oauth_client: fix session verification

Victor Costa
1 parent 7c98d685
Showing 5 changed files with 33 additions and 13 deletions Show diff stats
app/views/account/_signup_form.html.erb
plugins/oauth_client/controllers/public/oauth_client_plugin_public_controller.rb
plugins/oauth_client/lib/oauth_client_plugin.rb
plugins/oauth_client/test/unit/oauth_client_plugin_test.rb
plugins/oauth_client/views/account/_oauth_signup.html.erb
@@ -16,7 +16,7 @@
 <input type="hidden" id="signup_time_key" name="signup_time_key" />
 <script type="text/javascript">
   jQuery.ajax({
-    type: "POST",
+    type: "GET",
     url: "<%= url_for :controller=>'account', :action=>'signup_time' %>",
     dataType: 'json',
     success: function(data) {
@@ -9,10 +9,10 @@ class OauthClientPluginPublicController &lt; PublicController
       session[:user] = user
       redirect_to :controller => :account, :action => :login
     else
-      session[:oauth_email] = auth.info.email
+      session[:oauth_data] = auth
       name = auth.info.name
       name ||= auth.extra && auth.extra.raw_info ? auth.extra.raw_info.name : ''
-      redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email, :oauth_providers => [{:provider => auth.provider, :uid => auth.uid}]}, :profile_data => {:name => name}
+      redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email}, :profile_data => {:name => name}
     end
   end
@@ -19,7 +19,7 @@ class OauthClientPlugin &lt; Noosfero::Plugin
     plugin = self
     proc do
-      unless (plugin.context.params[:user]||{})[:oauth_providers].blank?
+      if plugin.context.session[:oauth_data].present?
         render :partial => 'account/oauth_signup'
       else
         ''
@@ -70,7 +70,19 @@ class OauthClientPlugin &lt; Noosfero::Plugin
   end
   def account_controller_filters
-    {:type => 'before_filter', :method_name => 'signup', :block => proc { raise "Wrong email for oauth signup" if request.post? && session[:oauth_email].present? && session[:oauth_email] != params[:user][:email] } }
+    {
+      :type => 'before_filter', :method_name => 'signup',
+      :block => proc {
+        auth = session[:oauth_data]
+
+        if auth.present? && params[:user].present?
+          params[:user][:oauth_providers] = [{:provider => auth.provider, :uid => auth.uid}]
+          if request.post? && auth.info.email != params[:user][:email]
+            raise "Wrong email for oauth signup"
+          end
+        end
+      }
+    }
   end
 end
@@ -40,7 +40,13 @@ class OauthClientPluginTest &lt; ActiveSupport::TestCase
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
-    stubs(:session).returns({:oauth_email => 'test@example.com'})
+
+    oauth_data = mock
+    info = mock
+    oauth_data.stubs(:info).returns(info)
+    info.stubs(:email).returns('test@example.com')
+    stubs(:session).returns({:oauth_data => oauth_data})
+
     params[:user] = {:email => 'test2@example.com'}
     assert_raises RuntimeError do
       instance_eval(&plugin.account_controller_filters[:block])
@@ -51,12 +57,18 @@ class OauthClientPluginTest &lt; ActiveSupport::TestCase
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
-    stubs(:session).returns({:oauth_email => 'test@example.com'})
+
+    oauth_data = mock
+    info = mock
+    oauth_data.stubs(:info).returns(info)
+    info.stubs(:email).returns('test@example.com')
+    stubs(:session).returns({:oauth_data => oauth_data})
+
     params[:user] = {:email => 'test@example.com'}
     instance_eval(&plugin.account_controller_filters[:block])
   end
-  should 'do not raise error if oauth email is not set' do
+  should 'do not raise error if oauth session is not set' do
     request = mock
     stubs(:request).returns(request)
     request.expects(:post?).returns(true)
-<%= hidden_field_tag 'user[oauth_providers][][provider]', @user.oauth_providers.first[:provider] %>
-<%= hidden_field_tag 'user[oauth_providers][][uid]', @user.oauth_providers.first[:uid] %>
 <%= hidden_field_tag 'return_to', '/' %>
 <style>
-  #signup-password,
-  #signup-password-confirmation,
-  #signup-email {
+  #signup-password, #signup-password-confirmation, #signup-email {
     display: none;
   }
 </style>
	@@ -16,7 +16,7 @@		@@ -16,7 +16,7 @@
16	<input type="hidden" id="signup_time_key" name="signup_time_key" />	16	<input type="hidden" id="signup_time_key" name="signup_time_key" />
17	<script type="text/javascript">	17	<script type="text/javascript">
18	jQuery.ajax({	18	jQuery.ajax({
19	- type: "POST",	19	+ type: "GET",
20	url: "<%= url_for :controller=>'account', :action=>'signup_time' %>",	20	url: "<%= url_for :controller=>'account', :action=>'signup_time' %>",
21	dataType: 'json',	21	dataType: 'json',
22	success: function(data) {	22	success: function(data) {
	@@ -9,10 +9,10 @@ class OauthClientPluginPublicController < PublicController		@@ -9,10 +9,10 @@ class OauthClientPluginPublicController < PublicController
9	session[:user] = user	9	session[:user] = user
10	redirect_to :controller => :account, :action => :login	10	redirect_to :controller => :account, :action => :login
11	else	11	else
12	- session[:oauth_email] = auth.info.email	12	+ session[:oauth_data] = auth
13	name = auth.info.name	13	name = auth.info.name
14	name \|\|= auth.extra && auth.extra.raw_info ? auth.extra.raw_info.name : ''	14	name \|\|= auth.extra && auth.extra.raw_info ? auth.extra.raw_info.name : ''
15	- redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email, :oauth_providers => [{:provider => auth.provider, :uid => auth.uid}]}, :profile_data => {:name => name}	15	+ redirect_to :controller => :account, :action => :signup, :user => {:login => login, :email => auth.info.email}, :profile_data => {:name => name}
16	end	16	end
17	end	17	end
18		18