Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Remove support for OAUTH_REDIRECT_AT_SIGN_IN (#17287)

Browse source 
Fixes #15959

Introduced in #6540, OAUTH_REDIRECT_AT_SIGN_IN allowed skipping the log-in form
to instead redirect to the external OmniAuth login provider.

However, it did not prevent the log-in form on /about introduced by #10232 from
appearing, and completely broke with the introduction of #15228.

As I restoring that previous log-in flow without introducing a security
vulnerability may require extensive care and knowledge of how OmniAuth works,
this commit removes support for OAUTH_REDIRECT_AT_SIGN_IN instead for the time
being.
This commit is contained in:
Claire 2022-01-23 15:50:41 +01:00 • committed by GitHub
parent 8a07ecd377
commit cfa583fa71
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 0 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

1
config/initializers/omniauth.rb
View file

@ -5,7 +5,6 @@ end
Devise.setup do |config|
# Devise omniauth strategies
options = {}
options[:redirect_at_sign_in] = ENV['OAUTH_REDIRECT_AT_SIGN_IN'] == 'true'
# CAS strategy
if ENV['CAS_ENABLED'] == 'true'