From da8b0e89fa9da82fc7965955e7c0639a65d6ac00 Mon Sep 17 00:00:00 2001 From: Marcel Werk Date: Mon, 14 Sep 2020 14:31:34 +0200 Subject: [PATCH] Expired session during 3rd party auth led to a SystemException --- wcfsetup/install/files/lib/action/FacebookAuthAction.class.php | 2 +- wcfsetup/install/files/lib/action/GithubAuthAction.class.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/wcfsetup/install/files/lib/action/FacebookAuthAction.class.php b/wcfsetup/install/files/lib/action/FacebookAuthAction.class.php index ab50f7e87f..d4ea40b358 100644 --- a/wcfsetup/install/files/lib/action/FacebookAuthAction.class.php +++ b/wcfsetup/install/files/lib/action/FacebookAuthAction.class.php @@ -68,7 +68,7 @@ class FacebookAuthAction extends AbstractAction { } // validate state, validation of state is executed after fetching the access_token to invalidate 'code' - if (!isset($_GET['state']) || !\hash_equals(WCF::getSession()->getVar('__facebookInit'), $_GET['state'])) throw new IllegalLinkException(); + if (!isset($_GET['state']) || !WCF::getSession()->getVar('__facebookInit') || !\hash_equals(WCF::getSession()->getVar('__facebookInit'), $_GET['state'])) throw new IllegalLinkException(); WCF::getSession()->unregister('__facebookInit'); try { diff --git a/wcfsetup/install/files/lib/action/GithubAuthAction.class.php b/wcfsetup/install/files/lib/action/GithubAuthAction.class.php index db95872029..559db9f5f6 100644 --- a/wcfsetup/install/files/lib/action/GithubAuthAction.class.php +++ b/wcfsetup/install/files/lib/action/GithubAuthAction.class.php @@ -64,7 +64,7 @@ class GithubAuthAction extends AbstractAction { } // validate state, validation of state is executed after fetching the access_token to invalidate 'code' - if (!isset($_GET['state']) || !\hash_equals(WCF::getSession()->getVar('__githubInit'), $_GET['state'])) throw new IllegalLinkException(); + if (!isset($_GET['state']) || !WCF::getSession()->getVar('__githubInit') || !\hash_equals(WCF::getSession()->getVar('__githubInit'), $_GET['state'])) throw new IllegalLinkException(); WCF::getSession()->unregister('__githubInit'); parse_str($content, $data); -- 2.20.1