{"push_id":545549784,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"fd57c475f4fb954faa62d7973d6c8382b5b6401f","before":"4c0cf6a78779452e5f5963b18bdfa223d9689c5d","commits":[{"sha":"fd57c475f4fb954faa62d7973d6c8382b5b6401f","author":{"email":"bdd34a8470f598a81c9df4d4621fcb4fc5dcf7ba@gmail.com","name":"Tute Costa"},"message":"Remove wildcard_redirect_uri option\n\nThis possibility combined with open redirectors (common in omniauth\nclients, to redirect back to where user were) can leak information, with\nURLs like:\n\nhttp://lh:3000/oauth/authorize?client_id=123&redirect_uri=http%3A%2F%2FCLIENT.com/callback/../open_redirect?to=http://evil.com&response_type=token\n\nThis changeset undos work merged in\nhttps://github.com/doorkeeper-gem/doorkeeper/pull/337\n\nWe can keep state between client and provider via the `state` OAuth\nparameter, so no functionality should be lost.\n\nThanks @homakov for your help on this.","distinct":true,"url":"https://api.github.com/repos/doorkeeper-gem/doorkeeper/commits/fd57c475f4fb954faa62d7973d6c8382b5b6401f"}]}