hedgedoc/lib/web
Sheogorath 1f1b2bd386 fix(oauth2): Fix crash in rolesClaim extraction
This patch adds a try-catch around the rolesClaim extraction to prevent
full crashes of HedgeDoc when a user profile is read, that doesn't
contain any such claim, which can happen with some IdPs, like Keycloak,
that omit the attribute when it's empty.

As a result an authorized user would crash the entire server, which is
definitely unintended behaviour. The simply try-catch should resolve the
issue and make sure that roles is always defined even if the
`extractProfileAttribute` call fails.

Signed-off-by: Sheogorath <sheogorath@shivering-isles.com>
2023-10-19 19:34:44 +02:00
..
auth fix(oauth2): Fix crash in rolesClaim extraction 2023-10-19 19:34:44 +02:00
imageRouter
middleware
note fix: use better already-exist check in note creation 2023-07-18 23:18:21 +02:00
baseRouter.js
historyRouter.js
statusRouter.js
userRouter.js
utils.js