Prevented API request with empty scopemap

2025-06-09 09:37:46 +02:00 · 2024-11-01 13:15:34 +11:00 · 2024-11-01 13:15:34 +11:00 · 8fecd1332a
parent 7a9bb9eac2
commit 8fecd1332a
1 changed files with 5 additions and 0 deletions
--- a/server/core/src/https/v1_oauth2.rs
+++ b/server/core/src/https/v1_oauth2.rs
@ -200,6 +200,11 @@ pub(crate) async fn oauth2_id_scopemap_post(
    Json(scopes): Json<Vec<String>>,
 ) -> Result<Json<()>, WebError> {
    let filter = oauth2_id(&rs_name);
+
+    if scopes.is_empty() {
+        return Err(WebError::OperationError(OperationError::EmptyRequest));
+    }
+
    state
        .qe_w_ref
        .handle_oauth2_scopemap_update(client_auth_info, group, scopes, filter, kopid.eventid)