Page MenuHomePhabricator

Oauthclient-php does not check API response for validity
Closed, ResolvedPublic

Description

From Client::complete():

$data = $this->makeOAuthCall( $requestToken, $tokenUrl );
$return = $this->decodeJson( $data );
$accessToken = new Token( $return->key, $return->secret );

The case when the response is valid JSON but doesn't contain the expected keys isn't handled nicely. Apparently this can happen.

Event Timeline

Change 900747 had a related patch set uploaded (by BryanDavis; author: Bryan Davis):

[mediawiki/oauthclient-php@master] Client: check for expected values in token return

https://gerrit.wikimedia.org/r/900747

Change 900747 merged by jenkins-bot:

[mediawiki/oauthclient-php@master] Client: check for expected values in token return

https://gerrit.wikimedia.org/r/900747

Tgr assigned this task to bd808.

Okay, apparently this happens on (some?) errors, in which case the expected keys are error (code) and message. We should be handling that more nicely.

Change 901323 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/oauthclient-php@master] [WIP] Log errors returned by server in nicer format

https://gerrit.wikimedia.org/r/901323

Change 901330 had a related patch set uploaded (by Gergő Tisza; author: Gergő Tisza):

[mediawiki/vagrant@master] oauth: Expose oauthclient-php demo to web

https://gerrit.wikimedia.org/r/901330

Change 901330 merged by jenkins-bot:

[mediawiki/vagrant@master] oauth: Expose oauthclient-php demo to web

https://gerrit.wikimedia.org/r/901330

Change 901323 merged by jenkins-bot:

[mediawiki/oauthclient-php@master] Log errors returned by server in nicer format

https://gerrit.wikimedia.org/r/901323

bd808 subscribed.

Fixed in oauhclient 2.0.0.