lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Validate the oauthstateanticsrf value.

Browse Source
This commit is contained in:
Laurent Destailleur 2022-01-19 23:01:50 +01:00
parent 3ae63cb111
commit 4be8cb5ded
1 changed files with 47 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
htdocs/core/modules/oauth/google_oauthcallback.php
View File

@ -119,10 +119,10 @@ if ($action == 'delete') {
if (GETPOST('code')) { // We are coming from oauth provider page. if (GETPOST('code')) { // We are coming from oauth provider page.
dol_syslog("We are coming from the oauth provider page"); dol_syslog("We are coming from the oauth provider page");
// TODO // We must validate that the $state is the same than the one into $_SESSION['oauthstateanticsrf'], return error if not.
// We should validate that the $sate is same than the one into $_SESSION['oauthstateanticsrf'], return error if not. if (isset($_SESSION['oauthstateanticsrf']) && $state == $_SESSION['oauthstateanticsrf']) {
print 'Value for state = '.dol_escape_htmltag($state).' differs from value in $_SESSION["oauthstateanticsrf"]. Code is refused.';
} else {
// This was a callback request from service, get the token // This was a callback request from service, get the token
try { try {
//var_dump($_GET['code']); //var_dump($_GET['code']);
@ -170,6 +170,7 @@ if (GETPOST('code')) { // We are coming from oauth provider page.
} catch (Exception $e) { } catch (Exception $e) {
print $e->getMessage(); print $e->getMessage();
} }
}
} else { } else {
// If we enter this page without 'code' parameter, we arrive here. this is the case when we want to get the redirect // If we enter this page without 'code' parameter, we arrive here. this is the case when we want to get the redirect
// to the OAuth provider login page // to the OAuth provider login page
@ -190,6 +191,9 @@ if (GETPOST('code')) { // We are coming from oauth provider page.
// Add more param // Add more param
$url .= '&nonce='.bin2hex(random_bytes(64/8)); $url .= '&nonce='.bin2hex(random_bytes(64/8));
// TODO Add param hd and/or login_hint // TODO Add param hd and/or login_hint
if (!preg_match('/^forlogin/', $state)) {
//$url .= 'hd=xxx';
}
// we go on oauth provider authorization page // we go on oauth provider authorization page
header('Location: '.$url); header('Location: '.$url);
@ -201,6 +205,6 @@ if (GETPOST('code')) { // We are coming from oauth provider page.
* View * View
*/ */
// No view at all, just actions, so we never reach this line, except on error. // No view at all, just actions, so we never reach this line.
$db->close(); $db->close();