[UX] Revoke Access Dialog not displayed on the current viewport #1036
Comments
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/167072035 The labels on this github issue will be updated when the story is started. |
|
Is there any update on this? It's been open for some time now and it is not fixed yet (currently running uaa-release 74.1.0). And it seems like the story is gone or I cannot access it on the Pivotal Tracker. |
strehle
pushed a commit
that referenced
this issue
Jul 15, 2021
strehle
added a commit
that referenced
this issue
Jul 26, 2021
…direct_uri_path_traversal # By Joshua Casey (417) and others # Via GitHub (170) and others * 'develop' of github.com:cloudfoundry/uaa: (1592 commits) Bump passay version 1.6.1 (#1612) Bump Spring Dependencies (#1611) Bump k8s.io/client-go from 0.21.2 to 0.21.3 in /k8s (#1609) Bump k8s.io/apimachinery from 0.21.2 to 0.21.3 in /k8s (#1608) Add workaround for revoke access dialog from issue #1036 (#1254) Bump spring oauth2 version to 2.5.1.RELEASE (#1601) Bump addressable from 2.5.0 to 2.8.0 in /uaa/slate (#1603) Add property option for mail.smtp.ssl.protocols (#1605) Add property option for mail.smtp.ssl.protocols (#1604) Fix CF-UAA version number Bump maven dependencies (#1600) Bump Tomcat dependency Bump github.com/onsi/gomega from 1.13.0 to 1.14.0 in /k8s (#1599) cleanup code from sonar findings and add additional tests cleanup code from sonar findings and add additional tests More test parameters for UaaUrlUtils.findMatchingRedirectUri() tests fix: Open Redirect Security Issue via some UAA endpoints, including logout.do BigInteger encoding fixed (#1579) Set startStopTimeout to be configurable (#1594) switch to StaleUrlCache ... # Conflicts: # dependencies.gradle # model/build.gradle # server/build.gradle # server/src/main/java/org/cloudfoundry/identity/uaa/oauth/beans/LegacyRedirectResolver.java # uaa/build.gradle
akarollil
added a commit
to GESoftware-CF/uaa
that referenced
this issue
Aug 5, 2021
* tag 'v75.6.0': Update UAA image reference in k8s deployment template to 75.6.0 Bump k8s.io/client-go from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1639) Bump k8s.io/api from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1638) fix generateDocs PKCE support in IDP (OIDC) proxy authorization flow (cloudfoundry#1606) fix: upgrade org.springframework.security.oauth:spring-security-oauth2 from 2.4.0.RELEASE to 2.5.1.RELEASE (cloudfoundry#1632) fix: upgrade org.passay:passay from 1.2.0 to 1.6.0 (cloudfoundry#1633) Do not expire invitations on GET requests (cloudfoundry#1128) revert back revert to last working fix bundle install update (cloudfoundry#1627) update kramdown 2.3.1 (cloudfoundry#1626) Fix bug with origin chooser and selected allowed provider configuration update activesupport 5.2.4.3 (cloudfoundry#1625) update jquery (cloudfoundry#1618) Update Font-Awesome (cloudfoundry#1617) Bump commons-io from 2.10.0 to 2.11.0 (cloudfoundry#1616) rebase rebase merge develop Bump passay version 1.6.1 (cloudfoundry#1612) Bump Spring Dependencies (cloudfoundry#1611) Bump k8s.io/client-go from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1609) Bump k8s.io/apimachinery from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1608) Add workaround for revoke access dialog from issue cloudfoundry#1036 (cloudfoundry#1254) Bump spring oauth2 version to 2.5.1.RELEASE (cloudfoundry#1601) Bump addressable from 2.5.0 to 2.8.0 in /uaa/slate (cloudfoundry#1603) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1605) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1604) Fix CF-UAA version number Bump maven dependencies (cloudfoundry#1600) Bump Tomcat dependency Bump github.com/onsi/gomega from 1.13.0 to 1.14.0 in /k8s (cloudfoundry#1599) cleanup code from sonar findings and add additional tests cleanup code from sonar findings and add additional tests More test parameters for UaaUrlUtils.findMatchingRedirectUri() tests fix: Open Redirect Security Issue via some UAA endpoints, including logout.do BigInteger encoding fixed (cloudfoundry#1579) Set startStopTimeout to be configurable (cloudfoundry#1594) switch to StaleUrlCache origin sync Bump jasmine-core from 3.7.1 to 3.8.0 in /uaa (cloudfoundry#1598) Bump jasmine from 3.7.0 to 3.8.0 in /uaa (cloudfoundry#1597) Bump dependency (cloudfoundry#1596) Performance optimation: Prevent expensive duplicate key exception and use upsert instead (cloudfoundry#1562) Refactor: query minimal user information everywhere authorities not needed (cloudfoundry#1322) Allow to use Account Chooser without Idp Discovery (cloudfoundry#1550) Bump k8s.io/client-go from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1586) Bump commons-io from 2.7 to 2.10.0 (cloudfoundry#1582) Update dependencies.gradle update Create dependencies.gradle cleanup PR - remove orphan class - use new class in all tests - dependency cosmetics Bump k8s.io/api from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1585) Bump github.com/onsi/gomega from 1.11.0 to 1.13.0 in /k8s (cloudfoundry#1573) Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.4 in /k8s (cloudfoundry#1575) Bump k8s.io/apimachinery from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1587) Github userUserInfo from local configuration (cloudfoundry#1595) Add '-Xdebug' jvm args to application container run in cargo if '-Dxdebug=true' option is sepcified for 'gradle run'. (cloudfoundry#1592) Bump Guava Dependencies (cloudfoundry#1581) Document the 'userInfoUrl' property for OAuth identity provider config Bump Spring Dependencies (cloudfoundry#1591) Fix issue 1584 Test that we redirect when client allows only SAML Backfill test cases for using refresh token value that was created with refresh_token_validity seconds specified [#178076368] Bump Spring Dependencies (cloudfoundry#1580) fix: test token audience claim in an unordered way Bump Spring Dependencies (cloudfoundry#1577) Bump bouncyCastleVersion from 1.68 to 1.69 Small improvements for the consent form (cloudfoundry#1561) Use Claims class to desrialize the token string. feat: output message when DB cannot be initialized refactor: extract variable formatting: whitespaces do not sleep more than 1 minute fix: test runner flakes fix: authTime can be later than 2037 Bump nokogiri from 1.11.0 to 1.11.4 in /uaa/slate Backfilled unit test Make Java 11 our minimum Additional test cases to verify that ldap bindSecret is not included in the response for the CVE issue where the delete-identity-provider response contained sensitive data #178139149 (cloudfoundry#1572) Adjust unit test to new constructor signature, after rebasing on top of the 'develop' branch Share common 'userInfoUrl' property between OIDC and OAuth2 config + Use it to fetch OAuth2 user info Various code/spaces improvements Implement support for Github OAuth 2.0 provider feat: error log on internal error feat: validate java version Fixed the CVE issue where the delete-identity-provider response contains relyingPartySecret value #178139149 Fix comment Include passcode prompt in json response if discovery or account chooser are enabled Bump bcprov-jdk15on from 1.66 to 1.67 in /server (cloudfoundry#1564) Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:4c7f2d881bc9c4a075232064e906d032c9512b03b87c06cbb2501560cb2f14e4 Return existing records on update failure Restore explicit imports. login_hint should not automatically bypass discovery logic Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/api (cloudfoundry#1544) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/app (cloudfoundry#1546) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /server (cloudfoundry#1545) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /statsd (cloudfoundry#1547) Bump jasmine-core from 3.6.0 to 3.7.1 in /uaa Bump jasmine from 3.6.4 to 3.7.0 in /uaa Bump k8s.io/client-go from 0.20.5 to 0.21.0 in /k8s Bump k8s.io/apimachinery from 0.20.5 to 0.21.0 in /k8s Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.1 in /k8s Bump Spring Dependencies (cloudfoundry#1559) refactor: extract shared code into helper methods Rename variable and test case for clarity Invert boolean method to have a more intuitive naming Add additional tests Only update user if token not issued by UAA Fix wrong username mapping on jwt Bearer with UAA token Bump tomcat-embed-core from 9.0.37 to 9.0.44 in /uaa (cloudfoundry#1548) Bump k8s.io/client-go from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1541) Bump github.com/onsi/ginkgo from 1.14.2 to 1.15.2 in /k8s (cloudfoundry#1535) Bump k8s.io/api from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1542) refactor: rename Bump github.com/onsi/gomega from 1.10.4 to 1.11.0 in /k8s (cloudfoundry#1532) Dependeny Updagtes (cloudfoundry#1538) refactor: implement recommendation from thymeleaf (cloudfoundry#1512) Fix typo feat: for unit tests, add time out to waiting for DB to start Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:7fd48f08134e279a4fe2b8a200ecfdca8cda847175df38f1293e9818d7dd53cc Bump dependency Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:c1d54700f1e6b8fabe49917a8e4ca59f381a11c69982439525f9af8a08f29e0c Add MockMvc Test to show performance improvement Fix bug with invalid login_hint on login page Move read configurations and parameters to allow earlier decisions Restructure login method to not read all IdentityProviders on login_hint Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:37fcf63a156b75174fbc7be0e3809d64cda6851de0bfe6fa7f12793d919de96a Added "final" modifier for method-local constant better name for matches function capitilize first letter of log sentence meaningful name for number of url-decode attempts javadoc explaining integrity bypass fix fix double dot path traversal integrity check bypass redirect resolver tests should cover path traversal bypass for both registered paths containing wildcards and those that do not unit tests for redirect_uri path integrity check bypass add lombok dependency Add PKCE support
akarollil
added a commit
to GESoftware-CF/uaa
that referenced
this issue
Aug 5, 2021
* tag 'v75.6.0': Update UAA image reference in k8s deployment template to 75.6.0 Bump k8s.io/client-go from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1639) Bump k8s.io/api from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1638) fix generateDocs PKCE support in IDP (OIDC) proxy authorization flow (cloudfoundry#1606) fix: upgrade org.springframework.security.oauth:spring-security-oauth2 from 2.4.0.RELEASE to 2.5.1.RELEASE (cloudfoundry#1632) fix: upgrade org.passay:passay from 1.2.0 to 1.6.0 (cloudfoundry#1633) Do not expire invitations on GET requests (cloudfoundry#1128) revert back revert to last working fix bundle install update (cloudfoundry#1627) update kramdown 2.3.1 (cloudfoundry#1626) Fix bug with origin chooser and selected allowed provider configuration update activesupport 5.2.4.3 (cloudfoundry#1625) update jquery (cloudfoundry#1618) Update Font-Awesome (cloudfoundry#1617) Bump commons-io from 2.10.0 to 2.11.0 (cloudfoundry#1616) rebase rebase merge develop Bump passay version 1.6.1 (cloudfoundry#1612) Bump Spring Dependencies (cloudfoundry#1611) Bump k8s.io/client-go from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1609) Bump k8s.io/apimachinery from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1608) Add workaround for revoke access dialog from issue cloudfoundry#1036 (cloudfoundry#1254) Bump spring oauth2 version to 2.5.1.RELEASE (cloudfoundry#1601) Bump addressable from 2.5.0 to 2.8.0 in /uaa/slate (cloudfoundry#1603) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1605) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1604) Fix CF-UAA version number Bump maven dependencies (cloudfoundry#1600) Bump Tomcat dependency Bump github.com/onsi/gomega from 1.13.0 to 1.14.0 in /k8s (cloudfoundry#1599) cleanup code from sonar findings and add additional tests cleanup code from sonar findings and add additional tests More test parameters for UaaUrlUtils.findMatchingRedirectUri() tests fix: Open Redirect Security Issue via some UAA endpoints, including logout.do BigInteger encoding fixed (cloudfoundry#1579) Set startStopTimeout to be configurable (cloudfoundry#1594) switch to StaleUrlCache origin sync Bump jasmine-core from 3.7.1 to 3.8.0 in /uaa (cloudfoundry#1598) Bump jasmine from 3.7.0 to 3.8.0 in /uaa (cloudfoundry#1597) Bump dependency (cloudfoundry#1596) Performance optimation: Prevent expensive duplicate key exception and use upsert instead (cloudfoundry#1562) Refactor: query minimal user information everywhere authorities not needed (cloudfoundry#1322) Allow to use Account Chooser without Idp Discovery (cloudfoundry#1550) Bump k8s.io/client-go from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1586) Bump commons-io from 2.7 to 2.10.0 (cloudfoundry#1582) Update dependencies.gradle update Create dependencies.gradle cleanup PR - remove orphan class - use new class in all tests - dependency cosmetics Bump k8s.io/api from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1585) Bump github.com/onsi/gomega from 1.11.0 to 1.13.0 in /k8s (cloudfoundry#1573) Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.4 in /k8s (cloudfoundry#1575) Bump k8s.io/apimachinery from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1587) Github userUserInfo from local configuration (cloudfoundry#1595) Add '-Xdebug' jvm args to application container run in cargo if '-Dxdebug=true' option is sepcified for 'gradle run'. (cloudfoundry#1592) Bump Guava Dependencies (cloudfoundry#1581) Document the 'userInfoUrl' property for OAuth identity provider config Bump Spring Dependencies (cloudfoundry#1591) Fix issue 1584 Test that we redirect when client allows only SAML Backfill test cases for using refresh token value that was created with refresh_token_validity seconds specified [#178076368] Bump Spring Dependencies (cloudfoundry#1580) fix: test token audience claim in an unordered way Bump Spring Dependencies (cloudfoundry#1577) Bump bouncyCastleVersion from 1.68 to 1.69 Small improvements for the consent form (cloudfoundry#1561) Use Claims class to desrialize the token string. feat: output message when DB cannot be initialized refactor: extract variable formatting: whitespaces do not sleep more than 1 minute fix: test runner flakes fix: authTime can be later than 2037 Bump nokogiri from 1.11.0 to 1.11.4 in /uaa/slate Backfilled unit test Make Java 11 our minimum Additional test cases to verify that ldap bindSecret is not included in the response for the CVE issue where the delete-identity-provider response contained sensitive data #178139149 (cloudfoundry#1572) Adjust unit test to new constructor signature, after rebasing on top of the 'develop' branch Share common 'userInfoUrl' property between OIDC and OAuth2 config + Use it to fetch OAuth2 user info Various code/spaces improvements Implement support for Github OAuth 2.0 provider feat: error log on internal error feat: validate java version Fixed the CVE issue where the delete-identity-provider response contains relyingPartySecret value #178139149 Fix comment Include passcode prompt in json response if discovery or account chooser are enabled Bump bcprov-jdk15on from 1.66 to 1.67 in /server (cloudfoundry#1564) Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:4c7f2d881bc9c4a075232064e906d032c9512b03b87c06cbb2501560cb2f14e4 Return existing records on update failure Restore explicit imports. login_hint should not automatically bypass discovery logic Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/api (cloudfoundry#1544) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/app (cloudfoundry#1546) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /server (cloudfoundry#1545) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /statsd (cloudfoundry#1547) Bump jasmine-core from 3.6.0 to 3.7.1 in /uaa Bump jasmine from 3.6.4 to 3.7.0 in /uaa Bump k8s.io/client-go from 0.20.5 to 0.21.0 in /k8s Bump k8s.io/apimachinery from 0.20.5 to 0.21.0 in /k8s Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.1 in /k8s Bump Spring Dependencies (cloudfoundry#1559) refactor: extract shared code into helper methods Rename variable and test case for clarity Invert boolean method to have a more intuitive naming Add additional tests Only update user if token not issued by UAA Fix wrong username mapping on jwt Bearer with UAA token Bump tomcat-embed-core from 9.0.37 to 9.0.44 in /uaa (cloudfoundry#1548) Bump k8s.io/client-go from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1541) Bump github.com/onsi/ginkgo from 1.14.2 to 1.15.2 in /k8s (cloudfoundry#1535) Bump k8s.io/api from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1542) refactor: rename Bump github.com/onsi/gomega from 1.10.4 to 1.11.0 in /k8s (cloudfoundry#1532) Dependeny Updagtes (cloudfoundry#1538) refactor: implement recommendation from thymeleaf (cloudfoundry#1512) Fix typo feat: for unit tests, add time out to waiting for DB to start Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:7fd48f08134e279a4fe2b8a200ecfdca8cda847175df38f1293e9818d7dd53cc Bump dependency Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:c1d54700f1e6b8fabe49917a8e4ca59f381a11c69982439525f9af8a08f29e0c Add MockMvc Test to show performance improvement Fix bug with invalid login_hint on login page Move read configurations and parameters to allow earlier decisions Restructure login method to not read all IdentityProviders on login_hint Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:37fcf63a156b75174fbc7be0e3809d64cda6851de0bfe6fa7f12793d919de96a Added "final" modifier for method-local constant better name for matches function capitilize first letter of log sentence meaningful name for number of url-decode attempts javadoc explaining integrity bypass fix fix double dot path traversal integrity check bypass redirect resolver tests should cover path traversal bypass for both registered paths containing wildcards and those that do not unit tests for redirect_uri path integrity check bypass add lombok dependency Add PKCE support
akarollil
added a commit
to GESoftware-CF/uaa
that referenced
this issue
Aug 11, 2021
Conflicts resolved in a gradle build and dependency files, a bunch of template files, and a couple of tests: UU dependencies.gradle UU k8s/templates/values/image.yml UU server/build.gradle UU server/src/main/java/org/cloudfoundry/identity/uaa/login/LoginInfoEndpoint.java UU server/src/main/resources/templates/web/accounts/email_sent.html UU server/src/main/resources/templates/web/accounts/new_activation_email.html UU server/src/main/resources/templates/web/home.html UU server/src/main/resources/templates/web/idp_discovery/account_chooser.html UU server/src/main/resources/templates/web/idp_discovery/password.html UU server/src/test/java/org/cloudfoundry/identity/uaa/oauth/beans/LegacyRedirectResolverTest.java UU uaa/src/test/java/org/cloudfoundry/identity/uaa/login/LoginMockMvcTests.java * master: Update UAA image reference in k8s deployment template to 75.6.0 Bump k8s.io/client-go from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1639) Bump k8s.io/api from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1638) fix generateDocs PKCE support in IDP (OIDC) proxy authorization flow (cloudfoundry#1606) fix: upgrade org.springframework.security.oauth:spring-security-oauth2 from 2.4.0.RELEASE to 2.5.1.RELEASE (cloudfoundry#1632) fix: upgrade org.passay:passay from 1.2.0 to 1.6.0 (cloudfoundry#1633) Do not expire invitations on GET requests (cloudfoundry#1128) revert back revert to last working fix bundle install update (cloudfoundry#1627) update kramdown 2.3.1 (cloudfoundry#1626) Fix bug with origin chooser and selected allowed provider configuration update activesupport 5.2.4.3 (cloudfoundry#1625) update jquery (cloudfoundry#1618) Update Font-Awesome (cloudfoundry#1617) Bump commons-io from 2.10.0 to 2.11.0 (cloudfoundry#1616) rebase rebase merge develop Bump passay version 1.6.1 (cloudfoundry#1612) Bump Spring Dependencies (cloudfoundry#1611) Bump k8s.io/client-go from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1609) Bump k8s.io/apimachinery from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1608) Add workaround for revoke access dialog from issue cloudfoundry#1036 (cloudfoundry#1254) Bump spring oauth2 version to 2.5.1.RELEASE (cloudfoundry#1601) Bump addressable from 2.5.0 to 2.8.0 in /uaa/slate (cloudfoundry#1603) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1605) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1604) Fix CF-UAA version number Bump maven dependencies (cloudfoundry#1600) Bump Tomcat dependency Bump github.com/onsi/gomega from 1.13.0 to 1.14.0 in /k8s (cloudfoundry#1599) cleanup code from sonar findings and add additional tests cleanup code from sonar findings and add additional tests More test parameters for UaaUrlUtils.findMatchingRedirectUri() tests fix: Open Redirect Security Issue via some UAA endpoints, including logout.do BigInteger encoding fixed (cloudfoundry#1579) Set startStopTimeout to be configurable (cloudfoundry#1594) switch to StaleUrlCache origin sync Bump jasmine-core from 3.7.1 to 3.8.0 in /uaa (cloudfoundry#1598) Bump jasmine from 3.7.0 to 3.8.0 in /uaa (cloudfoundry#1597) Bump dependency (cloudfoundry#1596) Performance optimation: Prevent expensive duplicate key exception and use upsert instead (cloudfoundry#1562) Refactor: query minimal user information everywhere authorities not needed (cloudfoundry#1322) Allow to use Account Chooser without Idp Discovery (cloudfoundry#1550) Bump k8s.io/client-go from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1586) Bump commons-io from 2.7 to 2.10.0 (cloudfoundry#1582) Update dependencies.gradle update Create dependencies.gradle cleanup PR - remove orphan class - use new class in all tests - dependency cosmetics Bump k8s.io/api from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1585) Bump github.com/onsi/gomega from 1.11.0 to 1.13.0 in /k8s (cloudfoundry#1573) Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.4 in /k8s (cloudfoundry#1575) Bump k8s.io/apimachinery from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1587) Github userUserInfo from local configuration (cloudfoundry#1595) Add '-Xdebug' jvm args to application container run in cargo if '-Dxdebug=true' option is sepcified for 'gradle run'. (cloudfoundry#1592) Bump Guava Dependencies (cloudfoundry#1581) Document the 'userInfoUrl' property for OAuth identity provider config Bump Spring Dependencies (cloudfoundry#1591) Fix issue 1584 Test that we redirect when client allows only SAML Backfill test cases for using refresh token value that was created with refresh_token_validity seconds specified [#178076368] Bump Spring Dependencies (cloudfoundry#1580) fix: test token audience claim in an unordered way Bump Spring Dependencies (cloudfoundry#1577) Bump bouncyCastleVersion from 1.68 to 1.69 Small improvements for the consent form (cloudfoundry#1561) Use Claims class to desrialize the token string. feat: output message when DB cannot be initialized refactor: extract variable formatting: whitespaces do not sleep more than 1 minute fix: test runner flakes fix: authTime can be later than 2037 Bump nokogiri from 1.11.0 to 1.11.4 in /uaa/slate Backfilled unit test Make Java 11 our minimum Additional test cases to verify that ldap bindSecret is not included in the response for the CVE issue where the delete-identity-provider response contained sensitive data #178139149 (cloudfoundry#1572) Adjust unit test to new constructor signature, after rebasing on top of the 'develop' branch Share common 'userInfoUrl' property between OIDC and OAuth2 config + Use it to fetch OAuth2 user info Various code/spaces improvements Implement support for Github OAuth 2.0 provider feat: error log on internal error feat: validate java version Fixed the CVE issue where the delete-identity-provider response contains relyingPartySecret value #178139149 Fix comment Include passcode prompt in json response if discovery or account chooser are enabled Bump bcprov-jdk15on from 1.66 to 1.67 in /server (cloudfoundry#1564) Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:4c7f2d881bc9c4a075232064e906d032c9512b03b87c06cbb2501560cb2f14e4 Return existing records on update failure Restore explicit imports. login_hint should not automatically bypass discovery logic Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/api (cloudfoundry#1544) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/app (cloudfoundry#1546) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /server (cloudfoundry#1545) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /statsd (cloudfoundry#1547) Bump jasmine-core from 3.6.0 to 3.7.1 in /uaa Bump jasmine from 3.6.4 to 3.7.0 in /uaa Bump k8s.io/client-go from 0.20.5 to 0.21.0 in /k8s Bump k8s.io/apimachinery from 0.20.5 to 0.21.0 in /k8s Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.1 in /k8s Bump Spring Dependencies (cloudfoundry#1559) refactor: extract shared code into helper methods Rename variable and test case for clarity Invert boolean method to have a more intuitive naming Add additional tests Only update user if token not issued by UAA Fix wrong username mapping on jwt Bearer with UAA token Bump tomcat-embed-core from 9.0.37 to 9.0.44 in /uaa (cloudfoundry#1548) Bump k8s.io/client-go from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1541) Bump github.com/onsi/ginkgo from 1.14.2 to 1.15.2 in /k8s (cloudfoundry#1535) Bump k8s.io/api from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1542) refactor: rename Bump github.com/onsi/gomega from 1.10.4 to 1.11.0 in /k8s (cloudfoundry#1532) Dependeny Updagtes (cloudfoundry#1538) refactor: implement recommendation from thymeleaf (cloudfoundry#1512) Fix typo feat: for unit tests, add time out to waiting for DB to start Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:7fd48f08134e279a4fe2b8a200ecfdca8cda847175df38f1293e9818d7dd53cc Bump dependency Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:c1d54700f1e6b8fabe49917a8e4ca59f381a11c69982439525f9af8a08f29e0c Add MockMvc Test to show performance improvement Fix bug with invalid login_hint on login page Move read configurations and parameters to allow earlier decisions Restructure login method to not read all IdentityProviders on login_hint Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:37fcf63a156b75174fbc7be0e3809d64cda6851de0bfe6fa7f12793d919de96a Added "final" modifier for method-local constant better name for matches function capitilize first letter of log sentence meaningful name for number of url-decode attempts javadoc explaining integrity bypass fix fix double dot path traversal integrity check bypass redirect resolver tests should cover path traversal bypass for both registered paths containing wildcards and those that do not unit tests for redirect_uri path integrity check bypass add lombok dependency Add PKCE support
akarollil
added a commit
to GESoftware-CF/uaa
that referenced
this issue
Aug 12, 2021
Merge conflicts fixed in the following: UU uaa/src/main/webapp/WEB-INF/spring/oauth-endpoints.xml UU uaa/src/test/java/org/cloudfoundry/identity/uaa/mock/token/JwtBearerGrantMockMvcTests.java * master: Update UAA image reference in k8s deployment template to 75.6.0 Bump k8s.io/client-go from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1639) Bump k8s.io/api from 0.21.3 to 0.22.0 in /k8s (cloudfoundry#1638) fix generateDocs PKCE support in IDP (OIDC) proxy authorization flow (cloudfoundry#1606) fix: upgrade org.springframework.security.oauth:spring-security-oauth2 from 2.4.0.RELEASE to 2.5.1.RELEASE (cloudfoundry#1632) fix: upgrade org.passay:passay from 1.2.0 to 1.6.0 (cloudfoundry#1633) Do not expire invitations on GET requests (cloudfoundry#1128) revert back revert to last working fix bundle install update (cloudfoundry#1627) update kramdown 2.3.1 (cloudfoundry#1626) Fix bug with origin chooser and selected allowed provider configuration update activesupport 5.2.4.3 (cloudfoundry#1625) update jquery (cloudfoundry#1618) Update Font-Awesome (cloudfoundry#1617) Bump commons-io from 2.10.0 to 2.11.0 (cloudfoundry#1616) rebase rebase merge develop Bump passay version 1.6.1 (cloudfoundry#1612) Bump Spring Dependencies (cloudfoundry#1611) Bump k8s.io/client-go from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1609) Bump k8s.io/apimachinery from 0.21.2 to 0.21.3 in /k8s (cloudfoundry#1608) Add workaround for revoke access dialog from issue cloudfoundry#1036 (cloudfoundry#1254) Bump spring oauth2 version to 2.5.1.RELEASE (cloudfoundry#1601) Bump addressable from 2.5.0 to 2.8.0 in /uaa/slate (cloudfoundry#1603) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1605) Add property option for mail.smtp.ssl.protocols (cloudfoundry#1604) Fix CF-UAA version number Bump maven dependencies (cloudfoundry#1600) Bump Tomcat dependency Bump github.com/onsi/gomega from 1.13.0 to 1.14.0 in /k8s (cloudfoundry#1599) cleanup code from sonar findings and add additional tests cleanup code from sonar findings and add additional tests More test parameters for UaaUrlUtils.findMatchingRedirectUri() tests fix: Open Redirect Security Issue via some UAA endpoints, including logout.do BigInteger encoding fixed (cloudfoundry#1579) Set startStopTimeout to be configurable (cloudfoundry#1594) switch to StaleUrlCache origin sync Bump jasmine-core from 3.7.1 to 3.8.0 in /uaa (cloudfoundry#1598) Bump jasmine from 3.7.0 to 3.8.0 in /uaa (cloudfoundry#1597) Bump dependency (cloudfoundry#1596) Performance optimation: Prevent expensive duplicate key exception and use upsert instead (cloudfoundry#1562) Refactor: query minimal user information everywhere authorities not needed (cloudfoundry#1322) Allow to use Account Chooser without Idp Discovery (cloudfoundry#1550) Bump k8s.io/client-go from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1586) Bump commons-io from 2.7 to 2.10.0 (cloudfoundry#1582) Update dependencies.gradle update Create dependencies.gradle cleanup PR - remove orphan class - use new class in all tests - dependency cosmetics Bump k8s.io/api from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1585) Bump github.com/onsi/gomega from 1.11.0 to 1.13.0 in /k8s (cloudfoundry#1573) Bump github.com/onsi/ginkgo from 1.16.1 to 1.16.4 in /k8s (cloudfoundry#1575) Bump k8s.io/apimachinery from 0.21.0 to 0.21.2 in /k8s (cloudfoundry#1587) Github userUserInfo from local configuration (cloudfoundry#1595) Add '-Xdebug' jvm args to application container run in cargo if '-Dxdebug=true' option is sepcified for 'gradle run'. (cloudfoundry#1592) Bump Guava Dependencies (cloudfoundry#1581) Document the 'userInfoUrl' property for OAuth identity provider config Bump Spring Dependencies (cloudfoundry#1591) Fix issue 1584 Test that we redirect when client allows only SAML Backfill test cases for using refresh token value that was created with refresh_token_validity seconds specified [#178076368] Bump Spring Dependencies (cloudfoundry#1580) fix: test token audience claim in an unordered way Bump Spring Dependencies (cloudfoundry#1577) Bump bouncyCastleVersion from 1.68 to 1.69 Small improvements for the consent form (cloudfoundry#1561) Use Claims class to desrialize the token string. feat: output message when DB cannot be initialized refactor: extract variable formatting: whitespaces do not sleep more than 1 minute fix: test runner flakes fix: authTime can be later than 2037 Bump nokogiri from 1.11.0 to 1.11.4 in /uaa/slate Backfilled unit test Make Java 11 our minimum Additional test cases to verify that ldap bindSecret is not included in the response for the CVE issue where the delete-identity-provider response contained sensitive data #178139149 (cloudfoundry#1572) Adjust unit test to new constructor signature, after rebasing on top of the 'develop' branch Share common 'userInfoUrl' property between OIDC and OAuth2 config + Use it to fetch OAuth2 user info Various code/spaces improvements Implement support for Github OAuth 2.0 provider feat: error log on internal error feat: validate java version Fixed the CVE issue where the delete-identity-provider response contains relyingPartySecret value #178139149 Fix comment Include passcode prompt in json response if discovery or account chooser are enabled Bump bcprov-jdk15on from 1.66 to 1.67 in /server (cloudfoundry#1564) Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:4c7f2d881bc9c4a075232064e906d032c9512b03b87c06cbb2501560cb2f14e4 Return existing records on update failure Restore explicit imports. login_hint should not automatically bypass discovery logic Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/api (cloudfoundry#1544) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /samples/app (cloudfoundry#1546) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /server (cloudfoundry#1545) Bump tomcat-embed-core from 9.0.37 to 9.0.45 in /statsd (cloudfoundry#1547) Bump jasmine-core from 3.6.0 to 3.7.1 in /uaa Bump jasmine from 3.6.4 to 3.7.0 in /uaa Bump k8s.io/client-go from 0.20.5 to 0.21.0 in /k8s Bump k8s.io/apimachinery from 0.20.5 to 0.21.0 in /k8s Bump github.com/onsi/ginkgo from 1.15.2 to 1.16.1 in /k8s Bump Spring Dependencies (cloudfoundry#1559) refactor: extract shared code into helper methods Rename variable and test case for clarity Invert boolean method to have a more intuitive naming Add additional tests Only update user if token not issued by UAA Fix wrong username mapping on jwt Bearer with UAA token Bump tomcat-embed-core from 9.0.37 to 9.0.44 in /uaa (cloudfoundry#1548) Bump k8s.io/client-go from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1541) Bump github.com/onsi/ginkgo from 1.14.2 to 1.15.2 in /k8s (cloudfoundry#1535) Bump k8s.io/api from 0.20.2 to 0.20.5 in /k8s (cloudfoundry#1542) refactor: rename Bump github.com/onsi/gomega from 1.10.4 to 1.11.0 in /k8s (cloudfoundry#1532) Dependeny Updagtes (cloudfoundry#1538) refactor: implement recommendation from thymeleaf (cloudfoundry#1512) Fix typo feat: for unit tests, add time out to waiting for DB to start Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:7fd48f08134e279a4fe2b8a200ecfdca8cda847175df38f1293e9818d7dd53cc Bump dependency Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:c1d54700f1e6b8fabe49917a8e4ca59f381a11c69982439525f9af8a08f29e0c Add MockMvc Test to show performance improvement Fix bug with invalid login_hint on login page Move read configurations and parameters to allow earlier decisions Restructure login method to not read all IdentityProviders on login_hint Update UAA image reference in k8s deployment template to cloudfoundry/uaa@sha256:37fcf63a156b75174fbc7be0e3809d64cda6851de0bfe6fa7f12793d919de96a Added "final" modifier for method-local constant better name for matches function capitilize first letter of log sentence meaningful name for number of url-decode attempts javadoc explaining integrity bypass fix fix double dot path traversal integrity check bypass redirect resolver tests should cover path traversal bypass for both registered paths containing wildcards and those that do not unit tests for redirect_uri path integrity check bypass add lombok dependency Add PKCE support
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
What version of UAA are you running?
"version":"4.31.0-SNAPSHOT"
How are you deploying the UAA?
I am deploying the UAA
What did you do?
What did you expect to see? What goal are you trying to achieve with the UAA?
The "Revoke Access" dialog should appear in the center of or at least visibly on the screen.
What did you see instead?
The dialog did not appear where expected but one has to scroll all the way up again to see a grayed area appear with the dialog in the middle.
I'm not an expert on this field but this is a UX issue and probably located in this line:
uaa/uaa/src/main/webapp/resources/oss/stylesheets/application.css
Line 8875 in 6b026ce
When changing the
positiontofixedin the browser, the dialog works more as expected (not 100% centered depending on viewport size but at least always visible).The text was updated successfully, but these errors were encountered: