Merge pull request #36552 from nextcloud/fix/client-login-flow/missin…

…g-state-token fix(client-login-flow): Handle missing stateToken gracefully
nextcloud · Feb 6, 2023 · eca7ab3 · eca7ab3
2 parents 3473b69 + 88d116b
commit eca7ab3
Show file tree

Hide file tree

Showing 2 changed files with 32 additions and 3 deletions.
diff --git a/core/Controller/ClientFlowLoginV2Controller.php b/core/Controller/ClientFlowLoginV2Controller.php
@@ -150,7 +150,10 @@ public function showAuthPickerPage($user = ''): StandaloneTemplateResponse {
 	 * @NoSameSiteCookieRequired
 	 */
 	#[UseSession]
-	public function grantPage(string $stateToken): StandaloneTemplateResponse {
+	public function grantPage(?string $stateToken): StandaloneTemplateResponse {
+		if ($stateToken === null) {
+			return $this->stateTokenMissingResponse();
+		}
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -182,7 +185,11 @@ public function grantPage(string $stateToken): StandaloneTemplateResponse {
 	/**
 	 * @PublicPage
 	 */
-	public function apptokenRedirect(string $stateToken, string $user, string $password) {
+	public function apptokenRedirect(?string $stateToken, string $user, string $password) {
+		if ($stateToken === null) {
+			return $this->loginTokenForbiddenResponse();
+		}
+
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -225,7 +232,10 @@ public function apptokenRedirect(string $stateToken, string $user, string $passw
 	 * @NoAdminRequired
 	 */
 	#[UseSession]
-	public function generateAppPassword(string $stateToken): Response {
+	public function generateAppPassword(?string $stateToken): Response {
+		if ($stateToken === null) {
+			return $this->stateTokenMissingResponse();
+		}
 		if (!$this->isValidStateToken($stateToken)) {
 			return $this->stateTokenForbiddenResponse();
 		}
@@ -298,6 +308,19 @@ private function isValidStateToken(string $stateToken): bool {
 		return hash_equals($currentToken, $stateToken);
 	}
 
+	private function stateTokenMissingResponse(): StandaloneTemplateResponse {
+		$response = new StandaloneTemplateResponse(
+			$this->appName,
+			'403',
+			[
+				'message' => $this->l10n->t('State token missing'),
+			],
+			'guest'
+		);
+		$response->setStatus(Http::STATUS_FORBIDDEN);
+		return $response;
+	}
+
 	private function stateTokenForbiddenResponse(): StandaloneTemplateResponse {
 		$response = new StandaloneTemplateResponse(
 			$this->appName,

diff --git a/tests/Core/Controller/ClientFlowLoginV2ControllerTest.php b/tests/Core/Controller/ClientFlowLoginV2ControllerTest.php
@@ -187,6 +187,12 @@ public function testShowAuthPickerValidLoginToken() {
 		$this->controller->showAuthPickerPage();
 	}
 
+	public function testGrantPageNoStateToken(): void {
+		$result = $this->controller->grantPage(null);
+
+		$this->assertSame(Http::STATUS_FORBIDDEN, $result->getStatus());
+	}
+
 	public function testGrantPageInvalidStateToken() {
 		$this->session->method('get')
 			->willReturnCallback(function ($name) {