← All changes | includes/API/Controller/EntryController.php +34 -25 2.10.1 → 3.3.1 View file →

		@@ -17,40 +17,49 @@
17	17	{
18	18	$this->formModel = new FormModel();
19	19	}
20	20
21		- public function googleAuth()
	21	+ // public function oneDriveAuth()
	22	+ // {
	23	+ // $state = $_GET['state'];
	24	+ // $code = urlencode($_GET['code']);
	25	+ // // echo $code;
	26	+ // if (wp_redirect($state . '&code=' . $code, 302)) {
	27	+ // exit;
	28	+ // }
	29	+ // }
	30	+
	31	+ public function authRedirect(WP_REST_Request $request)
22	32	{
23		- $state = $_GET['state'];
24		- $code = urlencode($_GET['code']);
25		- // echo $code;
26		- if (wp_redirect($state . '&code=' . $code, 302)) {
27		- exit;
	33	+ $state = $request->get_param('state');
	34	+ $site_url = $this->getDomain(get_site_url());
	35	+ $state_domain = $this->getDomain($state);
	36	+
	37	+ // the refused domain is caller-supplied; echoing it back reflects attacker
	38	+ // input into the response of a public endpoint
	39	+ if ('' === $state_domain || $site_url !== $state_domain) {
	40	+ return new WP_Error('404', 'Invalid redirect URL');
28	41	}
29		- }
30	42
31		- public function oneDriveAuth()
32		- {
33		- $state = $_GET['state'];
34		- $code = urlencode($_GET['code']);
35		- // echo $code;
36		- if (wp_redirect($state . '&code=' . $code, 302)) {
	43	+ $params = $request->get_params();
	44	+ unset($params['rest_route'], $params['state']);
	45	+
	46	+ $redirect_url = $state . '&' . http_build_query($params);
	47	+
	48	+ if (wp_safe_redirect($redirect_url, 302)) {
37	49	exit;
38	50	}
39	51	}
40	52
41		- public function authRedirect(WP_REST_Request $request)
	53	+ private function getDomain($url)
42	54	{
43		- $state = $request->get_param('state');
44		- $parsed_url = wp_parse_url(get_site_url());
45		- $site_url = $parsed_url['scheme'] . '://' . $parsed_url['host'];
46		- $site_url .= empty($parsed_url['port']) ? null : ':' . $parsed_url['port'];
47		- if (false === strpos($state, $site_url)) {
48		- return new WP_Error('404');
	55	+ // these endpoints are public: a missing or non-URL state must not raise
	56	+ // notices, it must simply fail the same-origin comparison
	57	+ $parsed_url = is_string($url) && '' !== $url ? wp_parse_url($url) : false;
	58	+ if (!is_array($parsed_url) || empty($parsed_url['scheme']) || empty($parsed_url['host'])) {
	59	+ return '';
49	60	}
50		- $params = $request->get_params();
51		- unset($params['rest_route'], $params['state']);
52		- if (wp_redirect($state . '&' . http_build_query($params), 302)) {
53		- exit;
54		- }
	61	+ $domain = $parsed_url['scheme'] . '://' . $parsed_url['host'];
	62	+ $domain .= empty($parsed_url['port']) ? null : ':' . $parsed_url['port'];
	63	+ return $domain;
55	64	}
56	65	}