From 85741fbb6ab829672d8f4f73edaa707637a1d693 Mon Sep 17 00:00:00 2001
From: Victor Costa <vfcosta@gmail.com>
Date: Thu, 2 Oct 2014 11:42:14 -0300
Subject: [PATCH] oauth_client: fix session verification

---
 app/views/account/_signup_form.html.erb                                          |  2 +-
 plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb |  4 ++--
 plugins/oauth_client/lib/oauth_client_plugin.rb                                  | 16 ++++++++++++++--
 plugins/oauth_client/test/unit/oauth_client_plugin_test.rb                       | 18 +++++++++++++++---
 plugins/oauth_client/views/account/_oauth_signup.html.erb                        |  6 +-----
 5 files changed, 33 insertions(+), 13 deletions(-)

diff --git a/app/views/account/_signup_form.html.erb b/app/views/account/_signup_form.html.erb
index 74d1655..28690e3 100644
--- a/app/views/account/_signup_form.html.erb
+++ b/app/views/account/_signup_form.html.erb
@@ -16,7 +16,7 @@
 <input type="hidden" id="signup_time_key" name="signup_time_key" />
 <script type="text/javascript">
   jQuery.ajax({
-    type: "POST",
+    type: "GET",
     url: "<%= url_for :controller=>'account', :action=>'signup_time' %>",
     dataType: 'json',
     success: function(data) {
diff --git a/plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb b/plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb
index eb101e8..834bec2 100644
--- a/plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb
+++ b/plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb
@@ -9,10 +9,10 @@ class OauthClientPluginPublicController < PublicController
       session[:user] = user
       redirect_to :controller => :account, :action => :login
     else
-      session[:oauth_email] = auth.info.email
+      session[:oauth_data] = auth
       name = auth.info.name
       name ||= auth.extra && auth.extra.raw_info ? auth.extra.raw_info.name : ''
-      redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email, :oauth_providers => [{:provider => auth.provider, :uid => auth.uid}]}, :profile_data => {:name => name}
+      redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email}, :profile_data => {:name => name}
     end
   end
 
diff --git a/plugins/oauth_client/lib/oauth_client_plugin.rb b/plugins/oauth_client/lib/oauth_client_plugin.rb
index 2ffa16b..664817d 100644
--- a/plugins/oauth_client/lib/oauth_client_plugin.rb
+++ b/plugins/oauth_client/lib/oauth_client_plugin.rb
@@ -19,7 +19,7 @@ class OauthClientPlugin < Noosfero::Plugin
     plugin = self
 
     proc do
-      unless (plugin.context.params[:user]||{})[:oauth_providers].blank?
+      if plugin.context.session[:oauth_data].present?
         render :partial => 'account/oauth_signup'
       else
         ''
@@ -70,7 +70,19 @@ class OauthClientPlugin < Noosfero::Plugin
   end
 
   def account_controller_filters
-    {:type => 'before_filter', :method_name => 'signup', :block => proc { raise "Wrong email for oauth signup" if request.post? && session[:oauth_email].present? && session[:oauth_email] != params[:user][:email] } }
+    {
+      :type => 'before_filter', :method_name => 'signup',
+      :block => proc {
+        auth = session[:oauth_data]
+
+        if auth.present? && params[:user].present?
+          params[:user][:oauth_providers] = [{:provider => auth.provider, :uid => auth.uid}]
+          if request.post? && auth.info.email != params[:user][:email]
+            raise "Wrong email for oauth signup"
+          end
+        end
+      }
+    }
   end
 
 end
diff --git a/plugins/oauth_client/test/unit/oauth_client_plugin_test.rb b/plugins/oauth_client/test/unit/oauth_client_plugin_test.rb
index db6d8a9..bdec592 100644
--- a/plugins/oauth_client/test/unit/oauth_client_plugin_test.rb
+++ b/plugins/oauth_client/test/unit/oauth_client_plugin_test.rb
@@ -40,7 +40,13 @@ class OauthClientPluginTest < ActiveSupport::TestCase
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
-    stubs(:session).returns({:oauth_email => 'test@example.com'})
+
+    oauth_data = mock
+    info = mock
+    oauth_data.stubs(:info).returns(info)
+    info.stubs(:email).returns('test@example.com')
+    stubs(:session).returns({:oauth_data => oauth_data})
+
     params[:user] = {:email => 'test2@example.com'}
     assert_raises RuntimeError do
       instance_eval(&plugin.account_controller_filters[:block])
@@ -51,12 +57,18 @@ class OauthClientPluginTest < ActiveSupport::TestCase
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
-    stubs(:session).returns({:oauth_email => 'test@example.com'})
+
+    oauth_data = mock
+    info = mock
+    oauth_data.stubs(:info).returns(info)
+    info.stubs(:email).returns('test@example.com')
+    stubs(:session).returns({:oauth_data => oauth_data})
+
     params[:user] = {:email => 'test@example.com'}
     instance_eval(&plugin.account_controller_filters[:block])
   end
 
-  should 'do not raise error if oauth email is not set' do
+  should 'do not raise error if oauth session is not set' do
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
diff --git a/plugins/oauth_client/views/account/_oauth_signup.html.erb b/plugins/oauth_client/views/account/_oauth_signup.html.erb
index 08f48d7..346c0dd 100644
--- a/plugins/oauth_client/views/account/_oauth_signup.html.erb
+++ b/plugins/oauth_client/views/account/_oauth_signup.html.erb
@@ -1,11 +1,7 @@
-<%= hidden_field_tag 'user[oauth_providers][][provider]', @user.oauth_providers.first[:provider] %>
-<%= hidden_field_tag 'user[oauth_providers][][uid]', @user.oauth_providers.first[:uid] %>
 <%= hidden_field_tag 'return_to', '/' %>
 
 <style>
-  #signup-password,
-  #signup-password-confirmation,
-  #signup-email {
+  #signup-password, #signup-password-confirmation, #signup-email {
     display: none;
   }
 </style>
--
libgit2 0.21.2