Commit b29be76b authored by Neetu Choudhary's avatar Neetu Choudhary
Browse files

fix:unauthenticated claim-selector rewrite leads to account takeover

parent 1fc1d5a7

README.md

+9 −3
Changes for README.md: 9 added lines, 3 removed lines.
Original line number Diff line number Diff line 
# OAuth login module



This module lets users log in to your Drupal website using any OAuth 2.0 or OpenID Connect (OIDC) provider. We support a wide range of OAuth Providers, including Microsoft Entra AD, Keycloak, Azure AD B2C, Google Apps, GitHub, AWS Cognito, Salesforce, Discord, Ping Federate, and custom OAuth or OpenID providers.



The miniOrange OAuth / OIDC Client Login module facilitates authorization and authentication with any OAuth Provider/Server that adheres to the OAuth 2.0 and OpenID Connect (OIDC) 1.0 standards.

This module lets users log in to your Drupal website using any OAuth 2.0 or

OpenID Connect (OIDC) provider. We support a wide range of OAuth Providers,

including Microsoft Entra AD, Keycloak, Azure AD B2C, Google Apps, GitHub,

AWS Cognito, Salesforce, Discord, Ping Federate, and custom OAuth or OpenID

providers.



The miniOrange OAuth / OIDC Client Login module facilitates authorization and

authentication with any OAuth Provider/Server that adheres to the OAuth 2.0

and OpenID Connect (OIDC) 1.0 standards.



See: https://www.drupal.org/project/oauth_login_oauth2 for further information.

config/install/oauth_login_oauth2.settings.yml

+1 −0
Changes for config/install/oauth_login_oauth2.settings.yml: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -15,4 +15,5 @@ miniorange_auth_client_user_info_ep: '' 
miniorange_oauth_client_attr_list_from_server: ''

miniorange_oauth_client_show_attr_list_from_server: ''

miniorange_oauth_client_email_attr_val: ''

miniorange_oauth_client_trust_unverified_email: false

miniorange_oauth_client_enable_logging: ''

config/schema/oauth_login_oauth2.schema.yml

+2 −0
Changes for config/schema/oauth_login_oauth2.schema.yml: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -36,5 +36,7 @@ oauth_login_oauth2.settings: 
      type: string

    miniorange_oauth_client_email_attr_val:

      type: string

    miniorange_oauth_client_trust_unverified_email:

      type: boolean

    miniorange_oauth_client_enable_logging:

      type: boolean

css/oauth_login_oauth2.style_settings.css

+0 −2
Changes for css/oauth_login_oauth2.style_settings.css: 0 added lines, 2 removed lines.
Original line number Diff line number Diff line
@@ -325,5 +325,3 @@ table.tableborder th { 
    color: #f2f2f2;

  }

}

oauth_login_oauth2.install

+12 −2
Changes for oauth_login_oauth2.install: 12 added lines, 2 removed lines.
Original line number Diff line number Diff line 
<?php



/**

 * @file

 * Install, update and uninstall functions for the oauth_login_oauth2 module.

 */



use Drupal\oauth_login_oauth2\Utilities;



/**
@@ -9,7 +14,9 @@ function oauth_login_oauth2_install() { 
  drupal_flush_all_caches();

}





/**

 * Encrypts the previously plain-text stored client secret.

 */

function oauth_login_oauth2_update_113101() {

  $config = \Drupal::configFactory()->getEditable('oauth_login_oauth2.settings');

  $client_secret = $config->get('miniorange_auth_client_client_secret');
@@ -19,6 +26,9 @@ function oauth_login_oauth2_update_113101() { 
  $config->set('miniorange_auth_client_client_secret', $client_secret)->save();

}



/**

 * Implements hook_uninstall().

 */

function oauth_login_oauth2_uninstall() {

  \Drupal::state()->set('mo-oauth-free-tier-notify-us-closed', false);

  \Drupal::state()->set('mo-oauth-free-tier-notify-us-closed', FALSE);

}