diff --git a/modules/authfacebook/extlibinc/base_facebook.php b/modules/authfacebook/extlibinc/base_facebook.php index a5fd3e9043db0edc0fc683e6d5f596e06f9da660..cd4536db1a59b5b48fe8b396a78aa356b229defd 100644 --- a/modules/authfacebook/extlibinc/base_facebook.php +++ b/modules/authfacebook/extlibinc/base_facebook.php @@ -698,7 +698,7 @@ abstract class BaseFacebook $this->clearPersistentData('state'); return $_REQUEST['code']; } else { - self::errorLog('CSRF state token does not match one provided.'); + self::errorLog('CSRF state token does not match one provided. ' . $this->state . '!=' . $_REQUEST['state']); return false; } } diff --git a/modules/authfacebook/lib/Auth/Source/Facebook.php b/modules/authfacebook/lib/Auth/Source/Facebook.php index 1a85e2bcded8e15813aaef2bed74a4394d787918..990659946162df91b5169916c2cff8848513c6e1 100644 --- a/modules/authfacebook/lib/Auth/Source/Facebook.php +++ b/modules/authfacebook/lib/Auth/Source/Facebook.php @@ -91,7 +91,7 @@ class sspmod_authfacebook_Auth_Source_Facebook extends SimpleSAML_Auth_Source { $facebook = new sspmod_authfacebook_Facebook(array('appId' => $this->api_key, 'secret' => $this->secret), $state); $facebook->destroySession(); - $linkback = SimpleSAML\Module::getModuleURL('authfacebook/linkback.php', array('AuthState' => $stateID)); + $linkback = SimpleSAML\Module::getModuleURL('authfacebook/linkback.php'); $url = $facebook->getLoginUrl(array('redirect_uri' => $linkback, 'scope' => $this->req_perms)); SimpleSAML_Auth_State::saveState($state, self::STAGE_INIT); diff --git a/modules/authfacebook/lib/Facebook.php b/modules/authfacebook/lib/Facebook.php index 530853fbf9ad58fff79d499b9403374a9514643f..42153933c2fb2a23ca526067514a7ecbb1ceedf6 100644 --- a/modules/authfacebook/lib/Facebook.php +++ b/modules/authfacebook/lib/Facebook.php @@ -146,4 +146,11 @@ class sspmod_authfacebook_Facebook extends BaseFacebook } return implode('_', $parts); } + + protected function establishCSRFTokenState() { + if ($this->state === null) { + $this->state = SimpleSAML_Auth_State::getStateId($this->ssp_state); + $this->setPersistentData('state', $this->state); + } + } } diff --git a/modules/authfacebook/www/linkback.php b/modules/authfacebook/www/linkback.php index 6ca8855bcc9c5d22dacb518933970861dd28412f..94adb167289de6490ed6cc6083121b194aad2f18 100644 --- a/modules/authfacebook/www/linkback.php +++ b/modules/authfacebook/www/linkback.php @@ -3,11 +3,15 @@ /** * Handle linkback() response from Facebook. */ - -if (!array_key_exists('AuthState', $_REQUEST) || empty($_REQUEST['AuthState'])) { - throw new SimpleSAML_Error_BadRequest('Missing state parameter on facebook linkback endpoint.'); + +// For backwards compatability look for AuthState first +if (array_key_exists('AuthState', $_REQUEST) && !empty($_REQUEST['AuthState'])) { + $state = SimpleSAML_Auth_State::loadState($_REQUEST['AuthState'], sspmod_authfacebook_Auth_Source_Facebook::STAGE_INIT); +} elseif (array_key_exists('state', $_REQUEST) && !empty($_REQUEST['state'])) { + $state = SimpleSAML_Auth_State::loadState($_REQUEST['state'], sspmod_authfacebook_Auth_Source_Facebook::STAGE_INIT); +} else { + throw new SimpleSAML_Error_BadRequest('Missing state parameter on facebook linkback endpoint.'); } -$state = SimpleSAML_Auth_State::loadState($_REQUEST['AuthState'], sspmod_authfacebook_Auth_Source_Facebook::STAGE_INIT); // Find authentication source if (!array_key_exists(sspmod_authfacebook_Auth_Source_Facebook::AUTHID, $state)) {