From 348ffd9a018f7c6f268b632afaca4ef6d9671c7c Mon Sep 17 00:00:00 2001 From: silky Date: Tue, 13 Oct 2015 15:22:57 +1100 Subject: [PATCH 1/3] Fixes #42; slightly nicer error message when no 'code' field. --- Yesod/Auth/OAuth2.hs | 21 ++++++++++++--------- yesod-auth-oauth2.cabal | 4 ++-- 2 files changed, 14 insertions(+), 11 deletions(-) diff --git a/Yesod/Auth/OAuth2.hs b/Yesod/Auth/OAuth2.hs index 7a9145d..0c2b6a8 100644 --- a/Yesod/Auth/OAuth2.hs +++ b/Yesod/Auth/OAuth2.hs @@ -102,15 +102,18 @@ authOAuth2Widget widget name oauth getCreds = AuthPlugin name dispatch login deleteSession tokenSessionKey case newToken of Just csrfToken | newToken == oldToken -> do - code <- lift $ runInputGet $ ireq textField "code" - oauth' <- withCallback csrfToken - master <- lift getYesod - result <- liftIO $ fetchAccessToken (authHttpManager master) oauth' (encodeUtf8 code) - case result of - Left _ -> permissionDenied "Unable to retreive OAuth2 token" - Right token -> do - creds <- liftIO $ getCreds (authHttpManager master) token - lift $ setCredsRedirect creds + mcode <- lift $ runInputGet $ iopt textField "code" + case mcode of + Nothing -> permissionDenied "`Code` field not provided." + Just code -> do + oauth' <- withCallback csrfToken + master <- lift getYesod + result <- liftIO $ fetchAccessToken (authHttpManager master) oauth' (encodeUtf8 code) + case result of + Left _ -> permissionDenied "Unable to retreive OAuth2 token" + Right token -> do + creds <- liftIO $ getCreds (authHttpManager master) token + lift $ setCredsRedirect creds _ -> permissionDenied "Invalid OAuth2 state token" diff --git a/yesod-auth-oauth2.cabal b/yesod-auth-oauth2.cabal index 7c25d80..c740627 100644 --- a/yesod-auth-oauth2.cabal +++ b/yesod-auth-oauth2.cabal @@ -1,5 +1,5 @@ name: yesod-auth-oauth2 -version: 0.1.4 +version: 0.1.5 license: BSD3 license-file: LICENSE author: Tom Streller @@ -52,4 +52,4 @@ library source-repository head type: git - location: https://github.com/thoughtbot/authenticate-oauth2.git + location: https://github.com/thoughtbot/yesod-auth-oauth2.git From 60c91306f12cd7bc6a1513fc3b6b27e9b6373dec Mon Sep 17 00:00:00 2001 From: silky Date: Wed, 14 Oct 2015 09:54:21 +1100 Subject: [PATCH 2/3] Fix source repo link --- yesod-auth-oauth2.cabal | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yesod-auth-oauth2.cabal b/yesod-auth-oauth2.cabal index 7c25d80..d1c6be3 100644 --- a/yesod-auth-oauth2.cabal +++ b/yesod-auth-oauth2.cabal @@ -52,4 +52,4 @@ library source-repository head type: git - location: https://github.com/thoughtbot/authenticate-oauth2.git + location: https://github.com/thoughtbot/yesod-auth-oauth2.git From 3efa4175a053c4551398081f195a76eb84899b0d Mon Sep 17 00:00:00 2001 From: silky Date: Wed, 14 Oct 2015 10:26:36 +1100 Subject: [PATCH 3/3] Cleanup as suggested by @pbrisbin --- Yesod/Auth/OAuth2.hs | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/Yesod/Auth/OAuth2.hs b/Yesod/Auth/OAuth2.hs index 7a9145d..bddd68d 100644 --- a/Yesod/Auth/OAuth2.hs +++ b/Yesod/Auth/OAuth2.hs @@ -24,6 +24,7 @@ import Control.Applicative ((<$>)) import Control.Exception.Lifted import Control.Monad.IO.Class +import Control.Monad (unless) import Data.ByteString (ByteString) import Data.Monoid ((<>)) import Data.Text (Text, pack) @@ -35,7 +36,6 @@ import Network.OAuth.OAuth2 import System.Random import Yesod.Auth import Yesod.Core -import Yesod.Form import qualified Data.ByteString.Lazy as BL @@ -97,22 +97,23 @@ authOAuth2Widget widget name oauth getCreds = AuthPlugin name dispatch login lift $ redirect authUrl dispatch "GET" ["callback"] = do - newToken <- lookupGetParam "state" + csrfToken <- requireGetParam "state" oldToken <- lookupSession tokenSessionKey deleteSession tokenSessionKey - case newToken of - Just csrfToken | newToken == oldToken -> do - code <- lift $ runInputGet $ ireq textField "code" - oauth' <- withCallback csrfToken - master <- lift getYesod - result <- liftIO $ fetchAccessToken (authHttpManager master) oauth' (encodeUtf8 code) - case result of - Left _ -> permissionDenied "Unable to retreive OAuth2 token" - Right token -> do - creds <- liftIO $ getCreds (authHttpManager master) token - lift $ setCredsRedirect creds - _ -> - permissionDenied "Invalid OAuth2 state token" + unless (oldToken == (Just csrfToken)) $ permissionDenied "Invalid OAuth2 state token" + code <- requireGetParam "code" + oauth' <- withCallback csrfToken + master <- lift getYesod + result <- liftIO $ fetchAccessToken (authHttpManager master) oauth' (encodeUtf8 code) + case result of + Left _ -> permissionDenied "Unable to retreive OAuth2 token" + Right token -> do + creds <- liftIO $ getCreds (authHttpManager master) token + lift $ setCredsRedirect creds + where + requireGetParam key = do + m <- lookupGetParam key + maybe (permissionDenied $ "'" <> key <> "' parameter not provided") return m dispatch _ _ = notFound