mirror of
https://gh.wpcy.net/https://github.com/discourse/discourse.git
synced 2026-05-02 17:57:36 +08:00
3e577b6ba8
Users/apps running OpenSSL in FIPS 140-3 mode cannot decrypt user API
key responses because FIPS forbids the legacy PKCS1_PADDING scheme.
Commit 300ece3d added support for a `padding=oaep` parameter to use
PKCS1_OAEP_PADDING instead, but the parameter was only handled in the
POST endpoints. When users go through the authorization UI flow (GET
/user-api-key/new → login → POST /user-api-key), the padding parameter
was lost because it wasn't captured in the controller or passed through
the form's hidden fields.
This fix:
- Captures @padding in the #new and #otp controller actions
- Adds hidden field for padding in new.html.erb and otp.html.erb
- Removes unused ALLOWED_PADDING_MODES constant
- Refactors specs to be more organized and concise
Internal ref - t/170427
10 lines
485 B
Text
10 lines
485 B
Text
<h1><%= t("user_api_key.otp_description", application_name: @application_name) %></h1>
|
|
<div class='authorize-api-key'>
|
|
<%= form_tag(user_api_key_otp_path) do %>
|
|
<%= hidden_field_tag 'application_name', @application_name %>
|
|
<%= hidden_field_tag 'public_key', @public_key%>
|
|
<%= hidden_field_tag('auth_redirect', @auth_redirect) %>
|
|
<%= hidden_field_tag('padding', @padding) if @padding %>
|
|
<%= submit_tag t('user_api_key.authorize'), class: 'btn btn-primary' %>
|
|
<% end %>
|
|
</div>
|
