TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-08-12 14:57:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(crypto): check for nil client secret (#7729)

Browse Source 
When creating an app without secret or other type of authentication method,
like JWT, and the authentication type is switched afterwards the app would remain without generated secret.
If then client authentication with secret is attempted, for example on the token endpoint, the handler would panic in the crypto.CompareHash function on the nile pointer to the CryptoValue.

This fix introduces a nil pointer check in crypt.CompareHash and returns a error.

The issue was reported over discord: https://discord.com/channels/927474939156643850/1222971118730875020
Possible fix was suggested here: https://github.com/zitadel/zitadel/pull/6999#discussion_r1553503088
This bug only applies to zitadel versions <=2.49.1.
This commit is contained in:
Tim Möhlmann
2024-04-09 09:44:52 +03:00
committed by GitHub
parent 323425aa30
commit ad9422a7d0
16 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
internal/static/i18n/pl.yaml
View File

@@ -314,6 +314,7 @@ Errors:
APIAuthMethodNoSecret: Wybrany metoda uwierzytelniania API nie wymaga tajnego
AuthMethodNoPrivateKeyJWT: Wybrana metoda uwierzytelniania nie wymaga klucza
ClientSecretInvalid: Tajne klienta jest nieprawidłowe
ClientSecretNotSet: Klucz tajny klienta nie jest ustawiony
Key:
AlreadyExisting: Klucz aplikacji już istnieje
NotFound: Klucz aplikacji nie znaleziony