Uploaded image for project: 'ZABBIX BUGS AND ISSUES'
  1. ZABBIX BUGS AND ISSUES
  2. ZBX-26799

[API] There is a possibility to create OAuth with access_token_updated than is greater than current unix timestamp

XMLWordPrintable

    • Icon: Problem report Problem report
    • Resolution: Unresolved
    • Icon: Trivial Trivial
    • 7.4.2rc1, 8.0.0alpha1 (master)
    • 7.4.2rc1, 8.0.0alpha1 (master)
    • API (A)
    • None
    • S25-W34/35
    • 0.5

      Steps to reproduce:

      • Create media type with OAuth authentication and access_token_updated > current_date e.g.
        {
            "jsonrpc": "2.0",
            "method": "mediatype.create",
            "params": {
                "name": "API E-mail",
                "type": 0,
                "smtp_server": "[email protected]",
                "smtp_email": "[email protected]",
                "smtp_authentication":  2,
                "redirection_url": "https://test/zabbix.php?action=oauth.authorize",
                "client_id": "test",
                "client_secret": "test",
                "authorization_url": "https://test/oauth2/v2/auth?response_type=code&scope=https%3A%2F%2Fmail.google.com%2F&access_type=offline&prompt=consent",
                "token_url": "https://oauth2.googleapis.com/token?grant_type=authorization_code",
                "tokens_status": "3",
                "access_token": "test",
                "access_token_updated": "1854381407",
                "access_expires_in": "3599",
                "refresh_token": "test"
            },
            "id": 1
        }
        }
        

      Result: Missing validation for access_token_updated value.

      Oauth access_token_updated > current unix timestamp.


      Expected: access_token_updated shouldn't be greater than current unix timestamp.

            gcalenko Gregory Chalenko
            kseve Kirils Seve
            Team C
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - Not Specified
                Not Specified
                Logged:
                Time Spent - 1h
                1h