chore: Update version

README.md

@@ -1,7 +1,7 @@
 # Planka
 #### Elegant open source project tracking.
 
-![David (path)](https://img.shields.io/github/package-json/v/plankanban/planka) ![Docker Pulls](https://img.shields.io/docker/pulls/meltyshev/planka) ![GitHub](https://img.shields.io/github/license/plankanban/planka)
+![David (path)](https://img.shields.io/github/package-json/v/plankanban/planka) ![Docker Pulls](https://img.shields.io/badge/docker_pulls-4M%2B-%23066da5) ![GitHub](https://img.shields.io/github/license/plankanban/planka)
 
 ![](https://raw.githubusercontent.com/plankanban/planka/master/demo.gif)
 

charts/planka/Chart.yaml

@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.2.3
+version: 0.2.4
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "1.19.2"
+appVersion: "1.20.0"
 
 dependencies:
   - alias: postgresql

client/.env

@@ -1 +1 @@
-REACT_APP_VERSION=1.19.2
+REACT_APP_VERSION=1.20.0

docker-compose-dev.yml

@@ -29,7 +29,11 @@ services:
       # - OIDC_ISSUER=
       # - OIDC_CLIENT_ID=
       # - OIDC_CLIENT_SECRET=
+      # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
+      # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile
+      # - OIDC_RESPONSE_MODE=fragment
+      # - OIDC_USE_DEFAULT_RESPONSE_MODE=true
       # - OIDC_ADMIN_ROLES=admin
       # - OIDC_EMAIL_ATTRIBUTE=email
       # - OIDC_NAME_ATTRIBUTE=name

docker-compose.yml

@@ -36,7 +36,11 @@ services:
       # - OIDC_ISSUER=
       # - OIDC_CLIENT_ID=
       # - OIDC_CLIENT_SECRET=
+      # - OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
+      # - OIDC_USERINFO_SIGNED_RESPONSE_ALG=
       # - OIDC_SCOPES=openid email profile
+      # - OIDC_RESPONSE_MODE=fragment
+      # - OIDC_USE_DEFAULT_RESPONSE_MODE=true
       # - OIDC_ADMIN_ROLES=admin
       # - OIDC_EMAIL_ATTRIBUTE=email
       # - OIDC_NAME_ATTRIBUTE=name

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "planka",
-  "version": "1.19.2",
+  "version": "1.20.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "planka",
-      "version": "1.19.2",
+      "version": "1.20.0",
       "hasInstallScript": true,
       "license": "AGPL-3.0",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "planka",
-  "version": "1.19.2",
+  "version": "1.20.0",
   "private": true,
   "homepage": "https://plankanban.github.io/planka",
   "repository": {

server/.env.sample

@@ -27,7 +27,11 @@ SECRET_KEY=notsecretkey
 # OIDC_ISSUER=
 # OIDC_CLIENT_ID=
 # OIDC_CLIENT_SECRET=
+# OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG=
+# OIDC_USERINFO_SIGNED_RESPONSE_ALG=
 # OIDC_SCOPES=openid email profile
+# OIDC_RESPONSE_MODE=fragment
+# OIDC_USE_DEFAULT_RESPONSE_MODE=true
 # OIDC_ADMIN_ROLES=admin
 # OIDC_EMAIL_ATTRIBUTE=email
 # OIDC_NAME_ATTRIBUTE=name

server/api/controllers/access-tokens/exchange-using-oidc.js

@@ -4,6 +4,9 @@ const Errors = {
   INVALID_CODE_OR_NONCE: {
     invalidCodeOrNonce: 'Invalid code or nonce',
   },
+  INVALID_USERINFO_SIGNATURE: {
+    invalidUserinfoSignature: 'Invalid signature on userinfo due to client misconfiguration',
+  },
   EMAIL_ALREADY_IN_USE: {
     emailAlreadyInUse: 'Email already in use',
   },
@@ -31,6 +34,9 @@ module.exports = {
     invalidCodeOrNonce: {
       responseType: 'unauthorized',
     },
+    invalidUserinfoSignature: {
+      responseType: 'unauthorized',
+    },
     emailAlreadyInUse: {
       responseType: 'conflict',
     },
@@ -51,6 +57,7 @@ module.exports = {
         sails.log.warn(`Invalid code or nonce! (IP: ${remoteAddress})`);
         return Errors.INVALID_CODE_OR_NONCE;
       })
+      .intercept('invalidUserinfoSignature', () => Errors.INVALID_USERINFO_SIGNATURE)
       .intercept('emailAlreadyInUse', () => Errors.EMAIL_ALREADY_IN_USE)
       .intercept('usernameAlreadyInUse', () => Errors.USERNAME_ALREADY_IN_USE)
       .intercept('missingValues', () => Errors.MISSING_VALUES);

server/api/controllers/show-config.js

@@ -4,11 +4,16 @@ module.exports = {
     if (sails.hooks.oidc.isActive()) {
       const oidcClient = sails.hooks.oidc.getClient();
 
+      const authorizationUrlParams = {
+        scope: sails.config.custom.oidcScopes,
+      };
+
+      if (!sails.config.custom.oidcUseDefaultResponseMode) {
+        authorizationUrlParams.response_mode = sails.config.custom.oidcResponseMode;
+      }
+
       oidc = {
-        authorizationUrl: oidcClient.authorizationUrl({
+        authorizationUrl: oidcClient.authorizationUrl(authorizationUrlParams),
-          scope: sails.config.custom.oidcScopes,
-          response_mode: 'fragment',
-        }),
         endSessionUrl: oidcClient.issuer.end_session_endpoint ? oidcClient.endSessionUrl({}) : null,
         isEnforced: sails.config.custom.oidcEnforced,
       };

server/api/helpers/users/get-or-create-one-using-oidc.js

@@ -12,6 +12,7 @@ module.exports = {
 
   exits: {
     invalidCodeOrNonce: {},
+    invalidUserinfoSignature: {},
     missingValues: {},
     emailAlreadyInUse: {},
     usernameAlreadyInUse: {},
@@ -34,6 +35,14 @@ module.exports = {
       );
       userInfo = await client.userinfo(tokenSet);
     } catch (e) {
+      if (
+        e instanceof SyntaxError &&
+        e.message.includes('Unexpected token e in JSON at position 0')
+      ) {
+        sails.log.warn('Error while exchanging OIDC code: userinfo response is signed');
+        throw 'invalidUserinfoSignature';
+      }
+
       sails.log.warn(`Error while exchanging OIDC code: ${e}`);
       throw 'invalidCodeOrNonce';
     }

server/api/hooks/oidc/index.js

@@ -25,12 +25,19 @@ module.exports = function defineOidcHook(sails) {
 
       const issuer = await openidClient.Issuer.discover(sails.config.custom.oidcIssuer);
 
-      client = new issuer.Client({
+      const metadata = {
         client_id: sails.config.custom.oidcClientId,
         client_secret: sails.config.custom.oidcClientSecret,
         redirect_uris: [sails.config.custom.oidcRedirectUri],
         response_types: ['code'],
-      });
+        userinfo_signed_response_alg: sails.config.custom.oidcUserinfoSignedResponseAlg,
+      };
+
+      if (sails.config.custom.oidcIdTokenSignedResponseAlg) {
+        metadata.id_token_signed_response_alg = sails.config.custom.oidcIdTokenSignedResponseAlg;
+      }
+
+      client = new issuer.Client(metadata);
     },
 
     getClient() {

server/config/custom.js

@@ -39,7 +39,11 @@ module.exports.custom = {
   oidcIssuer: process.env.OIDC_ISSUER,
   oidcClientId: process.env.OIDC_CLIENT_ID,
   oidcClientSecret: process.env.OIDC_CLIENT_SECRET,
+  oidcIdTokenSignedResponseAlg: process.env.OIDC_ID_TOKEN_SIGNED_RESPONSE_ALG,
+  oidcUserinfoSignedResponseAlg: process.env.OIDC_USERINFO_SIGNED_RESPONSE_ALG,
   oidcScopes: process.env.OIDC_SCOPES || 'openid email profile',
+  oidcResponseMode: process.env.OIDC_RESPONSE_MODE || 'fragment',
+  oidcUseDefaultResponseMode: process.env.OIDC_USE_DEFAULT_RESPONSE_MODE === 'true',
   oidcAdminRoles: process.env.OIDC_ADMIN_ROLES ? process.env.OIDC_ADMIN_ROLES.split(',') : [],
   oidcEmailAttribute: process.env.OIDC_EMAIL_ATTRIBUTE || 'email',
   oidcNameAttribute: process.env.OIDC_NAME_ATTRIBUTE || 'name',