upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-08 16:26:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

Merge pull request #36586 from nextcloud/backport/36552/stable24

Browse source 
[stable24] fix(client-login-flow): Handle missing stateToken gracefully
This commit is contained in:
Julius Härtl 2023-03-06 12:53:53 +01:00 committed by GitHub
commit 6452b9dd4f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
core/Controller/ClientFlowLoginV2Controller.php
View file

@ -157,7 +157,10 @@ class ClientFlowLoginV2Controller extends Controller {
* @NoCSRFRequired
* @NoSameSiteCookieRequired
*/
public function grantPage(string $stateToken): StandaloneTemplateResponse {
public function grantPage(?string $stateToken): StandaloneTemplateResponse {
if ($stateToken === null) {
return $this->stateTokenMissingResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -189,7 +192,11 @@ class ClientFlowLoginV2Controller extends Controller {
/**
* @PublicPage
*/
public function apptokenRedirect(string $stateToken, string $user, string $password) {
public function apptokenRedirect(?string $stateToken, string $user, string $password) {
if ($stateToken === null) {
return $this->stateTokenMissingResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -232,7 +239,10 @@ class ClientFlowLoginV2Controller extends Controller {
* @NoAdminRequired
* @UseSession
*/
public function generateAppPassword(string $stateToken): Response {
public function generateAppPassword(?string $stateToken): Response {
if ($stateToken === null) {
return $this->stateTokenMissingResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -305,6 +315,19 @@ class ClientFlowLoginV2Controller extends Controller {
return hash_equals($currentToken, $stateToken);
}
private function stateTokenMissingResponse(): StandaloneTemplateResponse {
$response = new StandaloneTemplateResponse(
$this->appName,
'403',
[
'message' => $this->l10n->t('State token missing'),
],
'guest'
);
$response->setStatus(Http::STATUS_FORBIDDEN);
return $response;
}
private function stateTokenForbiddenResponse(): StandaloneTemplateResponse {
$response = new StandaloneTemplateResponse(
$this->appName,

6
tests/Core/Controller/ClientFlowLoginV2ControllerTest.php
View file

@ -188,6 +188,12 @@ class ClientFlowLoginV2ControllerTest extends TestCase {
$this->controller->showAuthPickerPage();
}
public function testGrantPageNoStateToken(): void {
$result = $this->controller->grantPage(null);
$this->assertSame(Http::STATUS_FORBIDDEN, $result->getStatus());
}
public function testGrantPageInvalidStateToken() {
$this->session->method('get')
->willReturnCallback(function ($name) {