upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-04-26 00:27:49 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 29

Merge pull request #36552 from nextcloud/fix/client-login-flow/missing-state-token

Browse source 
fix(client-login-flow): Handle missing stateToken gracefully
This commit is contained in:
Christoph Wurst 2023-02-06 16:51:25 +01:00 committed by GitHub
commit eca7ab3221
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 32 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
core/Controller/ClientFlowLoginV2Controller.php
View file

@ -150,7 +150,10 @@ class ClientFlowLoginV2Controller extends Controller {
* @NoSameSiteCookieRequired
*/
#[UseSession]
public function grantPage(string $stateToken): StandaloneTemplateResponse {
public function grantPage(?string $stateToken): StandaloneTemplateResponse {
if ($stateToken === null) {
return $this->stateTokenMissingResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -182,7 +185,11 @@ class ClientFlowLoginV2Controller extends Controller {
/**
* @PublicPage
*/
public function apptokenRedirect(string $stateToken, string $user, string $password) {
public function apptokenRedirect(?string $stateToken, string $user, string $password) {
if ($stateToken === null) {
return $this->loginTokenForbiddenResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -225,7 +232,10 @@ class ClientFlowLoginV2Controller extends Controller {
* @NoAdminRequired
*/
#[UseSession]
public function generateAppPassword(string $stateToken): Response {
public function generateAppPassword(?string $stateToken): Response {
if ($stateToken === null) {
return $this->stateTokenMissingResponse();
}
if (!$this->isValidStateToken($stateToken)) {
return $this->stateTokenForbiddenResponse();
}
@ -298,6 +308,19 @@ class ClientFlowLoginV2Controller extends Controller {
return hash_equals($currentToken, $stateToken);
}
private function stateTokenMissingResponse(): StandaloneTemplateResponse {
$response = new StandaloneTemplateResponse(
$this->appName,
'403',
[
'message' => $this->l10n->t('State token missing'),
],
'guest'
);
$response->setStatus(Http::STATUS_FORBIDDEN);
return $response;
}
private function stateTokenForbiddenResponse(): StandaloneTemplateResponse {
$response = new StandaloneTemplateResponse(
$this->appName,

6
tests/Core/Controller/ClientFlowLoginV2ControllerTest.php
View file

@ -187,6 +187,12 @@ class ClientFlowLoginV2ControllerTest extends TestCase {
$this->controller->showAuthPickerPage();
}
public function testGrantPageNoStateToken(): void {
$result = $this->controller->grantPage(null);
$this->assertSame(Http::STATUS_FORBIDDEN, $result->getStatus());
}
public function testGrantPageInvalidStateToken() {
$this->session->method('get')
->willReturnCallback(function ($name) {