public/mailcow-dockerized
1
0 Fork 0
mirror of https://github.com/mailcow/mailcow-dockerized.git synced 2026-11-05 16:08:21 +00:00
Code Issues Releases Wiki Activity

[Web] OIDC/LDAP: check the OAuth state, keep the mailbox on token refresh, require unique IdP users

Browse Source
This commit is contained in:
FreddleSpl0it committed 2026-11-02 09:54:54 +01:00
1 parent 41467dc47f
commit 5eb3148bd5
5 files changed
+56 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/web/inc/triggers.user.inc.php
+4 -2
View File
@@ -19,8 +19,10 @@ if ($iam_provider){
header('Location: ' . $redirect_uri);
die();
}
} elseif ($_GET['code'] && $_GET['state'] === $_SESSION['oauth2state']) {
// Check given state against previously stored one to mitigate CSRF attack
} elseif (!empty($_GET['code']) && !empty($_SESSION['oauth2state']) && is_string($_GET['state'] ?? null)
&& hash_equals((string)$_SESSION['oauth2state'], $_GET['state'])) {
// Check given state against previously stored one to mitigate CSRF attack, a state is used once
unset($_SESSION['oauth2state']);
// Received access token in $_GET['code']
// extract info and verify user
identity_provider('verify-sso');