michael.heier/jellyfin
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Merge pull request #8734 from nielsvanvelzen/qc-revoke

Browse Source
This commit is contained in:
Bond-009 2022-12-07 18:14:16 +01:00 committed by GitHub
commit 8258d884f3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
Jellyfin.Api/Controllers/QuickConnectController.cs
View File

@ -1,3 +1,4 @@
using System;
using System.ComponentModel.DataAnnotations; using System.ComponentModel.DataAnnotations;
using System.Threading.Tasks; using System.Threading.Tasks;
using Jellyfin.Api.Constants; using Jellyfin.Api.Constants;
@ -51,7 +52,7 @@ namespace Jellyfin.Api.Controllers
/// <response code="200">Quick connect request successfully created.</response> /// <response code="200">Quick connect request successfully created.</response>
/// <response code="401">Quick connect is not active on this server.</response> /// <response code="401">Quick connect is not active on this server.</response>
/// <returns>A <see cref="QuickConnectResult"/> with a secret and code for future use or an error message.</returns> /// <returns>A <see cref="QuickConnectResult"/> with a secret and code for future use or an error message.</returns>
[HttpGet("Initiate")] [HttpPost("Initiate")]
[ProducesResponseType(StatusCodes.Status200OK)] [ProducesResponseType(StatusCodes.Status200OK)]
public async Task<ActionResult<QuickConnectResult>> InitiateQuickConnect() public async Task<ActionResult<QuickConnectResult>> InitiateQuickConnect()
{ {
@ -66,6 +67,16 @@ namespace Jellyfin.Api.Controllers
} }
} }
/// <summary>
/// Old version of <see cref="InitiateQuickConnect" /> using a GET method.
/// Still available to avoid breaking compatibility.
/// </summary>
/// <returns>The result of <see cref="InitiateQuickConnect" />.</returns>
[Obsolete("Use POST request instead")]
[HttpGet("Initiate")]
[ApiExplorerSettings(IgnoreApi = true)]
public Task<ActionResult<QuickConnectResult>> InitiateQuickConnectLegacy() => InitiateQuickConnect();
/// <summary> /// <summary>
/// Attempts to retrieve authentication information. /// Attempts to retrieve authentication information.
/// </summary> /// </summary>
@ -96,6 +107,7 @@ namespace Jellyfin.Api.Controllers
/// Authorizes a pending quick connect request. /// Authorizes a pending quick connect request.
/// </summary> /// </summary>
/// <param name="code">Quick connect code to authorize.</param> /// <param name="code">Quick connect code to authorize.</param>
/// <param name="userId">The user the authorize. Access to the requested user is required.</param>
/// <response code="200">Quick connect result authorized successfully.</response> /// <response code="200">Quick connect result authorized successfully.</response>
/// <response code="403">Unknown user id.</response> /// <response code="403">Unknown user id.</response>
/// <returns>Boolean indicating if the authorization was successful.</returns> /// <returns>Boolean indicating if the authorization was successful.</returns>
@ -103,17 +115,19 @@ namespace Jellyfin.Api.Controllers
[Authorize(Policy = Policies.DefaultAuthorization)] [Authorize(Policy = Policies.DefaultAuthorization)]
[ProducesResponseType(StatusCodes.Status200OK)] [ProducesResponseType(StatusCodes.Status200OK)]
[ProducesResponseType(StatusCodes.Status403Forbidden)] [ProducesResponseType(StatusCodes.Status403Forbidden)]
public async Task<ActionResult<bool>> AuthorizeQuickConnect([FromQuery, Required] string code) public async Task<ActionResult<bool>> AuthorizeQuickConnect([FromQuery, Required] string code, [FromQuery] Guid? userId = null)
{ {
var userId = User.GetUserId(); var currentUserId = User.GetUserId();
if (userId.Equals(default)) var actualUserId = userId ?? currentUserId;
if (actualUserId.Equals(default) || (!userId.Equals(currentUserId) && !User.IsInRole(UserRoles.Administrator)))
{ {
return StatusCode(StatusCodes.Status403Forbidden, "Unknown user id"); return Forbid("Unknown user id");
} }
try try
{ {
return await _quickConnect.AuthorizeRequest(userId, code).ConfigureAwait(false); return await _quickConnect.AuthorizeRequest(actualUserId, code).ConfigureAwait(false);
} }
catch (AuthenticationException) catch (AuthenticationException)
{ {