This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new 706f25c6d [OPENMEETINGS-2834] state is set and checked during OAuth
login
706f25c6d is described below
commit 706f25c6d42169f3e0502d4559c18c474f326c50
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Tue Sep 8 09:15:25 2026 +0700
[OPENMEETINGS-2834] state is set and checked during OAuth login
---
.../openmeetings/installation/ImportInitvalues.java | 2 +-
.../org/apache/openmeetings/web/app/UserManager.java | 5 +++--
.../org/apache/openmeetings/web/app/WebSession.java | 10 ++++++++++
.../apache/openmeetings/web/pages/auth/SignInPage.java | 17 +++++++++++------
4 files changed, 25 insertions(+), 9 deletions(-)
diff --git
a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java
b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java
index 2643f3305..88bd3b16a 100644
---
a/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java
+++
b/openmeetings-install/src/main/java/org/apache/openmeetings/installation/ImportInitvalues.java
@@ -519,7 +519,7 @@ public class ImportInitvalues {
.setEnabled(false)
.setClientId(CLIENT_PLACEHOLDER)
.setClientSecret(SECRET_PLACEHOLDER)
-
.setRequestKeyUrl("https://oauth.yandex.ru/authorize?response_type=code&client_id={$client_id}";)
+
.setRequestKeyUrl("https://oauth.yandex.ru/authorize?response_type=code&client_id={$client_id}";)
// &redirect_uri={$redirect_uri} is optional, can be taken from client_id
.setRequestTokenUrl("https://oauth.yandex.ru/token";)
.setRequestTokenMethod(RequestTokenMethod.POST)
.setRequestTokenAttributes("grant_type=authorization_code&code={$code}&client_id={$client_id}&client_secret={$client_secret}")
diff --git
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/UserManager.java
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/UserManager.java
index 7391d9cce..17778dbe0 100644
---
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/UserManager.java
+++
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/UserManager.java
@@ -344,12 +344,13 @@ public class UserManager implements IUserManager {
Map<String, String> params = new HashMap<>();
params.put("{$client_id}", s.getClientId());
params.put("{$redirect_uri}", getRedirectUri(s));
- params.put("{$state}", randomUUID().toString());
return params;
}
public static void showAuth(final OAuthServer s) {
- String authUrl = prepareUrl(s.getRequestKeyUrl(),
getInitParams(s));
+ final String state = randomUUID().toString();
+ WebSession.get().setOauthState(state);
+ String authUrl = prepareUrl(s.getRequestKeyUrl(),
getInitParams(s)) + "&state=" + state;
log.debug("redirectUrl={}", authUrl);
throw new RedirectToUrlException(authUrl);
}
diff --git
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/WebSession.java
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/WebSession.java
index 3ceb92044..f46231d87 100644
---
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/WebSession.java
+++
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/app/WebSession.java
@@ -118,6 +118,7 @@ public class WebSession extends
AbstractAuthenticatedWebSession implements IWebS
private Long roomId = null;
private Long recordingId = null;
private boolean kickedByAdmin = false;
+ private String oauthState = null;
private ExtendedClientProperties extProps = new
ExtendedClientProperties();
@Inject
private ClientManager cm;
@@ -158,6 +159,7 @@ public class WebSession extends
AbstractAuthenticatedWebSession implements IWebS
recordingId = null;
tz = null;
browserTz = null;
+ oauthState = null;
extProps = new ExtendedClientProperties();
}
@@ -430,6 +432,14 @@ public class WebSession extends
AbstractAuthenticatedWebSession implements IWebS
return get().roomId;
}
+ public String getOauthState() {
+ return oauthState;
+ }
+
+ public void setOauthState(String oauthState) {
+ this.oauthState = oauthState;
+ }
+
public Invitation getInvitation() {
return invitation;
}
diff --git
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInPage.java
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInPage.java
index 19cc0668f..85ed1b306 100644
---
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInPage.java
+++
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/pages/auth/SignInPage.java
@@ -119,14 +119,19 @@ public class SignInPage extends BaseInitedPage {
public SignInPage(PageParameters p) throws InterruptedException {
super();
- WebSession.get().checkToken(p.get(TOKEN_PARAM));
+ WebSession ws = WebSession.get();
+ ws.checkToken(p.get(TOKEN_PARAM));
if (WebSession.get().isSignedIn()) {
setResponsePage(Application.get().getHomePage());
}
- StringValue oauthid = p.get("oauthid");
- if (!oauthid.isEmpty()) { // oauth2 login
+ StringValue oauthId = p.get("oauthid");
+ StringValue oauthState = p.get("state");
+ if (!oauthId.isEmpty() && ws.getOauthState() != null &&
!oauthState.isEmpty()
+ &&
ws.getOauthState().equals(oauthState.toString()))
+ { // oauth2 login
try {
- long serverId = oauthid.toLong(-1);
+ ws.setOauthState(null);
+ long serverId = oauthId.toLong(-1);
OAuthServer server = oauthDao.get(serverId);
log.debug("OAuthServer={}", server);
if (server == null) {
@@ -136,7 +141,7 @@ public class SignInPage extends BaseInitedPage {
User u =
userManager.loginOAuth(p.get("code").toOptionalString(), server);
- if (u != null && WebSession.get().signIn(u)) {
+ if (u != null && ws.signIn(u)) {
setResponsePage(Application.get().getHomePage());
} else {
log.error("Failed to login via
OAuth2!");
@@ -150,7 +155,7 @@ public class SignInPage extends BaseInitedPage {
StringValue login = pp.getParameterValue("login"), password =
pp.getParameterValue("password");
if (!login.isEmpty() && !password.isEmpty()) {
try {
- if (WebSession.get().signIn(login.toString(),
password.toString(), Type.USER, null)) {
+ if (ws.signIn(login.toString(),
password.toString(), Type.USER, null)) {
setResponsePage(Application.get().getHomePage());
} else {
log.error("Failed to login using POST
parameters passed");
