err := getBasicSession(validator, sessionGroups, req)
33 session, err := getBasicSession(validator, sessionGroups, req)
34+ if session != nil {
34− session.Email = session.User
35+ session.Email = session.User
36+ }
35 return session, err
37 return session, err
36 }
38 }
37 }
39 }