fedipod 1.49.1 → 1.49.2

package/lib/client/masto/oauth.mjs

@@ -85,7 +85,7 @@ button[hidden]{display:none}
   return true;
 }
 
-function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}) {
+function sendLoginForm(res, params, error = '', client = null, status = null, headers = {}, mount = '') {
   const hidden = [...params.entries()].filter(([k]) => k !== 'password')
     .map(([k, v]) => `<input type="hidden" name="${escapeHtml(k)}" value="${escapeHtml(v)}">`).join('\n');
   // Name what is asking, so the owner approves a client they can see rather
@@ -116,7 +116,7 @@ input,button{font:inherit;width:100%;padding:.5rem;margin:.3rem 0;box-sizing:bor
 <h1>FediPod</h1>
 ${asking}
 ${error ? `<p class="err" id="login-err" role="alert">${escapeHtml(error)}</p>` : ''}
-<form method="POST" action="/oauth/authorize">
+<form method="POST" action="${escapeHtml(mount)}/oauth/authorize">
 ${hidden}
 <label for="password">Agent password</label>
 <input type="password" id="password" name="password" autofocus autocomplete="current-password"
@@ -580,15 +580,15 @@ export async function handle(api, ctx) {
         // ask the person to type it again, which is the one thing that
         // cannot help. Retry-After says how long the wait actually is.
         return sendLoginForm(res, params, 'too many attempts — wait a minute', client,
-          429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) });
+          429, { 'retry-after': String(Math.ceil(AUTHZ_WINDOW_MS / 1000)) }, api.mount || '');
       }
       if (!pw || !checkPassword(pw, body.password || '')) {
-        return sendLoginForm(res, params, 'wrong password — try again', client);
+        return sendLoginForm(res, params, 'wrong password — try again', client, null, {}, api.mount || '');
       }
     } else if (pw && !proved) {
       // The login/approve screen names what is asking before the owner types
       // the password — a cross-site client cannot forge past that.
-      return sendLoginForm(res, params, '', client);
+      return sendLoginForm(res, params, '', client, null, {}, api.mount || '');
     } else if (!proved && api.allowed && !api.allowed.isLocalRequest(req) && !api.throughDoor?.(req)) {
       // With a pod to sign in at, the owner does that instead of a password.
       if (req.method === 'GET' && ownerWebId) return sendPodSigninPage(res, client, ownerWebId, api.mount || '', ownAddress(api));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fedipod",
-  "version": "1.49.1",
+  "version": "1.49.2",
   "description": "Standalone single-actor ActivityPub agent whose wire face, RDF truth and state all live on a Solid pod (CSS). Bundles a Phanpy UI and a Mastodon client-API facade.",
   "type": "module",
   "license": "MIT",