Use strtok to find QP's in Uri for OAuth redirect processing

diff --git a/src/Module/OAuth/Token.php b/src/Module/OAuth/Token.php
index 7e22a88dabff6c588533c7a504d2309caa71e96e..25c0c69137c61a3441dd9c338a6451122a360faa 100644 (file)
--- a/src/Module/OAuth/Token.php
+++ b/src/Module/OAuth/Token.php
@@ -90,10 +90,10 @@ class Token extends BaseApi
                        $me = null;
                } elseif ($request['grant_type'] == 'authorization_code') {
                        // For security reasons only allow freshly created tokens
-                       $uri = new Uri($request['redirect_uri']);
+                       $redirect_uri = strtok($request['redirect_uri'],'?');
                        $condition = [
                                "`redirect_uri` LIKE ? AND `id` = ? AND `code` = ? AND `created_at` > ?",
-                               '%' . $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath() . '%', $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
+                               $redirect_uri, $application['id'], $request['code'], DateTimeFormat::utc('now - 5 minutes')
                        ];
 
                        $token = DBA::selectFirst('application-view', ['access_token', 'created_at', 'uid'], $condition);

diff --git a/src/Security/OAuth.php b/src/Security/OAuth.php
index 7655398b35118a96fcfbddd3d8e4ec359c25dea4..f6a01a2a87b458ae9c7c69e84c5ff094cce679f2 100644 (file)
--- a/src/Security/OAuth.php
+++ b/src/Security/OAuth.php
@@ -131,8 +131,7 @@ class OAuth
                }
 
                if (!empty($redirect_uri)) {
-                       $uri = new Uri($redirect_uri);
-                       $redirect_uri = $uri->getScheme() . '://' . $uri->getHost() . $uri->getPath();
+                       $redirect_uri = strtok($redirect_uri, '?');
                        $condition = DBA::mergeConditions($condition, ["`redirect_uri` LIKE ?", '%' . $redirect_uri . '%']);
                }
 
@@ -143,6 +142,7 @@ class OAuth
                }
 
                // The redirect_uri could contain several URI that are separated by spaces.
+               $exploded = explode(' ', $application['redirect_uri']);
                if (($application['redirect_uri'] != $redirect_uri) && !in_array($redirect_uri, explode(' ', $application['redirect_uri']))) {
                        return [];
                }