4 commits

Author	SHA1	Message	Date
Erik Johnston	243d427fbc	Block clients from sending server ACLs that lock the local server out. (#8708) ... Fixes #4042	2020-11-03 12:13:48 +00:00
Erik Johnston	f21e24ffc2	Add ability for access tokens to belong to one user but grant access to another user. (#8616) ... We do it this way round so that only the "owner" can delete the access token (i.e. `/logout/all` by the "owner" also deletes that token, but `/logout/all` by the "target user" doesn't). A future PR will add an API for creating such a token. When the target user and authenticated entity are different the `Processed request` log line will be logged with a: `{@admin:server as @bob:server} ...`. I'm not convinced by that format (especially since it adds spaces in there, making it harder to use `cut -d ' '` to chop off the start of log lines). Suggestions welcome.	2020-10-29 15:58:44 +00:00
Richard van der Hoff	d9d86c2996	Remove redundant token_id parameter to create_event ... this is always the same as requester.access_token_id.	2020-10-13 23:06:36 +01:00
Erik Johnston	b2486f6656	Fix message duplication if something goes wrong after persisting the event (#8476) ... Should fix #3365.	2020-10-13 12:07:56 +01:00