Bug 1196743 - Fix information disclosure vulnerability that allows attacker to obtain victim's GitHub OAuth return code

1 files changed, 10 insertions, 0 deletions

diff --git a/Bugzilla.pm b/Bugzilla.pm
index 96f7cd0d2..a219d5bde 100644
--- a/Bugzilla.pm
+++ b/Bugzilla.pm
@@ -353,6 +353,16 @@ sub page_requires_login {
     return $_[0]->request_cache->{page_requires_login};
 }
 
+sub github_secret {
+    my ($class) = @_;
+    my $cache = $class->request_cache;
+    my $cgi   = $class->cgi;
+
+    $cache->{github_secret} //= $cgi->cookie('github_secret') // generate_random_password(16);
+
+    return $cache->{github_secret};
+}
+
 sub login {
     my ($class, $type) = @_;