mirror of
https://we.phorge.it/source/phorge.git
synced 2024-09-23 02:38:48 +02:00
8c3ef4b73c
Summary: Ref T1445. Ref T1536. Although we have separate CSRF protection and have never been vulnerable to OAuth hijacking, properly implementing the "state" parameter provides a little more certainty. Before OAuth, we set a random value on the client, and pass its hash as the "state" parameter. Upon return, validate that (a) the user has a nonempty "phcid" cookie and (b) the OAuth endpoint passed back the correct state (the hash of that cookie). Test Plan: Logged in with all OAuth providers, which all apparently support `state`. Reviewers: btrahan Reviewed By: btrahan CC: aran, arice Maniphest Tasks: T1445, T1536 Differential Revision: https://secure.phabricator.com/D6179
57 lines
1.6 KiB
PHP
57 lines
1.6 KiB
PHP
<?php
|
|
|
|
abstract class PhabricatorAuthController extends PhabricatorController {
|
|
|
|
public function buildStandardPageResponse($view, array $data) {
|
|
$page = $this->buildStandardPageView();
|
|
|
|
$page->setApplicationName(pht('Login'));
|
|
$page->setBaseURI('/login/');
|
|
$page->setTitle(idx($data, 'title'));
|
|
$page->appendChild($view);
|
|
|
|
$response = new AphrontWebpageResponse();
|
|
return $response->setContent($page->render());
|
|
}
|
|
|
|
protected function renderErrorPage($title, array $messages) {
|
|
$view = new AphrontErrorView();
|
|
$view->setTitle($title);
|
|
$view->setErrors($messages);
|
|
|
|
return $this->buildApplicationPage(
|
|
$view,
|
|
array(
|
|
'title' => $title,
|
|
'device' => true,
|
|
'dust' => true,
|
|
));
|
|
|
|
}
|
|
|
|
protected function establishWebSession(PhabricatorUser $user) {
|
|
$session_key = $user->establishSession('web');
|
|
|
|
$request = $this->getRequest();
|
|
|
|
// NOTE: We allow disabled users to login and roadblock them later, so
|
|
// there's no check for users being disabled here.
|
|
|
|
$request->setCookie('phusr', $user->getUsername());
|
|
$request->setCookie('phsid', $session_key);
|
|
|
|
// Clear the registration key.
|
|
$request->clearCookie('phreg');
|
|
|
|
// Clear the client ID / OAuth state key.
|
|
$request->clearCookie('phcid');
|
|
}
|
|
|
|
protected function buildLoginValidateResponse(PhabricatorUser $user) {
|
|
$validate_uri = new PhutilURI($this->getApplicationURI('validate/'));
|
|
$validate_uri->setQueryParam('phusr', $user->getUsername());
|
|
|
|
return id(new AphrontRedirectResponse())->setURI((string)$validate_uri);
|
|
}
|
|
|
|
}
|