Browse Source
show error page if no valid client identifier is given and if it is not a API request
Signed-off-by: Bjoern Schiessle <bjoern@schiessle.org>
pull/4704/head
Bjoern Schiessle
9 years ago
committed by
Lukas Reschke
No known key found for this signature in database
GPG Key ID: B9F6980CF6E759B1
1 changed files with
24 additions and
5 deletions
-
core/Controller/ClientFlowLoginController.php
|
|
|
@ -151,18 +151,37 @@ class ClientFlowLoginController extends Controller { |
|
|
|
*/ |
|
|
|
public function showAuthPickerPage($clientIdentifier = '', |
|
|
|
$oauthState = '') { |
|
|
|
$stateToken = $this->random->generate( |
|
|
|
64, |
|
|
|
ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
|
|
); |
|
|
|
$this->session->set(self::stateName, $stateToken); |
|
|
|
|
|
|
|
|
|
|
|
$clientName = $this->getClientName(); |
|
|
|
$client = null; |
|
|
|
if($clientIdentifier !== '') { |
|
|
|
$client = $this->clientMapper->getByIdentifier($clientIdentifier); |
|
|
|
$clientName = $client->getName(); |
|
|
|
} |
|
|
|
|
|
|
|
$validClient = $client !== null && $client->getClientIdentifier() !== null; |
|
|
|
$cookieCheckSuccessful = $this->request->passesStrictCookieCheck(); |
|
|
|
|
|
|
|
// no valid clientIdentifier given and no valid API Request (APIRequest header not set)
|
|
|
|
if ($cookieCheckSuccessful === false && $validClient === false) { |
|
|
|
return new TemplateResponse( |
|
|
|
$this->appName, |
|
|
|
'error', |
|
|
|
['errors' => |
|
|
|
[ |
|
|
|
['error' => 'Access Forbidden', 'hint' => 'Invalid request'] |
|
|
|
] |
|
|
|
] |
|
|
|
); |
|
|
|
} |
|
|
|
|
|
|
|
$stateToken = $this->random->generate( |
|
|
|
64, |
|
|
|
ISecureRandom::CHAR_LOWER.ISecureRandom::CHAR_UPPER.ISecureRandom::CHAR_DIGITS |
|
|
|
); |
|
|
|
$this->session->set(self::stateName, $stateToken); |
|
|
|
|
|
|
|
return new TemplateResponse( |
|
|
|
$this->appName, |
|
|
|
'loginflow/authpicker', |
|
|
|
|
