diff options
author | Dave Lawrence <dlawrence@mozilla.com> | 2013-09-26 17:10:35 +0200 |
---|---|---|
committer | Dave Lawrence <dlawrence@mozilla.com> | 2013-09-26 17:10:35 +0200 |
commit | 4180e54e7b2c2a147954425312bf1cd485b14d24 (patch) | |
tree | 09e9a938e21d5ea1d2b267cdb8131d071212a11b /Bugzilla/Auth/Login/Cookie.pm | |
parent | 69016099b3a2ae057f5e33ec30545a8209589446 (diff) | |
download | bugzilla-4180e54e7b2c2a147954425312bf1cd485b14d24.tar.gz bugzilla-4180e54e7b2c2a147954425312bf1cd485b14d24.tar.xz |
Bug 917669 - invalid or expired authentication tokens and cookies should throw errors, not be silently ignored
Diffstat (limited to 'Bugzilla/Auth/Login/Cookie.pm')
-rw-r--r-- | Bugzilla/Auth/Login/Cookie.pm | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/Bugzilla/Auth/Login/Cookie.pm b/Bugzilla/Auth/Login/Cookie.pm index 88c48e236..4f4ef80ab 100644 --- a/Bugzilla/Auth/Login/Cookie.pm +++ b/Bugzilla/Auth/Login/Cookie.pm @@ -21,6 +21,7 @@ use base qw(Bugzilla::Auth::Login); use Bugzilla::Constants; use Bugzilla::Util; +use Bugzilla::Error; use List::Util qw(first); @@ -80,7 +81,9 @@ sub get_login_info { AND (ipaddr = ? OR ipaddr IS NULL)', undef, ($login_cookie, $user_id, $ip_addr)); - # If the cookie is valid, return a valid username. + # If the cookie or token is valid, return a valid username. + # If they were not valid and we are using a webservice, then + # throw an error notifying the client. if ($is_valid) { # If we logged in successfully, then update the lastused # time on the login cookie @@ -88,12 +91,16 @@ sub get_login_info { WHERE cookie = ?", undef, $login_cookie); return { user_id => $user_id }; } + elsif (i_am_webservice()) { + ThrowUserError('invalid_cookies_or_token'); + } } - # Either the he cookie is invalid, or we got no cookie. We don't want - # to ever return AUTH_LOGINFAILED, because we don't want Bugzilla to - # actually throw an error when it gets a bad cookie. It should just - # look like there was no cookie to begin with. + # Either the cookie or token is invalid and we are not authenticating + # via a webservice, or we did not receive a cookie or token. We don't + # want to ever return AUTH_LOGINFAILED, because we don't want Bugzilla to + # actually throw an error when it gets a bad cookie or token. It should just + # look like there was no cookie or token to begin with. return { failure => AUTH_NODATA }; } @@ -104,9 +111,7 @@ sub login_token { return $self->{'_login_token'} if exists $self->{'_login_token'}; - if ($usage_mode ne USAGE_MODE_XMLRPC - && $usage_mode ne USAGE_MODE_JSON - && $usage_mode ne USAGE_MODE_REST) { + if (!i_am_webservice()) { return $self->{'_login_token'} = undef; } |