nodebb-plugin-session-sharing 8.0.4 → 8.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/library.js +7 -2
- package/package.json +1 -1
package/library.js
CHANGED
|
@@ -137,7 +137,7 @@ plugin.getUser = async (remoteId) => {
|
|
|
137
137
|
};
|
|
138
138
|
|
|
139
139
|
plugin.process = async (token) => {
|
|
140
|
-
const payload = await jwt.verify(token, plugin.settings.secret);
|
|
140
|
+
const payload = await jwt.verify(token, plugin.settings.secret, { algorithms: ['HS256'] });
|
|
141
141
|
const userData = await plugin.normalizePayload(payload);
|
|
142
142
|
const [uid, isNewUser] = await plugin.findOrCreateUser(userData);
|
|
143
143
|
await plugin.updateUserProfile(uid, userData, isNewUser);
|
|
@@ -386,10 +386,15 @@ plugin.addMiddleware = async function ({ req, res }) {
|
|
|
386
386
|
const { hostWhitelist, guestRedirect, editOverride, loginOverride, registerOverride } = await meta.settings.get('session-sharing');
|
|
387
387
|
|
|
388
388
|
if (hostWhitelist) {
|
|
389
|
+
const hostHeader = req.headers.host;
|
|
390
|
+
if (!hostHeader) {
|
|
391
|
+
return;
|
|
392
|
+
}
|
|
393
|
+
|
|
389
394
|
const hosts = hostWhitelist.split(',') || [hostWhitelist];
|
|
390
395
|
let whitelisted = false;
|
|
391
396
|
for (const host of hosts) {
|
|
392
|
-
if (
|
|
397
|
+
if (hostHeader.includes(host)) {
|
|
393
398
|
whitelisted = true;
|
|
394
399
|
break;
|
|
395
400
|
}
|