diff options
| author | Christian Grothoff <grothoff@gnunet.org> | 2023-09-06 21:29:55 +0200 |
|---|---|---|
| committer | Christian Grothoff <grothoff@gnunet.org> | 2023-09-06 21:29:55 +0200 |
| commit | 5d24900f8bccd02ada1808bed373d5ac832f825d (patch) | |
| tree | 6ce34a135c96a1c0b32947ce661021136646ff46 /src | |
| parent | 5e2b19c64e2e8a3b84d82f1cf5c3c088e01b5c0c (diff) | |
-do not allow scope upgrades when refreshing
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/taler-merchant-httpd_private-post-instances-ID-token.c | 8 | ||||
| -rw-r--r-- | src/backenddb/versioning.sql | 4 |
2 files changed, 8 insertions, 4 deletions
diff --git a/src/backend/taler-merchant-httpd_private-post-instances-ID-token.c b/src/backend/taler-merchant-httpd_private-post-instances-ID-token.c index 28a521a4..839c68d1 100644 --- a/src/backend/taler-merchant-httpd_private-post-instances-ID-token.c +++ b/src/backend/taler-merchant-httpd_private-post-instances-ID-token.c @@ -91,6 +91,14 @@ TMH_private_post_instances_ID_token (const struct TMH_RequestHandler *rh, } if (refreshable) iscope |= TMH_AS_REFRESHABLE; + if (0 != (iscope & (~hc->auth_scope))) + { + /* more permissions requested for the new token, not allowed */ + GNUNET_break_op (0); + return TALER_MHD_reply_with_ec (connection, + TALER_EC_GENERIC_TOKEN_PERMISSION_INSUFFICIENT, + NULL); + } qs = TMH_db->insert_login_token (TMH_db->cls, mi->settings.id, &btoken, diff --git a/src/backenddb/versioning.sql b/src/backenddb/versioning.sql index c7fa8121..444cf95e 100644 --- a/src/backenddb/versioning.sql +++ b/src/backenddb/versioning.sql @@ -146,10 +146,6 @@ BEGIN; --- Added by Christian Grothoff to support concurrency, see --- https://stackoverflow.com/questions/29900845/create-schema-if-not-exists-raises-duplicate-key-error?rq=4 -LOCK TABLE pg_catalog.pg_namespace; - -- This file adds versioning support to database it will be loaded to. -- It requires that PL/pgSQL is already loaded - will raise exception otherwise. |