mirror of
https://we.phorge.it/source/phorge.git
synced 2024-12-04 20:52:43 +01:00
d22495a820
Summary: Depends on D20113. Ref T6703. Continue moving toward a future where multiple copies of a given type of provider may exist. Switch MFA from session-MFA at the start to one-shot MFA at the actual link action. Add one-shot MFA to the unlink action. This theoretically prevents an attacker from unlinking an account while you're getting coffee, registering `alIce` which they control, adding a copy of your profile picture, and then trying to trick you into writing a private note with your personal secrets or something. Test Plan: Linked and unlinked accounts. Refreshed account. Unlinked, then registered a new account. Unlinked, then relinked to my old account. Reviewers: amckinley Reviewed By: amckinley Maniphest Tasks: T6703 Differential Revision: https://secure.phabricator.com/D20117
79 lines
2.2 KiB
PHP
79 lines
2.2 KiB
PHP
<?php
|
|
|
|
final class PhabricatorAuthConfirmLinkController
|
|
extends PhabricatorAuthController {
|
|
|
|
public function handleRequest(AphrontRequest $request) {
|
|
$viewer = $this->getViewer();
|
|
$accountkey = $request->getURIData('akey');
|
|
|
|
$result = $this->loadAccountForRegistrationOrLinking($accountkey);
|
|
list($account, $provider, $response) = $result;
|
|
|
|
if ($response) {
|
|
return $response;
|
|
}
|
|
|
|
if (!$provider->shouldAllowAccountLink()) {
|
|
return $this->renderError(pht('This account is not linkable.'));
|
|
}
|
|
|
|
$panel_uri = '/settings/panel/external/';
|
|
|
|
if ($request->isFormOrHisecPost()) {
|
|
$workflow_key = sprintf(
|
|
'account.link(%s)',
|
|
$account->getPHID());
|
|
|
|
$hisec_token = id(new PhabricatorAuthSessionEngine())
|
|
->setWorkflowKey($workflow_key)
|
|
->requireHighSecurityToken($viewer, $request, $panel_uri);
|
|
|
|
$account->setUserPHID($viewer->getPHID());
|
|
$account->save();
|
|
|
|
$this->clearRegistrationCookies();
|
|
|
|
// TODO: Send the user email about the new account link.
|
|
|
|
return id(new AphrontRedirectResponse())->setURI($panel_uri);
|
|
}
|
|
|
|
$dialog = $this->newDialog()
|
|
->setTitle(pht('Confirm %s Account Link', $provider->getProviderName()))
|
|
->addCancelButton($panel_uri)
|
|
->addSubmitButton(pht('Confirm Account Link'));
|
|
|
|
$form = id(new PHUIFormLayoutView())
|
|
->setFullWidth(true)
|
|
->appendChild(
|
|
phutil_tag(
|
|
'div',
|
|
array(
|
|
'class' => 'aphront-form-instructions',
|
|
),
|
|
pht(
|
|
'Confirm the link with this %s account. This account will be '.
|
|
'able to log in to your Phabricator account.',
|
|
$provider->getProviderName())))
|
|
->appendChild(
|
|
id(new PhabricatorAuthAccountView())
|
|
->setUser($viewer)
|
|
->setExternalAccount($account)
|
|
->setAuthProvider($provider));
|
|
|
|
$dialog->appendChild($form);
|
|
|
|
$crumbs = $this->buildApplicationCrumbs();
|
|
$crumbs->addTextCrumb(pht('Confirm Link'), $panel_uri);
|
|
$crumbs->addTextCrumb($provider->getProviderName());
|
|
$crumbs->setBorder(true);
|
|
|
|
return $this->newPage()
|
|
->setTitle(pht('Confirm External Account Link'))
|
|
->setCrumbs($crumbs)
|
|
->appendChild($dialog);
|
|
}
|
|
|
|
|
|
}
|