OpenSourceArk/Ghost
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use config flag to change whether token integrity is checked

Browse Source 
ref KTLO-1
Allows us to get this out to self-hosters much faster
This commit is contained in:
Sam Lord 2024-08-22 22:07:33 +01:00 committed by Sam Lord
parent 23c0882019
commit 244e612f53
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ghost/core/core/server/services/members/middleware.js
View File

@ -169,19 +169,26 @@ const createIntegrityToken = async function createIntegrityToken(req, res) {
}; };
const verifyIntegrityToken = async function verifyIntegrityToken(req, res, next) { const verifyIntegrityToken = async function verifyIntegrityToken(req, res, next) {
const shouldThrowForInvalidToken = config.get('verifyRequestIntegrity');
try { try {
const token = req.body.integrityToken; const token = req.body.integrityToken;
if (!token) { if (!token) {
logging.warn('Request with missing integrity token.'); logging.warn('Request with missing integrity token.');
// In future this will throw an error if (shouldThrowForInvalidToken) {
return next(); throw new errors.BadRequestError();
} else {
return next();
}
} }
if (membersService.requestIntegrityTokenProvider.validate(token)) { if (membersService.requestIntegrityTokenProvider.validate(token)) {
return next(); return next();
} else { } else {
logging.warn('Request with invalid integrity token.'); logging.warn('Request with invalid integrity token.');
// In future this will throw an error if (shouldThrowForInvalidToken) {
return next(); throw new errors.BadRequestError();
} else {
return next();
}
} }
} catch (err) { } catch (err) {
next(err); next(err);