Moonlight-Panel/Moonlight
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed oauth2 account spoofing using unverified discord accounts for claiming identity

Browse Source
This commit is contained in:
Marcel Baumgartner
2023-06-24 22:15:04 +02:00
parent faebaa59dd
commit 389ded9b77
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
Moonlight/App/OAuth2/Providers/DiscordOAuth2Provider.cs
View File

@@ -86,6 +86,13 @@ public class DiscordOAuth2Provider : OAuth2Provider
var email = getData.GetValue<string>("email"); var email = getData.GetValue<string>("email");
var id = getData.GetValue<ulong>("id"); var id = getData.GetValue<ulong>("id");
var verified = getData.GetValue<bool>("verified");
if (!verified)
{
Logger.Warn("A user tried to use an unverified discord account to login", "security");
throw new DisplayException("You can only use verified discord accounts for oauth signin");
}
// Handle data // Handle data