mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Make magic strings of ClientFlowLogin and v2 publicly available 

Signed-off-by: Joas Schilling <coding@schilljs.com>
This commit is contained in:
Joas Schilling 2020-07-17 09:05:16 +02:00
parent 79c677e26d
commit 543fabe279
No known key found for this signature in database
GPG Key ID: 7076EA9751AACDDA
2 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
core/Controller/ClientFlowLoginController.php
View File

@ -78,7 +78,7 @@ class ClientFlowLoginController extends Controller {
/** @var EventDispatcherInterface */ /** @var EventDispatcherInterface */
private $eventDispatcher; private $eventDispatcher;
public const stateName = 'client.flow.state.token'; public const STATE_NAME = 'client.flow.state.token';
/** /**
* @param string $appName * @param string $appName
@ -135,7 +135,7 @@ class ClientFlowLoginController extends Controller {
* @return bool * @return bool
*/ */
private function isValidToken($stateToken) { private function isValidToken($stateToken) {
$currentToken = $this->session->get(self::stateName); $currentToken = $this->session->get(self::STATE_NAME);
if (!is_string($stateToken) || !is_string($currentToken)) { if (!is_string($stateToken) || !is_string($currentToken)) {
return false; return false;
} }
@ -198,7 +198,7 @@ class ClientFlowLoginController extends Controller {
64, 64,
ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS
); );
$this->session->set(self::stateName, $stateToken); $this->session->set(self::STATE_NAME, $stateToken);
$csp = new Http\ContentSecurityPolicy(); $csp = new Http\ContentSecurityPolicy();
if ($client) { if ($client) {
@ -286,11 +286,11 @@ class ClientFlowLoginController extends Controller {
public function generateAppPassword($stateToken, public function generateAppPassword($stateToken,
$clientIdentifier = '') { $clientIdentifier = '') {
if (!$this->isValidToken($stateToken)) { if (!$this->isValidToken($stateToken)) {
$this->session->remove(self::stateName); $this->session->remove(self::STATE_NAME);
return $this->stateTokenForbiddenResponse(); return $this->stateTokenForbiddenResponse();
} }
$this->session->remove(self::stateName); $this->session->remove(self::STATE_NAME);
try { try {
$sessionId = $this->session->getId(); $sessionId = $this->session->getId();
@ -343,7 +343,7 @@ class ClientFlowLoginController extends Controller {
$this->accessTokenMapper->insert($accessToken); $this->accessTokenMapper->insert($accessToken);
$redirectUri = $client->getRedirectUri(); $redirectUri = $client->getRedirectUri();
if (parse_url($redirectUri, PHP_URL_QUERY)) { if (parse_url($redirectUri, PHP_URL_QUERY)) {
$redirectUri .= '&'; $redirectUri .= '&';
} else { } else {

18
core/Controller/ClientFlowLoginV2Controller.php
View File

@ -44,8 +44,8 @@ use OCP\IURLGenerator;
use OCP\Security\ISecureRandom; use OCP\Security\ISecureRandom;
class ClientFlowLoginV2Controller extends Controller { class ClientFlowLoginV2Controller extends Controller {
private const tokenName = 'client.flow.v2.login.token'; public const TOKEN_NAME = 'client.flow.v2.login.token';
private const stateName = 'client.flow.v2.state.token'; public const STATE_NAME = 'client.flow.v2.state.token';
/** @var LoginFlowV2Service */ /** @var LoginFlowV2Service */
private $loginFlowV2Service; private $loginFlowV2Service;
@ -105,7 +105,7 @@ class ClientFlowLoginV2Controller extends Controller {
return $this->loginTokenForbiddenResponse(); return $this->loginTokenForbiddenResponse();
} }
$this->session->set(self::tokenName, $token); $this->session->set(self::TOKEN_NAME, $token);
return new RedirectResponse( return new RedirectResponse(
$this->urlGenerator->linkToRouteAbsolute('core.ClientFlowLoginV2.showAuthPickerPage') $this->urlGenerator->linkToRouteAbsolute('core.ClientFlowLoginV2.showAuthPickerPage')
@ -128,7 +128,7 @@ class ClientFlowLoginV2Controller extends Controller {
64, 64,
ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS
); );
$this->session->set(self::stateName, $stateToken); $this->session->set(self::STATE_NAME, $stateToken);
return new StandaloneTemplateResponse( return new StandaloneTemplateResponse(
$this->appName, $this->appName,
@ -188,11 +188,11 @@ class ClientFlowLoginV2Controller extends Controller {
return $this->loginTokenForbiddenResponse(); return $this->loginTokenForbiddenResponse();
} }
$loginToken = $this->session->get(self::tokenName); $loginToken = $this->session->get(self::TOKEN_NAME);
// Clear session variables // Clear session variables
$this->session->remove(self::tokenName); $this->session->remove(self::TOKEN_NAME);
$this->session->remove(self::stateName); $this->session->remove(self::STATE_NAME);
$sessionId = $this->session->getId(); $sessionId = $this->session->getId();
$result = $this->loginFlowV2Service->flowDone($loginToken, $sessionId, $this->getServerPath(), $this->userId); $result = $this->loginFlowV2Service->flowDone($loginToken, $sessionId, $this->getServerPath(), $this->userId);
@ -240,7 +240,7 @@ class ClientFlowLoginV2Controller extends Controller {
} }
private function isValidStateToken(string $stateToken): bool { private function isValidStateToken(string $stateToken): bool {
$currentToken = $this->session->get(self::stateName); $currentToken = $this->session->get(self::STATE_NAME);
if (!is_string($stateToken) || !is_string($currentToken)) { if (!is_string($stateToken) || !is_string($currentToken)) {
return false; return false;
} }
@ -265,7 +265,7 @@ class ClientFlowLoginV2Controller extends Controller {
* @throws LoginFlowV2NotFoundException * @throws LoginFlowV2NotFoundException
*/ */
private function getFlowByLoginToken(): LoginFlowV2 { private function getFlowByLoginToken(): LoginFlowV2 {
$currentToken = $this->session->get(self::tokenName); $currentToken = $this->session->get(self::TOKEN_NAME);
if (!is_string($currentToken)) { if (!is_string($currentToken)) {
throw new LoginFlowV2NotFoundException('Login token not set in session'); throw new LoginFlowV2NotFoundException('Login token not set in session');
} }