github-mirror/framework
github-mirror/framework
2
0
Fork 0
mirror of https://github.com/flarum/framework.git synced 2025-02-22 05:55:25 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1141 from sijad/fix-logout-redirect

Browse Source 
prevent unsafe redirect via logout controller
This commit is contained in:
Toby Zerner 2017-03-04 22:10:18 +10:30 committed by GitHub
commit cf65b28ccf
1 changed files with 15 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
framework/core/src/Forum/Controller/LogOutController.php
View File

@ -11,7 +11,7 @@
namespace Flarum\Forum\Controller; namespace Flarum\Forum\Controller;
use Flarum\Core\User; use Flarum\Core\Access\AssertPermissionTrait;
use Flarum\Event\UserLoggedOut; use Flarum\Event\UserLoggedOut;
use Flarum\Foundation\Application; use Flarum\Foundation\Application;
use Flarum\Http\Controller\ControllerInterface; use Flarum\Http\Controller\ControllerInterface;
@ -24,6 +24,8 @@ use Zend\Diactoros\Response\RedirectResponse;
class LogOutController implements ControllerInterface class LogOutController implements ControllerInterface
{ {
use AssertPermissionTrait;
/** /**
* @var Application * @var Application
*/ */
@ -67,24 +69,24 @@ class LogOutController implements ControllerInterface
{ {
$session = $request->getAttribute('session'); $session = $request->getAttribute('session');
if (array_get($request->getQueryParams(), 'token') !== $session->get('csrf_token')) {
throw new TokenMismatchException;
}
$actor = $request->getAttribute('actor');
$this->assertRegistered($actor);
$url = array_get($request->getQueryParams(), 'return', $this->app->url()); $url = array_get($request->getQueryParams(), 'return', $this->app->url());
$response = new RedirectResponse($url); $response = new RedirectResponse($url);
if ($user = User::find($session->get('user_id'))) { $this->authenticator->logOut($session);
if (array_get($request->getQueryParams(), 'token') !== $session->get('csrf_token')) {
throw new TokenMismatchException;
}
$this->authenticator->logOut($session); $actor->accessTokens()->delete();
$user->accessTokens()->delete(); $this->events->fire(new UserLoggedOut($actor));
$this->events->fire(new UserLoggedOut($user)); return $this->rememberer->forget($response);
$response = $this->rememberer->forget($response);
}
return $response;
} }
} }